CVE Vulnerability Catalog

In the Linux kernel's ksmbd (SMB3) subsystem, two related vulnerabilities were found: reuse of the fp->node list head causing list corruption and a reference count race leading to use-after-free (UAF) during durable handle cleanup by ksmbd_durable_scavenger().

In the Linux kernel, a missing lock around the tc_count increment in smb2_find_smb_sess_tcon_unlocked() was found. This issue arose after a refactoring of CIFS code that changed locking from cifs_tcp_ses_lock to tc_lock but did not cover this specific location.

A vulnerability was found in the Linux kernel's IOAM implementation for IPv6. The ipv6_hop_ioam() function fails to refresh the hdr pointer after a potential data buffer reallocation by skb_ensure_writable(), leading to a Use-After-Free condition.

In the bcmgenet driver for Broadcom chips, a vulnerability causes RX traffic to stall after EEE activation. Setting RBUF_EEE_EN and RBUF_PM_EN bits in RBUF_ENERGY_CTRL prevents RBUF from forwarding frames to DMA, stopping rx_packets increment and potentially causing a paging fault. Reproduced on Pi 4B and Broadcom 4908-family boards.

In the Linux kernel, a use-after-free vulnerability was found in the mlx5e driver in the mlx5e_tx_reporter_timeout_recover function. The issue occurs when the function accesses sq->netdev after mlx5e_safe_reopen_channels() has torn down and freed the channel (and its SQs). The fix replaces three sq->netdev references with priv->netdev, which is safe because priv outlives channel teardown.

In the Linux kernel's ixgbevf driver, a use-after-free vulnerability was found in ixgbevf_clean_rx_irq(). During VEPA multicast source pruning, after freeing the skb buffer, the pointer is not nullified, leading to a dereference of freed memory in the next loop iteration.

In the Linux kernel's KVM for ARM64, a vulnerability was found in the emulated ITS (Interrupt Translation Service) controller. The function restoring Device Table Entries (DTE) did not validate the number of EventID bits, allowing restoration of an out-of-range value larger than supported by the virtual ITS.

In the Linux kernel, the RDMA/siw (Soft-iWARP) driver lacks validation of the MPA header length in received FPDU frames. A malicious remote peer can send a frame with an mpa_len smaller than the required DDP/RDMAP header, causing a signed integer underflow and leading to a use-after-free memory read.

A TOCTOU (time-of-check time-of-use) vulnerability was found in the Linux kernel's batman-adv implementation. During local TT-based TVLV generation, the VLAN count is checked first, then a buffer is allocated. Despite holding a lock, the number of TT entries per VLAN can increase between check and allocation, causing a buffer overflow.

In the Linux kernel, the batman-adv module has a vulnerability where the last_changeset_len field is declared as signed short (s16) but never intended to hold negative values. Assigning a value greater than 32767 wraps it to a negative signed integer, causing incorrect sign extension when widened to s32 in batadv_send_my_tt_response(). This results in allocating a full-sized buffer but populating only a small portion, leaving the rest uninitialized.

In the Linux kernel, a use-after-free vulnerability was found in the ARM FFA firmware driver's notification handling. Notification handlers look up a callback pointer under a lock but invoke it after dropping the lock, allowing a concurrent unregister to delete and free the memory.

A vulnerability was found in the Linux kernel's netfs filesystem, related to cancellation of DIO and single read requests. The bug occurs when preparation of a new read subrequest fails and the subrequest has already been added to the list, leading to improper reference management and potential race conditions.

In the Linux kernel, missing locking was found when adding new subrequests in retry functions for read and write operations in the netfs filesystem. This vulnerability could lead to data races and system instability.

In the Linux kernel's netfs subsystem, missing memory barriers were found when accessing the stream->subrequests list without locks. Reader functions may see incomplete data because the NETFS_SREQ_IN_PROGRESS flag might not be visible yet. The fix adds proper release/acquire barriers to list operations.

A vulnerability was found in the Linux kernel's netfs_read_to_pagecache() function, which fails to pause the generation of new subrequests after a subrequest failure. The fix adds a pause in subrequest generation upon error.

A use-after-free vulnerability was found in the Linux kernel's netfs subsystem in netfs_read_gaps(), where a sink folio was released prematurely. This can lead to memory corruption and potential exploitation.

In the Linux kernel, a vulnerability was found in the cortina (Gemini Ethernet) network driver. A static local SKB buffer used for reassembling packets from fragments in gmac_rx() is shared between two Ethernet ports, potentially causing race conditions when both ports are used simultaneously.

In the Linux kernel, a vulnerability was found in the Cortina Ethernet driver where the fragment counter (frag_nr) is reset during packet reception in the gmac_rx() function. When the ring buffer is completely emptied during a poll cycle, the fragment counter is reset even though the packet is not yet fully assembled in the SKB, potentially causing incorrect packet reassembly.

In the Linux kernel, a vulnerability was found in the TLS implementation due to an off-by-one error when chaining wrapped sk_msg rings using sg_chain(). The chain pointer is placed at MAX_SKB_FRAGS instead of the last entry, potentially causing incorrect cryptographic operations.

A vulnerability in the Linux kernel's TLS implementation creates an invalid scatterlist chain when end=0 (start!=0), resulting in a chain-after-chain scenario. This passes illegal input to the crypto layer, potentially causing errors or security breaches.