CVE Vulnerability Catalog

A data race on the death_list in the Linux kernel's Rust Binder driver was found. An unsafe remove operation can run concurrently with moving items to a local list, corrupting prev/next pointers and causing system crashes.

An out-of-bounds read was found in the rtw_get_ie() IE parser in the staging rtl8723bs driver in the Linux kernel. The IE length was not validated, allowing reads beyond the frame buffer or infinite loops on malicious frames.

In the staging rtl8723bs driver in the Linux kernel, a stack buffer overflow was found during Association Request frame parsing. The Supported Rates IE length from the frame was used directly as the memcpy() length when copying into a fixed-size 16-byte stack buffer, allowing a malicious station to cause a stack overflow by advertising an IE length larger than 16 bytes.

An out-of-bounds read was found in the Extended Supported Rates (ESR) IE parsing in the OnBeacon function in the staging rtl8723bs driver in the Linux kernel. Lack of bounds checking can cause kernel panics on malicious beacon frames.

In the Linux kernel, the blocker tracking mechanism assumed lock pointers are at least 4-byte aligned to use their lower bits for type encoding. On architectures like m68k that only guarantee 2-byte alignment for 32-bit values, this assumption is broken, causing WARN_ON_ONCE warnings. The fix adjusts runtime checks to silently ignore locks that are not 4-byte aligned, disabling the feature in such cases.

In the Linux kernel's ksmbd module, a socket leak occurs when the per-IP connection limit is exceeded. The accepted socket is not closed, enabling a remote DoS attack.

In the NFS client (Linux kernel), a missing check of the cert_serial and privkey_serial fields in nfs_match_client() was found when using the TLS security policy of type RPC_XPRTSEC_TLS_X509. This could lead to incorrect client identification.

In the Linux kernel, a race condition in the IPv4 routing subsystem allows rt_bind_exception() to bind a new dst to a stale fnhe entry that is about to be freed, causing a permanent dst reference leak and device reference leak, visible as a hang during net device unregistration (e.g., sit interfaces).

W jądrze systemu Linux zidentyfikowano podatność w funkcji binfmt_misc, która nie przywraca dostępu do zapisu przed zamknięciem plików otwartych przez open_exec(). W przypadku wystąpienia błędu, zamknięcie pliku nie przywraca uprawnień do zapisu, co może prowadzić do niepowodzenia kolejnych operacji zapisu na tym samym pliku.

In the Linux kernel, in the io_uring subsystem for network commands, the skb_queue_splice() function received transposed arguments when retrying timestamp retrieval. This caused packets to be spliced in the wrong direction, into the on-stack list instead of the socket queue. The fix reverses the arguments to restore correct behavior.

A race condition in the Linux kernel's veth driver can permanently stall the TX queue, observed on ARM64 systems (Ampere Altra Max). This leads to a complete halt of network traffic.

In the Linux kernel's SMB client, an incomplete backport of a fix misses a kref_put() call in cfids_invalidation_worker(). This can lead to a use-after-free (UAF) vulnerability.

A lockdep WARN was found in the NVMe multipath driver in the Linux kernel due to partition scan work. The dependency among open_mutex, kblockd workqueue, and partition scan can lead to a deadlock.

In the Linux kernel ice driver, a vulnerability was found due to improper cleanup of PTP resources during driver removal in an error path. Missing calls to ice_ptp_cleanup_pf and deinitialization of the 'ps_lock' mutex cause a warning and call trace when freeing the ice_adapter object.

In the Linux kernel's statmount_string() function, an uninitialized 'offp' pointer exists for STATMOUNT_MNT_UIDMAP and STATMOUNT_MNT_GIDMAP flags, which can lead to dereferencing uninitialized memory.

In the Linux kernel, the widen_imprecise_scalars() function in BPF fails to account for differences in stack depth between states, potentially causing out-of-bounds stack memory access.

In the DRM driver for Intel Xe GPUs (drm/xe/guc), a missing synchronization during device unbind allows the Dead CT worker to run after resources are freed, leading to a use-after-free condition.

In the Linux kernel netfilter subsystem, a vulnerability was found where the seqadj extension is missing for NATted connections when a conntrack helper is assigned. This causes kernel warnings and incorrect NAT translation for FTP traffic in PASV/EPSV modes, potentially leading to connection drops.

W jądrze Linuxa rozwiązano podatność polegającą na obecności dwóch nieprawidłowych instrukcji BUG_ON() w module drm/amdgpu. Mogą one być łatwo wywołane przez użytkowników przestrzeni użytkowej.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.