CVE Vulnerability Catalog

In the Linux kernel's F2FS filesystem, a vulnerability was found due to missing validation of i_inline_xattr_size for inodes without the FI_INLINE_XATTR flag. An attacker can exploit a crafted filesystem image to set this value arbitrarily, leading to an out-of-bounds read when processing inline directories.

In the Linux kernel F2FS filesystem, a vulnerability was found due to missing validation of ACL entry sizes in f2fs_acl_from_disk(). A malformed ACL can cause an out-of-bounds read, confirmed by a KASAN report.

The Linux kernel reverts commit 9609dd704725 that removed non-uptodate folios from the page cache in move_data_block. The revert fixes kernel panics reported on nearly full f2fs partitions, caused by a race condition that corrupts the LRU list and frees pages with active LRU links.

In the Linux kernel's F2FS filesystem, a vulnerability was found in the __destroy_extent_node() function where setting the FI_NO_EXTENT flag does not reset the largest extent length to zero or update the inode folio, causing stale cached data and triggering a sanity check error.

In the Linux kernel, a bug was found in __cgroup_bpf_run_filter_sysctl() where a temporary buffer allocated by kvzalloc() was freed using kfree() instead of kvfree(). This can cause memory corruption on large allocations.

In the Linux kernel's KVM subsystem for x86, a vulnerability was found where the base GFN of a shadow page is not verified to be within the target memslot before querying the maximum mapping level. This can cause an out-of-bounds read in the lpage_info structure, resulting in a host page fault and potential system instability.

In the Linux kernel KVM component, a vulnerability allows a guest to trigger a kernel panic (BUG_ON) when writing to an ioeventfd with datamatch enabled. The issue occurs when a guest write crosses a page boundary and the second page contains a datamatch-enabled ioeventfd – an unaligned pointer dereference triggers the BUG_ON.

A bug in the Linux kernel's NX crypto driver (nx_crypto_ctx_exit) caused an incorrect argument type to be used. The nx_crypto_ctx_shash_exit function passed a context pointer (nx_crypto_ctx *) instead of a crypto_tfm * pointer, leading to a memory access violation and system crash (oops).

A use-after-free vulnerability was found in the Linux kernel's GFS2 filesystem in the gfs2_qd_dealloc function. During unmount, an RCU callback may access a freed superblock object, leading to potential security issues.

A use-after-free vulnerability was found in the Linux kernel's hdlc_ppp driver. PPP protocol timers (LCP/IPCP/IPV6CP) were not synchronized before freeing the HDLC state structure, allowing code execution in freed memory.

A use-after-free vulnerability was found in the Linux kernel's __blkcg_rstat_flush() function in the blk-cgroup subsystem. It occurs when multiple blkgs in the same blkcg are released concurrently, causing a race condition and access to freed memory.

In the Linux kernel, a use-after-free vulnerability exists in the TIPC module's tipc_aead_decrypt_done function. Missing netns reference protection before asynchronous decryption can lead to reading freed memory after network namespace teardown.

A vulnerability in the Linux kernel's CID (Concurrency ID) mechanism in the scheduler causes an out-of-bounds (OOB) clear_bit operation when CID is MM_CID_UNSET, leading to kernel memory corruption.

Vulnerability in the rpmsg_char driver in the Linux kernel causes a use-after-free during error handling in rpmsg_chrdev_probe(). Incorrect initialization order may lead to a callback with a stale pointer.

In the Linux kernel OCFS2 filesystem, a vulnerability was found due to missing validation of the physical bitmap size in group block descriptors. A malicious descriptor can claim a bitmap size exceeding the available block space, leading to an out-of-bounds read (use-after-free) during bitmap scanning.

In the Linux kernel, a vulnerability was found in the sev_dbg_crypt() function in KVM for AMD SVM, where during encryption (ENCRYPT path) the transfer length is not bounded by the destination page offset (d_off). When d_off > s_off, the intermediate buffer (dst_tpage) of 4096 bytes can be written out of bounds, leading to page overflow and potential memory corruption.

A vulnerability was found in the Linux kernel's NTFS filesystem due to missing synchronization of volume label accesses. A race condition between setting and reading the label can lead to a use-after-free condition.

In the Linux kernel's fbdev/fbcon driver, the fbcon_do_set_font() function on error (e.g., memory allocation) fails to restore hi_font_mask and screen buffer. This causes terminal desynchronization and an out-of-bounds read of the font array, potentially disclosing kernel memory.

A use-after-free vulnerability was found in the Linux kernel's fbdev omap2 driver. The omapfb_mmap() function has a race condition with the OMAPFB_SETUP_PLANE ioctl, allowing concurrent memory mapping and freeing, leading to use-after-free.

In the Linux kernel's I2C subsystem, there is a race condition during adapter registration. The adapter can be looked up via i2c_get_adapter() before its struct device is fully initialized, leading to access to uninitialized data and potential NULL-pointer dereference or use-after-free.