CVE Vulnerability Catalog

A bug in the Linux kernel causes a crash in the icl_update_topdown_event() function on Intel RaptorLake machines. The issue occurs when the function is invoked on E-core CPUs that do not support the perf metrics feature, leading to a general protection fault and system hang. The bug was introduced by commit f9bdf1f95339, which mistakenly replaced is_topdown_count() with is_topdown_event().

In the Linux kernel's CIFS/SMB client, error logging was added when close_all_cached_dirs() fails due to low memory, which previously caused a "Dentry still in use" error during unmount.

In the ath12k wifi driver in the Linux kernel, a buffer overflow in debugfs was found. Writing more than 32 bytes causes memory corruption. The vulnerability is limited to root users.

In the Linux virtio-pci driver, virtio_pci_admin_dev_parts_get() returns a result size 8 bytes too large because it includes extra status bytes from virtqueue_get_buf(). This causes errors during live migration and potential out-of-bounds reads.

In the Linux kernel, a race condition was found in the has_locked_children() function called by may_decode_fh() without holding locks. This can cause a system crash (oops). The fix renames the function to __has_locked_children() and adds a safe wrapper with locking.

W jądrze systemu Linux zidentyfikowano podatność, która mogła prowadzić do awarii podczas tworzenia danych reklamowych Bluetooth. Problem dotyczy funkcji eir_create_adv_data, która nie sprawdza, czy dodawane EIR_FLAGS i EIR_TX_POWER mieszczą się w dostępnej przestrzeni.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the ASoC driver for MediaTek MT8195. When no codec is assigned to ETDM2_IN_BE and ETDM1_OUT_BE links in the device tree, the strcmp function receives a null pointer, causing a kernel panic.

In the Linux kernel's ath11k driver, a vulnerability causes node corruption in the ar->arvifs list during WLAN recovery. Improper list reinitialization in ath11k_core_halt() leads to list inconsistency, triggering a kernel panic when an interface is removed concurrently.

In the ath12k WiFi driver in the Linux kernel, there is a use-after-free bug. After freeing skb, the code still accesses rxcb->is_continuation, which can lead to accessing already freed memory.

In the Linux kernel, a vulnerability in the ath12k driver causes WMI commands to be sent to the firmware during a crash, leading to a kernel call trace. The fix sets ATH12K_FLAG_CRASH_FLUSH and ATH12K_FLAG_RECOVERY flags upon crash notification to prevent command transmission during recovery.

In the ath12k WiFi driver in the Linux kernel, a bug was found causing node corruption in the ar->arvifs list during WLAN recovery. The ath12k_core_halt() function only reinitializes the list head, leaving invalid pointers in the next node, leading to a kernel panic when attempting to remove an interface.

W jądrze systemu Linux naprawiono podatność związaną z wywołaniem smp_processor_id() w jądrze z możliwością preempcji. Zastosowano raw_smp_processor_id() w celu poprawienia śladu wywołania, co zapobiega generowaniu błędów w przypadku, gdy preempcja jest włączona.

In the Linux kernel's InfiniBand CM subsystem, cm_free_priv_msg() was reused in a context where the cm_id lock is not needed, causing false lockdep asserts and WARNs when freeing an old message.

In the Linux kernel's hisi_acc_vfio_pci driver, a bug in live migration for VMs without a loaded VF driver leads to NULL pointer access when migrating device data.

In the Linux kernel's octeontx2-pf driver, the TC_HTB_LEAF_DEL_LAST callback for QoS was refactored to fix issues with stopping traffic before queue reassignment and warnings during system reboot.

In the Linux kernel's fs/dax subsystem, a bug in wait_entry_unlocked_exclusive() causes the current entry to be skipped after calling xas_pause(), leading to missed locked entries during scanning. This triggers a warning in truncate_folio_batch_exceptionals() and potential data inconsistency.

In the Linux kernel's TIPC stack, a refcount warning in tipc_aead_encrypt occurs when get_net() is called on a network namespace being destroyed (refcount=0), potentially leading to use-after-free.

In the Linux kernel's netdevsim driver, a bug causes napi_complete() to be called from netpoll context when NAPI is not scheduled, triggering a warning in napi_complete_done().

In the Linux kernel, in pinctrl drivers for MediaTek v1 platforms, there is a bug causing an invalid pointer dereference. The mtk_eint_do_init() function tries to access the 'soc' field in the mtk_pinctrl structure, which does not exist in the definition used by v1 drivers, causing a system crash during boot, e.g., on Genio 350 EVK (MT8365).

A heap-buffer-overread vulnerability was found in GnuTLS when handling the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows an attacker to create a certificate with a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that may contain sensitive data. As a result, confidential information may be exposed when GnuTLS verifies certificates from certain websites if the SCT is not checked correctly.