CVE Vulnerability Catalog

In the Linux kernel's sev-guest module, a vulnerability was found where pages remain in an unknown state when set_memory_{encrypted,decrypted}() fails. To prevent potential data leaks, these pages are not returned to the buddy allocator but are explicitly leaked via snp_leak_pages().

A use-after-free vulnerability was found in the Linux kernel's ISCI driver during device removal. The completion tasklet is not killed before the controller is torn down, allowing a race between interrupts and memory cleanup. After the ihost structure is freed, a delayed tasklet may still dereference freed memory, leading to a crash or potential exploitation.

In the Linux kernel's DRM V3D driver, a use-after-free vulnerability exists on the error path during CPU job handling. After v3d_job_cleanup() frees the job memory, subsequent reads of timestamp and performance query arrays cause memory corruption. Additionally, a NULL pointer dereference occurs on the early error path.

In the Linux kernel DRM driver for VirtIO, a vulnerability was found where the return value of the DMA reservation lock function (dma_resv_lock_interruptible) is ignored. If interrupted by a signal (-EINTR) or due to memory shortage (-ENOMEM), the lock is not held, leading to a race condition when adding fences and potentially corrupting the fence list.

In the Linux kernel's AMD/Display driver, an out-of-bounds read vulnerability was found. GPIO pin table parsers did not validate whether the declared structure size from VBIOS fits within the available BIOS image, allowing reads beyond its boundaries.

In the Linux kernel, a use-after-free vulnerability was found in the batman-adv module's batadv_mcast_purge_orig() function. It removes entries from RCU-protected hlists without waiting for an RCU grace period, allowing concurrent RCU readers to access freed memory.

In the Linux kernel's batman-adv (BLA) module, a vulnerability was found involving a double decrement of the bla.num_requests counter. The issue stems from non-atomic operations on the counter and the request_sent flag, leading to a race condition and incorrect state.

In the Linux kernel, the batman-adv (tp_meter) module had a vulnerability where batadv_tp_sender_cleanup() used an unsafe combination of timer_delete_sync() and timer_delete() to stop a timer. This could lead to the timer being re-armed after cleanup, causing a use-after-free condition.

In the Linux kernel's batman-adv module, a vulnerability was found due to incorrect typing of the `tt_buff_len` field as `s16` instead of `u16`. Values greater than 32767 wrap to negative numbers, causing full buffer allocation but only partial population, leaving the rest uninitialized.

In the Linux kernel's pmbus/adm1266 driver, a buffer overflow vulnerability exists during block read operations. The read_buf declaration was one byte too small, causing out-of-bounds write when handling maximum-length responses (255 bytes + PEC byte).

In the Linux kernel hwmon (pmbus/adm1266) driver, a vulnerability was found where the wrong constant (ADM1266_PDIO_STATUS instead of ADM1266_PDIO_NR) is used in the PDIO mask scanning loop. This causes out-of-bounds read from the caller's stack and potential out-of-bounds write to the bits array, leading to memory corruption.

In the Linux kernel for RISC-V, an uninitialized stack variable 'cregs' causes register corruption. Functions compat_riscv_gpr_set() and compat_restore_sigcontext() call cregs_to_regs() even after a failed user-space copy, writing uninitialized stack data into the target task's pt_regs.

In the Linux kernel, a vulnerability was found in the ARM FF-A driver due to missing validation of the framework notification message layout. Incorrect offset and size values can lead to out-of-bounds reads or oversized memory allocations.

In the Linux kernel netfilter/x_tables subsystem, a new function xtables_unregister_table_exit was added to replace xt_unregister_table(). This fixes an issue where during module removal (rmmod), users performing set/getsockopt could not re-instantiate the table because the larval table was already removed and the existing instance was no longer on the active table list.

In the Linux kernel, the netfilter ebtables module introduces a two-stage removal scheme to prevent a race condition during table operation assignment. The table->ops assignment is now performed while holding the ebt mutex, avoiding exposure of a partially filled table structure.

A race condition vulnerability was found in the Linux kernel's netfilter bridge eb_tables module during initialization. The sockopt registration occurs too early, before the module initialization is complete, exposing partially initialized structures globally.

A vulnerability in the Linux kernel's statmount_mnt_idmap function can cause an out-of-bounds write on the seq buffer. The issue occurs because manual increment of seq->count after seq_printf() bypasses overflow detection, leading to a NULL byte write beyond the allocated buffer.

In the Linux kernel on PREEMPT_RT, a use-after-free vulnerability was found in irq_work_single(). After clearing the BUSY flag via atomic_cmpxchg(), the code still dereferences the work structure, which can be freed prematurely by another thread calling irq_work_sync().

In the Linux kernel, the netfs_read_folio() function fails to wait for ongoing writeback to complete. This can lead to data corruption because the function trusts the dirty flag and folio->private data, which may be cleaned up before the writeback flag is cleared.

In the Linux kernel, the AFS filesystem has a vulnerability due to incorrect locking when handling symbolic links. This allows races between multiple get_link() calls, potentially leading to memory leaks or incorrect symlink content reads.