CVE Vulnerability Catalog

In the Linux kernel, the NFC NCI subsystem lacks bounds checking for arrays in the nfc_target structure, which may lead to out-of-bounds memory writes. The issue was detected by syzkaller with CONFIG_FORTIFY_SOURCE enabled.

In the Linux kernel, a use-after-free vulnerability was found in the ravb driver in the ravb_rx_gbeth() function. After the skb is delivered to napi_gro_receive(), which may free it, dereferencing skb may trigger use-after-free.

In the Linux kernel, the hisilicon network driver (hisi_femac) has a potential use-after-free vulnerability in hisi_femac_rx(). The skb is delivered to napi_gro_receive() which may free it, and dereferencing skb after that may trigger use-after-free.

In the Linux kernel, the hisilicon network driver has a use-after-free vulnerability in the hix5hd2_rx() function. The skb is passed to napi_gro_receive() which may free it, and then dereferencing skb may trigger use-after-free.

In the Linux kernel, the x86/mm/ident_map code's ident_pud_init() uses GB pages for identity maps, potentially including larger address ranges than requested, including BIOS-reserved areas. This can allow processor speculation into reserved regions, causing system halts on UV systems.

In the Linux kernel, an ext4 vulnerability involves accessing an uninitialized spinlock (sbi->s_bdev_wb_lock) during the fast-commit replay path. This triggers a warning about registering a non-static key and can disrupt lock validation. The fix moves the spinlock initialization earlier in __ext4_fill_super().

W jądrze Linuxa rozwiązano podatność związaną z niewłaściwym zarządzaniem licznikami referencji na węźle CPU. W funkcji parse_perf_domain, w przypadku błędu podczas wywołania of_parse_phandle_with_args, odniesienie do węzła urządzenia CPU nie jest prawidłowo dekrementowane.

A vulnerability in the ASIHPI driver in the Linux kernel has been fixed, which could lead to potential out-of-bounds array access. The array index used to store values depends on the firmware, creating a risk of unauthorized access.

In the Linux kernel, the mlx5 driver had an error path bug in multi-packet WQE transmit. On DMA mapping failure, the code erroneously unmapped an entry from the active mappings list, potentially removing a random mapping and causing PCI function errors.

A vulnerability was found in the Linux kernel's DSA shutdown sequence. Two issues were identified: a use-after-free in the lan9303 driver due to dev_get_drvdata() calls after shutdown, and a race condition when zeroing conduit->dsa_ptr during packet reception. The fix closes the conduit interface before zeroing pointers, preventing access to the driver after shutdown.

A vulnerability has been identified in the Linux kernel that leads to memory disclosure due to improper padding application in Ethernet frames. The patch uses skb_put_padto() to properly pad Ethernet frames, eliminating the data disclosure issue.

A vulnerability related to buffer overflow when parsing NFS reparse points has been fixed in the Linux kernel. The issue stemmed from incorrect calculation of the data buffer size, leading to access beyond its bounds.

An integer overflow vulnerability was discovered in the Linux kernel's BLKSECDISCARD operation. Passing crafted values (sector 512 and a near-maximum uint64_t sector count) causes an infinite loop in blkdev_issue_secure_erase(), leading to system overload and hang.

A vulnerability has been identified and resolved in the Linux kernel within the drm/amdkfd module. The issue was related to improper pointer clearing, which could lead to a use-after-free bug.

A double free issue during the unloading of the amdgpu module has been fixed in the Linux kernel. This issue occurred when flexible endpoints used DIGs from available inflexible endpoints, leading to memory management errors.

A vulnerability in the Linux kernel related to use after free has been fixed in case of platform device registration errors.

In the Linux kernel, the AMD Display module (DCN30) has an index out of bounds issue in cm3_helper_translate_curve_to_hw_format. The index 'i' may exceed the number of transfer function points, leading to buffer overflow in color arrays.

A vulnerability was found in the Linux kernel's ext4 filesystem. If the default hash version is set to DX_HASH_SIPHASH but the casefold feature is not enabled, mounting the filesystem fails.

A vulnerability has been identified in the Linux kernel within the ocfs2 module, related to improper synchronization work management during errors. If an error occurs after successfully reading the global quota, it may lead to incorrect resource deallocation.

A vulnerability in the Linux kernel related to the ext4 filesystem has been fixed, concerning use-after-free on failed mount attempts. The issue was that the s_err_report timer remained active, potentially leading to I/O errors.