CVE Vulnerability Catalog

A race condition was found in the Linux kernel's RBD (Ceph RADOS Block Device) driver during image unmap. The lock_dwork work item can be re-queued by maybe_kick_acquire() after cancellation, causing rbd_acquire_lock() to execute after resources are freed, violating an assertion about valid image format.

In the Linux kernel, a vulnerability was found in the LSM (Linux Security Module) mechanism. The lsm_set_self_attr() function does not hold the cred_guard_mutex, which may allow unauthorized changes to process security attributes, especially in the context of SELinux and AppArmor.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's unix_stream_data_wait() function for AF_UNIX sockets. The issue stems from a missing lock when reading the pointer to the last SKB in the receive queue, potentially leading to dereferencing freed memory. The flaw affects kernels from version 6.5 onward.

In the Linux kernel CIFS filesystem, a bug causes a busy dentry to be used after unmounting. The issue occurs when deferred file close work executes after unmount, triggering a warning in generic_shutdown_super.

In the Linux kernel's sev-guest module, a vulnerability was found where pages remain in an unknown state when set_memory_{encrypted,decrypted}() fails. To prevent potential data leaks, these pages are not returned to the buddy allocator but are explicitly leaked via snp_leak_pages().

A use-after-free vulnerability was found in the Linux kernel's ISCI driver during device removal. The completion tasklet is not killed before the controller is torn down, allowing a race between interrupts and memory cleanup. After the ihost structure is freed, a delayed tasklet may still dereference freed memory, leading to a crash or potential exploitation.

In the Linux kernel's DRM V3D driver, a use-after-free vulnerability exists on the error path during CPU job handling. After v3d_job_cleanup() frees the job memory, subsequent reads of timestamp and performance query arrays cause memory corruption. Additionally, a NULL pointer dereference occurs on the early error path.

In the Linux kernel DRM driver for VirtIO, a vulnerability was found where the return value of the DMA reservation lock function (dma_resv_lock_interruptible) is ignored. If interrupted by a signal (-EINTR) or due to memory shortage (-ENOMEM), the lock is not held, leading to a race condition when adding fences and potentially corrupting the fence list.

In the Linux kernel's AMD/Display driver, an out-of-bounds read vulnerability was found. GPIO pin table parsers did not validate whether the declared structure size from VBIOS fits within the available BIOS image, allowing reads beyond its boundaries.

In the Linux kernel, a use-after-free vulnerability was found in the batman-adv module's batadv_mcast_purge_orig() function. It removes entries from RCU-protected hlists without waiting for an RCU grace period, allowing concurrent RCU readers to access freed memory.

In the Linux kernel's batman-adv (BLA) module, a vulnerability was found involving a double decrement of the bla.num_requests counter. The issue stems from non-atomic operations on the counter and the request_sent flag, leading to a race condition and incorrect state.

In the Linux kernel, the batman-adv (tp_meter) module had a vulnerability where batadv_tp_sender_cleanup() used an unsafe combination of timer_delete_sync() and timer_delete() to stop a timer. This could lead to the timer being re-armed after cleanup, causing a use-after-free condition.

In the Linux kernel's batman-adv module, a vulnerability was found due to incorrect typing of the `tt_buff_len` field as `s16` instead of `u16`. Values greater than 32767 wrap to negative numbers, causing full buffer allocation but only partial population, leaving the rest uninitialized.

In the Linux kernel's pmbus/adm1266 driver, a buffer overflow vulnerability exists during block read operations. The read_buf declaration was one byte too small, causing out-of-bounds write when handling maximum-length responses (255 bytes + PEC byte).

In the Linux kernel hwmon (pmbus/adm1266) driver, a vulnerability was found where the wrong constant (ADM1266_PDIO_STATUS instead of ADM1266_PDIO_NR) is used in the PDIO mask scanning loop. This causes out-of-bounds read from the caller's stack and potential out-of-bounds write to the bits array, leading to memory corruption.

In the Linux kernel for RISC-V, an uninitialized stack variable 'cregs' causes register corruption. Functions compat_riscv_gpr_set() and compat_restore_sigcontext() call cregs_to_regs() even after a failed user-space copy, writing uninitialized stack data into the target task's pt_regs.

In the Linux kernel, a vulnerability was found in the ARM FF-A driver due to missing validation of the framework notification message layout. Incorrect offset and size values can lead to out-of-bounds reads or oversized memory allocations.

In the Linux kernel netfilter/x_tables subsystem, a new function xtables_unregister_table_exit was added to replace xt_unregister_table(). This fixes an issue where during module removal (rmmod), users performing set/getsockopt could not re-instantiate the table because the larval table was already removed and the existing instance was no longer on the active table list.

In the Linux kernel, the netfilter ebtables module introduces a two-stage removal scheme to prevent a race condition during table operation assignment. The table->ops assignment is now performed while holding the ebt mutex, avoiding exposure of a partially filled table structure.

A race condition vulnerability was found in the Linux kernel's netfilter bridge eb_tables module during initialization. The sockopt registration occurs too early, before the module initialization is complete, exposing partially initialized structures globally.