CVE Vulnerability Catalog

In the Linux kernel, the ocfs2 filesystem has a use-after-free due to missing validation of the i_dio_orphaned_slot field during inode read. A corrupted append-DIO dinode can carry an out-of-range slot value for the mounted filesystem, leading to an invalid pointer and a UAF in ocfs2_get_system_file_inode(). The fix rejects an active i_dio_orphaned_slot outside the slot range during dinode validation.

In the Linux kernel, the Squashfs filesystem fails to check whether a block offset read from disk is negative. A negative offset (e.g., into the decompressed fragment block) causes an out-of-bounds access in squashfs_copy_data(). The fix checks if the offset is negative and returns 0, matching existing behavior for offsets beyond the block.

Vulnerability in the ntfs3 filesystem driver in the Linux kernel. In the mi_enum_attr() function, insufficient validation of the end virtual cluster number (evcn) can lead to integer overflow, allowing invalid attributes to be accepted. The fix adds a range check for evcn, rejecting values outside the range, except for U64_MAX which is used as a sentinel for empty attributes.

In the Linux kernel, the riscv-sbi-mpxy driver did not validate the RPMI notification length returned by SBI before copying data from shared memory into the notification buffer. Additionally, the event walker used a reversed loop condition and could inspect a short event record.

In the Linux kernel BPF verifier, the pointer type for atomic RMW operations is recorded only when the current destination is PTR_TO_ARENA. A second path can reach the same instruction with an ordinary pointer without comparing it against the saved arena type, leading to incompatible use of the instruction.

In the Linux kernel's ksmbd module, check_lock_range() uses inclusive ranges, so start == end represents a valid single-byte range rather than an empty range. The start == end shortcut skipped mandatory byte-range lock checks for one-byte reads, writes, copychunk operations and one-byte truncate ranges, allowing the operation to proceed despite a conflicting lock.

A slab-out-of-bounds read vulnerability exists in the ksmbd module of the Linux kernel in the ksmbd_alloc_user() function. The function copies resp->hash_sz bytes from the mountd IPC login response, where hash_sz is a __u16 supplied by the response and is not validated against the size of the hash[] buffer (KSMBD_REQ_MAX_HASH_SZ). A malformed or malicious login response can set hash_sz up to 65535, causing the memcpy() to read past the end of the response object.

In the Linux kernel, the rdma_accept_failed error path of smbdirect_accept_connect_request() destroyed memory pools before destroying the QP. This left an outstanding recv_io object at kmem_cache_destroy() time, triggering a "Slab cache still has objects" warning and later a NULL-pointer dereference in mempool_free_bulk.

In the Linux kernel, the SMB server (ksmbd) has a Use-After-Free and double-free vulnerability in smb2_lock(). Granted locks are published to conn->lock_list and fp->lock_list immediately after vfs_lock_file() succeeds, but they also remain on the rollback_list. If a later element in the request array fails, the rollback loop may free an already-freed object, as a concurrent UNLOCK request can remove it.

In the Linux kernel, the EROFS filesystem has an out-of-bounds read vulnerability in the case of invalid interlaced ztailpacking pclusters. Filesystem images can contain invalid clusters, leading to a read from a kmap'd page and copying irrelevant kernel memory into userspace-visible page cache.

In the ksmbd module of the Linux kernel, smb_check_perm_dacl() bounds its ACE walks by the remaining NTSD length (acl_size) rather than the DACL's declared size (pdacl_size). A crafted DACL can place an access-granting ACE beyond pdacl->size, which is accepted during SMB2_CREATE access validation.

In the Linux kernel NFSv4/flexfiles module, two code paths assume the data server client has a session, which is not true for NFSv4.0 (clp->cl_session is NULL). This causes NULL dereferences in nfs4_init_ds_session() and ff_layout_async_handle_error_v4(), and a busy-loop in nfs4_renew_state() due to zero cl_lease_time.

In Linux kernel BPF/XDP subsystem, program checks were moved into dev_xdp_install() to prevent swapping a normal XDP program for an offloaded/device-bound one via BPF_LINK_UPDATE, which previously bypassed verification and allowed execution on the software path.

In the hinic3 network driver in Linux kernel, an issue was fixed related to skb linearization and error handling in skb_checksum_help(). The bug could lead to out-of-bounds DMA reads or IOMMU faults, and also to sending corrupted packets with incomplete checksums.

In the Linux kernel KCM (Kernel Connection Multiplexer) module, RCU protection was missing during execution of a BPF program in the strparser, which could trigger kernel warnings during BPF map operations. The fix holds the RCU lock while running the program.

In the virtio_net driver, the RX ring resize operation was fixed for when an AF_XDP socket is attached, preventing write past the end of the xsk_buffs array when the size grows. The fix properly resizes the array.

In the Linux kernel IPVS module, an integer overflow was fixed in the FTP helper that parses PASV/EPSV responses, which could wrap values and use incorrect port/address for data connections. The fix widens the port accumulator to u32 and rejects values above 65535 and address octets above 255.

In the Linux kernel hp-bioscfg module (platform/x86), a missing bounds check was fixed when parsing password encodings from ACPI packages, which could cause out-of-bounds reads and passing an invalid pointer to hp_convert_hexstr_to_str().

In the Linux kernel, the ntfs_ir_to_ib() function contains a heap out-of-bounds write. It copies entries from index_root into a freshly allocated index_block_size-byte buffer without verifying that the entries fit in the available space. The lack of a bounds check before memcpy allows writes past the end of the allocation.

In the Linux kernel, the NTFS filesystem did not reject setxattr of the reserved $LXUID, $LXGID, $LXMOD, and $LXDEV extended attributes from userspace. The fix requires CAP_SYS_ADMIN to modify these attributes.