CVE Vulnerability Catalog

In the Linux kernel's memstick ms_block driver, there is an out-of-bounds write vulnerability when a card reports too many blocks. This can corrupt the data structure and potentially lead to code execution.

In the Linux kernel's IPVS, there are errors in calculating IPv6 transport offsets. The TCP app code assumed an IPv4 network header, which can cause issues with apps over IPv6. The ICMPV6 header offset was also corrected.

In the Linux kernel's IPVS, after calling skb_ensure_writable(), which may reallocate skb->head, the IP header pointer was not reloaded, potentially leading to use of a stale pointer.

In the Linux kernel's sunxi reset driver, there is a resource leak when ioremap() fails. The memory region obtained via request_mem_region() is not released.

In the Linux kernel's powerpc/spufs driver, there is an out-of-bounds access in spufs_mem_mmap_access(). The offset is checked against vm_end instead of the local store size, allowing access beyond the buffer.

In the Linux kernel, the mask_user_address() function incorrectly checks for CONFIG_E500 instead of CONFIG_PPC_E500, preventing mask_user_address_isel() from being used on E500 hardware. The fix corrects the check to use the proper name.

In the Linux kernel's cfg80211 subsystem, a vulnerability exists due to missing validation of the EHT MLE type and size before reading the MLD ID. A malicious access point can send a short EHT MLE in an MBSSID beacon, leading to an out-of-bounds read by ieee80211_mle_get_mld_id(). The fix adds validation before the read.

In the Linux kernel, the ieee80211_mle_common_size() function has an issue with validating the common info length in MLE elements. For Reconfiguration and Priority Access types, the length is not correctly checked, potentially leading to improper reads. The fix accounts for the Reconfiguration length and validates the length for all known MLE types.

In the Linux kernel's mac80211 subsystem, a vulnerability exists due to missing validation of extension frame layout before processing. Unsupported extension subtypes can reach code that reads regular headers, potentially leading to improper reads. The fix adds validation and appropriate processing paths for S1G beacon frames.

In the Linux kernel, the mwifiex driver has a vulnerability causing permanently busy Wi-Fi scans after multiple roam iterations. The issue stems from incorrect power-save state (ps_state) handling during association response processing, leading to a missing sleep confirmation and blocking subsequent scans.

In the Linux kernel's MTD subsystem (virt-concat), a memory leak exists: the mtd_virt_concat_create_join() function creates a new name on every MTD registration, and when the name already exists, it does not free the newly allocated string. The fix adds freeing the temporary name before continuing.

In the Linux kernel's mchp23k256 driver for MTD, there is an issue with selecting chip capacity data: the driver uses of_device_get_match_data(), which when matched via SPI id table leads to using default data instead of the correct one. The fix changes to spi_get_device_match_data() to use SPI table data when OF data is absent.

In the Linux kernel's NAND driver lpc32xx_slc, there is an issue with DMA timeout handling: lpc32xx_xmit_dma() ignores the result of wait_for_completion_timeout(), causing a timed-out DMA transfer to be reported as successful. The fix returns -ETIMEDOUT and terminates the DMA channel before unmapping the scatterlist.

In the Linux kernel's sdhci-esdhc-imx driver, there is an issue in esdhc_change_pinstate(): it checks for pins_100mhz and pins_200mhz at the top and returns an error if either is missing, preventing the default pin state from being restored. The fix moves the checks into their respective switch cases.

In the Linux kernel's sdhci-esdhc-imx driver, there is an issue with unhandled interrupt during system suspend: the usdhc interrupt is not disabled during suspend when device_may_wakeup() returns false, leading to a "nobody cared" warning. The fix unconditionally disables the usdhc interrupt during suspend and re-enables it during resume.

In the Linux kernel, the sdhci-esdhc-imx MMC driver replaces pm_runtime_get_sync() with pm_runtime_resume_and_get() in the suspend path. The new function automatically drops the usage counter on failure, simplifying error handling. If it fails, the device is unclocked and accessing hardware registers would cause a kernel panic, so the error is returned immediately.

In the Linux kernel BPF subsystem, the verifier rejects variable offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. The issue arises because constant offsets were moved to reg->var_off, while __check_buffer_access() only checks the instruction offset. For writable raw tracepoints, an access with a negative offset can wrap the calculated end, allowing a program to bypass validation.

In the Linux kernel, the fwnode_init() function did not initialize all fields of the fwnode_handle structure. If a firmware node is allocated on the stack or heap without zeroing, the secondary pointer may contain uninitialized memory, potentially leading to dereferencing. The fix sets fwnode->secondary to NULL and initializes the remaining fields of the structure.

A vulnerability in the Linux kernel's f2fs filesystem can cause a deadlock in f2fs_balance_fs() when the filesystem space is nearly exhausted. This results in processes and writeback workers being blocked for over 120 seconds, indicating a severe system hang.

In the Linux kernel f2fs filesystem, a potential deadlock was found in the gc_merge path of f2fs_balance_fs(). When the device is mounted with the gc_merge mount option, a deadlock can occur between the write thread, garbage collector thread, and truncate process. The fix calls f2fs_submit_merged_write() and f2fs_submit_all_merged_ipu_writes() in the GC_MERGE path to commit cached writes, similar to the NOGC_MERGE path.