CVE Vulnerability Catalog

In the Linux kernel's DRBD module, there is a vulnerability due to not rejecting data replies with an out-of-range payload size. A malicious or man-in-the-middle DRBD peer can send a reply with a negative size, leading to copying data beyond a bio page and corrupting kernel memory.

In the Linux kernel for RISC-V, there is a NULL pointer dereference vulnerability in machine_kexec_prepare(). The pointer image->segment[i].buf can be NULL and is copied without a check, potentially causing a system crash.

In the Linux kernel's tracing/osnoise module, there is a missing synchronize_rcu() call during unregistering. This can lead to use-after-free when RCU readers are still traversing the instance list.

In the Linux kernel for s390, the function memtop_get_page_count() lacks an array_index_nospec() call, allowing speculative execution with a user-controlled 'level' value used to read from an array.

In the Linux kernel's cgroup/cpuset module, there is a divide-by-zero error when rebinding a memory policy with MPOL_F_RELATIVE_NODES in response to a CPU hotplug event. The issue arises from using cs->mems_allowed instead of cs->effective_mems.

In the Linux kernel's pmdomain module for i.MX93, there is an issue with shared control bits for clock and reset between DSI and CSI domains. This can lead to incorrect behavior if one domain disables shared resources while the other is still active.

In the Linux kernel's pmdomain module for MediaTek, there is a potential NULL pointer dereference during cleanup or on-check of HW_VOTER type power domains. Functions are called without checking the domain type, which can lead to a system crash.

In the Linux kernel's pmdomain module for i.MX8MP, there is an issue with the VC8000E power up sequence. According to the errata, it is necessary to gate off the clock before powering up and enable it after, to avoid handshake hang.

In the Linux kernel's mlx5 driver, there is a memory leak when repeatedly allocating and freeing mkeys with TPH hints. After removing the entry from idx_xa, the mlx5_st_idx_data structure was never freed, causing the leak to grow.

In the rt2x00 driver in the Linux kernel, rt2x00lib_probe_dev() uses the full teardown path for all probe failures, even when work structures are not yet initialized. This can lead to invalid work drains and DEBUG_OBJECTS reports.

In the Linux kernel's ieee80211_register_hw(), there is a memory leak when kmemdup() fails while copying band structures. The error path skips rate_control_deinitialize(), leaking local->rate_ctrl.

In the brcmfmac driver in the Linux kernel, there is a heap overflow when processing short authentication frames. The frame length can be less than the management header, causing arithmetic wrap and copying a huge amount of data beyond the buffer.

In the Linux kernel's Bluetooth btrtl driver, there is a vulnerability due to improper bounds checking of firmware patches. A too-short patch can cause arithmetic underflow and lead to oversized read/write during Bluetooth setup.

In the Linux kernel's memstick ms_block driver, there is an out-of-bounds write vulnerability when a card reports too many blocks. This can corrupt the data structure and potentially lead to code execution.

In the Linux kernel's IPVS, there are errors in calculating IPv6 transport offsets. The TCP app code assumed an IPv4 network header, which can cause issues with apps over IPv6. The ICMPV6 header offset was also corrected.

In the Linux kernel's IPVS, after calling skb_ensure_writable(), which may reallocate skb->head, the IP header pointer was not reloaded, potentially leading to use of a stale pointer.

In the Linux kernel's sunxi reset driver, there is a resource leak when ioremap() fails. The memory region obtained via request_mem_region() is not released.

In the Linux kernel's powerpc/spufs driver, there is an out-of-bounds access in spufs_mem_mmap_access(). The offset is checked against vm_end instead of the local store size, allowing access beyond the buffer.

In the Linux kernel, the mask_user_address() function incorrectly checks for CONFIG_E500 instead of CONFIG_PPC_E500, preventing mask_user_address_isel() from being used on E500 hardware. The fix corrects the check to use the proper name.

In the Linux kernel's cfg80211 subsystem, a vulnerability exists due to missing validation of the EHT MLE type and size before reading the MLD ID. A malicious access point can send a short EHT MLE in an MBSSID beacon, leading to an out-of-bounds read by ieee80211_mle_get_mld_id(). The fix adds validation before the read.