CVE Vulnerability Catalog

In the Linux kernel, the RDMA/rxe driver has a race condition in do_task() during draining, potentially leading to a use-after-free due to incorrect task state overwriting.

In the Linux kernel, the iommu/vt-d driver has an issue with dirty page tracking when the page walk is incoherent. Dirty page tracking relies on the IOMMU atomically updating the dirty bit in the paging-structure entry, which requires coherent memory between IOMMU and CPU. If the page walk is incoherent, the operation can result in a non-recoverable fault. The fix marks SSADS as supported only when both ecap_slads and ecap_smpwc are supported.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's F2FS filesystem in the f2fs_merge_page_bio() function. The issue is caused by a race condition where a bounce page used for encryption is freed before being accessed, leading to a NULL pointer dereference and kernel panic.

In the D-Link network driver in the Linux kernel, a missing memory allocation failure handling was found in the copy_thresh function. A failed skb allocation can lead to NULL pointer dereference and system crash.

W jądrze Linuxa rozwiązano podatność związaną z vhost i vringh, polegającą na niewłaściwej weryfikacji wartości zwracanej. Problem dotyczy funkcji copy_from_iter i copy_to_iter, które nie powinny zwracać wartości ujemnych, a sprawdzanie długości skopiowanych danych powinno być poprawne.

In the Linux kernel's uio_hv_generic driver, the default interrupt mask setting was removed because it should be fully controlled by userspace. Concurrent mask changes by the driver and user application could cause missed interrupts and system hangs.

In the Linux kernel, the io_waitid_wait() function (io_uring module) had an issue with removing the wait queue entry. On successful return, the entry should always be removed from the wait queue list. Previously this was skipped if a cancellation was in progress, which could race with another invocation of the wait queue entry callback.

In the Linux kernel, the io_uring/zcrx subsystem has a bug causing overshooting of the receive limit. Double counting of buffers in frag lists allows a request to receive more data than requested.

In the Linux kernel, the wcd937x audio codec driver (ASoC) had an issue where the SoundWire port for HPHL_COMP and HPHR_COMP was incorrectly set to zero. This can lead to memory corruption by accessing the -1th element of the port_map array.

In the Linux kernel, a vulnerability in the UDF filesystem allows an out-of-bounds read when handling Allocation Extent Descriptors. Malformed on-disk data can cause udf_update_tag() to call crc_itu_t() on out-of-bounds memory, triggering a KASAN use-after-free read.

In the NFC NCI subsystem of the Linux kernel, a missing packet data validation was found. The nci_valid_size() function did not validate data properly, potentially leading to processing of uninitialized memory and information leak.

In the Linux kernel for LoongArch architecture, a vulnerability was found in the BPF mechanism where return values from struct operations were not properly sign-extended. This caused pointers to be treated as 32-bit values, leading to a kernel panic during the ns_bpf_qdisc selftest.

A vulnerability in the Linux kernel's ksm_madvise function incorrectly clears the upper 32 bits of vma->vm_flags when handling the VM_MERGEABLE flag. This causes inconsistency in userfaultfd leading to a kernel panic (BUG) or warning.

In the Linux kernel, the ksmbd SMB server has a race condition in RPC handle list access. ksmbd_session_rpc_open() incorrectly used a read lock instead of write lock, and ksmbd_session_rpc_method() ran without any lock.

In the Linux kernel KVM for SVM, a vulnerability exists where fastpath handlers for WRMSR and HLT are executed even when the next RIP is invalid (e.g., with nrips=false). This causes an attempt to read guest memory via the emulator, leading to a 'sleeping function called from invalid context' error because the operation runs with IRQs disabled.

Multiple CSRF attack vectors in JDownloads component 1.0.0-4.0.47 for Joomla were discovered.

microCLAUDIA in v3.2.0 and prior has an improper access control vulnerability. An authenticated user can perform unauthorized actions on other organizations' systems by sending direct API requests using organization identifiers.

In the Linux kernel, the binder driver has a double-free vulnerability in dbitmap_free(). When a process fails to expand its bitmap, the old bitmap is freed but later freed again upon process termination.

A double removal of a request from the list was found in the p9_fd_cancelled function of the 9p/trans_fd driver in the Linux kernel. The bug is caused by a race condition between p9_read_work and p9_fd_cancelled threads concurrently modifying the req_list, leading to memory corruption and a KASAN error.

A vulnerability in the Linux kernel's KVM for x86 was found, where L1 intercepts are rechecked when completing userspace I/O emulation. This can cause an access to be incorrectly treated as intercepted even after emulation, leading to a WARN warning and potential disruption.