CVE Vulnerability Catalog

In the Linux kernel, in the HISI SAS driver for v3 hardware, there is an issue with the order of freeing IRQ vectors. If the driver fails to request the channel IRQ or fatal IRQ during probe, it frees the IRQ vectors before freeing the IRQs, leading to a kernel BUG.

In the Linux kernel's SCSI libfc driver, there is a use-after-free vulnerability in fc_exch_abts_resp(). fc_exch_release(ep) decreases the reference count, and when it reaches zero, the object is freed, but it is still used in subsequent code, leading to use-after-free.

In the Linux kernel, a crash in monitor mode with the mt76 SDIO driver was fixed. The RXD size was increased from 128 to 256 to avoid nonlinear buffer issues.

In the Linux kernel, the netfilter conntrack module has an issue with garbage collection autotuning. The change in gc behavior causes netlink event overflows when the hash table is large. The fix adjusts the gc schedule to avoid overflows.

In the Linux kernel, an inode reference leak in ceph_get_snapdir() was fixed. The reference was not released in error handling cases.

In the Linux kernel, a memory leak in ceph_readdir was fixed when note_last_dentry returns an error. last_readdir is reset and a comment was added.

In the Linux kernel, an error handling issue in wfx_init_common() in the staging wfx driver was fixed. One error handler did not call ieee80211_free_hw(hw), potentially causing a memory leak.

In the Linux kernel, an issue in the staging vchiq_core driver was fixed where find_service_by_handle could return NULL for an invalid handle, leading to a NULL pointer dereference.

In the Linux kernel, a possible memory leak in MMU DR fini in the habanalabs driver was fixed. A copy-paste error caused a leak when host-resident shadow is NULL.

In the Linux kernel, in the net/tls module, a slab-out-of-bounds bug in decrypt_internal was fixed. The issue was due to incorrect IV size for AES128-CCM, causing an out-of-bounds read.

In the Linux kernel's qede driver, a vulnerability exists where skb allocation is not confirmed before use. qede_build_skb() assumes build_skb() always works, but it can fail under memory pressure, causing a kernel panic. The fix adds a check for NULL return from build_skb().

A vulnerability in the Linux kernel's AMD GPU driver (amdgpu/drm) affects the dcn30_internal_validate_bw function. Missing FPU protection during swath width calculations (CalculateSwathWidth) can lead to a general protection fault, causing system crashes during prolonged WebGL Aquarium usage, especially with DRM debug logs enabled.

In the Linux kernel, a NULL dereference crash in the svc_deferred_event trace class in SUNRPC was fixed, occurring when an svc_rqst is deferred while sunrpc tracing is enabled.

In the Linux kernel, a vulnerability in the cifs driver was fixed that could lead to a buffer overflow when handling symbolic links. The issue was due to a missing check that link_len does not exceed the size of the link_str buffer. A check was added.

In the Linux kernel, in Hyper-V drivers (vmbus), sysctl_record_panic_msg is now deactivated by default in isolated guests. The panic page may contain guest-sensitive information, so it is no longer dumped to Hyper-V by default. Comments in hyperv_panic_event and hyperv_die_event were also updated.

In the Linux kernel, the aqc111 USB driver has out-of-bounds access vulnerabilities in the aqc111_rx_fixup() function. A malicious or defective USB device can trigger out-of-bounds reads of the metadata array, corruption of data in cloned SKBs, and construction of a packet with a tail beyond the buffer end. The fix is not described in this description.

In the Linux kernel IPv6 module, there is a kernel panic vulnerability when forwarding a packet if the input interface has no associated in6 dev. This can be triggered using tc commands with netem corrupt.

In the Linux kernel, the dm-integrity module has a memory corruption vulnerability when the tag_size parameter is smaller than the actual digest size. This can cause writes beyond the end of the ic->recalc_tags array, leading to memory corruption. The issue is fixed by increasing the tags array with sufficient padding.

In the Linux kernel, a vulnerability related to the BFQ scheduler was fixed, which could lead to use-after-free (UAF). The commit regarding honoring already-setup queue merges was restored after being reverted, as the bug was fixed in another commit.

In the Linux kernel, a vulnerability in the zoran driver (media: staging: media: zoran) was fixed where the buffer number was miscalculated in zoran_reap_stat_com when tmp_dcim=1. This led to a NULL pointer dereference later. The fix corrects the calculation and adds a check to prevent recurrence.