CVE Vulnerability Catalog

A vulnerability in the Linux kernel's BPF subsystem causes a kernel warning when performing narrower access to pointer fields in context structures. The issue occurs when a BPF program reads fewer bytes than the pointer field size, leading to a context access conversion error.

In the Linux kernel's mlx5e driver, a bug was found where after hardware decryption, if the xfrm (IPsec) state was freed before lookup, the secpath extension on the skb was not removed. This caused access to an invalid pointer and a system crash (page fault) during security policy checks.

In the Linux kernel BPF JIT for ARM64, when a program acts as an exception boundary, find_used_callee_regs() is not called, leaving ctx->fp_used false. Consequently, the frame pointer (FP) is not set up in the prologue, potentially causing a kernel crash due to a page fault.

A vulnerability has been identified in the Linux kernel related to stack buffer overflow in the gmin_get_var_int() function. The issue arises when gmin_get_config_var() does not return the proper error code, leading to incorrect buffer length processing and memory overwrite.

W jądrze systemu Linux naprawiono podatność związaną z warunkiem wyścigu oraz użyciem po zwolnieniu (UAF) w funkcji padata_reorder. Problem polegał na niewłaściwym zarządzaniu licznikiem referencji, co mogło prowadzić do błędów w przetwarzaniu padata.

A double destruction of the rsv_qp object was found in the Linux kernel's RDMA HNS driver. The issue occurs when rsv_qp is destroyed first in free_mr_init() and then in hns_roce_exit() during error handling, leading to list corruption.

In the ext4 filesystem in the Linux kernel, a use-after-free vulnerability exists in ext4_end_io_rsv_work(). The issue occurs when an io_end is added to the i_rsv_conversion_list without checking if conversion is needed, and the inode may be freed before the work executes, leading to use-after-free.

In the f2fs filesystem in the Linux kernel, KMSAN detected use of uninitialized values in the extent_info structure. The get_read_extent_info() function initializes only three fields (fofs, blk, len), leaving others uninitialized, leading to undefined behavior during extent merging.

A use-after-free (UAF) vulnerability was discovered in the Linux kernel's F2FS filesystem in the f2fs_sync_inode_meta() function. Reported by syzbot, it can cause reading freed memory during inode metadata synchronization.

In the Linux kernel, a vulnerability in the F2FS filesystem causes a kernel panic during f2fs_evict_inode due to a use-after-free in inode list operations. An attacker could trigger this to crash the system.

In the PPTP driver in the Linux kernel, there is an uninitialized data read vulnerability in the pptp_xmit() function. Lack of minimal skb length check can lead to out-of-bounds memory read.

In the cs42l43 SPI driver in the Linux kernel, the property entries array is not null-terminated. When unterminated, this can lead to a fault in the cs35l56 amplifier driver as the node parser walks off the end of the array into unknown memory.

A vulnerability in the Linux kernel's ipv6_gso_segment() function allows rejecting malicious IPv6 packets with overly long extension headers. The issue causes an overflow of the 16-bit skb->transport_header field, potentially leading to a system crash.

In the Linux kernel sunrpc module (NFS over TLS), a vulnerability exists in TLS alert handling. The tls_alert_recv function assumes valid data in the msghdr iterator's kvec, which can be exploited. A rework of control message setup and usage via sock_recvmsg() is proposed.

In the fbnic network driver in the Linux kernel, a use-after-free (UaF) vulnerability exists in the AF_XDP part. When the device fails to open, the NAPI pointer is not cleared from the queue, leading to use-after-free in xsk_bind().

A stack out-of-bounds write vulnerability was found in the Linux kernel's mqprio network scheduler. The issue occurs when validation of TCA_MQPRIO_TC_ENTRY_INDEX allows value 16, while the fp[] array has only 16 elements (indices 0-15).

In the Linux kernel's sunrpc module, a vulnerability was found in server-side TLS alert handling. The tls_alert_recv() function incorrectly assumes it can read data from the msg iterator, causing issues with TLS control message processing.

In the Linux kernel's ksmbd module, a race condition was found regarding Preauh_HashValue. When a client sends multiple session requests, improper freeing of Preauh_HashValue memory can occur.

In the Linux kernel for x86/SEV-SNP, a cache coherency vulnerability requires manual cache line eviction during memory validation after a page state change to private. The mitigation involves touching the first and last byte of each 4K page.

A use-after-free vulnerability was found in the Linux kernel's USB gadget driver in the composite_dev_cleanup() function. The issue occurs when the cdev->os_desc_req pointer is freed but not set to NULL, leading to reuse after an allocation failure.