CVE Vulnerability Catalog

In the Linux kernel's scsi iscsi module, a use-after-free bug exists in task abort handling. The fix reverts a goto to common cleanup code and moves iscsi_get_conn() after checking task validity.

In the Linux kernel, the AMDKFD driver's svm_migrate_fini function performs redundant resource release operations, causing warnings and potential issues during driver disconnect.

In the Linux kernel, the SCTP function sctp_rcv_ootb does not check if skb_header_pointer returns NULL before using it, which could lead to a NULL pointer dereference. The fix adds a check and breaks out if the return is NULL.

In the Linux kernel, the mac80211 subsystem has a use-after-free vulnerability during CCMP/GCMP RX. Under certain conditions, the 'hdr' variable may be invalid, leading to use of freed memory.

In the Linux kernel, the dma-debug module can generate an error message millions of times per second, causing printk buffer spam and CPU usage up to 100%. This affects drivers using the DMA API.

In the Linux kernel's enetc driver, there is an illegal memory access when reading the affinity_hint file in procfs. irq_set_affinity_hit() stores a reference to a temporary stack variable, leading to a page fault on later access. The issue is fixed by the get_cpu_mask() helper, which provides permanent storage.

In the Linux kernel's drm/sched (GPU scheduler), before killing a job, all its dependencies must complete to avoid data corruption.

In the Linux kernel, the wl1251 driver's wl1251_cmd_scan function calls memcpy without checking the length, which could lead to a buffer overflow. The fix adds a check to ensure the length is within the maximum allowed size.

In the Linux kernel, a vulnerability in the f2fs filesystem was fixed where multiple filesystem instances could race on accessing the global fsync_entry_slab pointer, leading to a use-after-free issue during recovery. The fix initializes and destroys this slab cache only once during module init/destroy to avoid the issue.

In the Linux kernel, a use-after-free vulnerability in the iSCSI driver (scsi: iscsi) during resets has been fixed. The issue occurs when iscsi_conn_teardown wakes up the EH thread and frees the connection while those threads are still accessing the connection's ehwait field. The fix moves the TMF fields from the connection to the session.

In the Linux kernel, a NULL dereference in nfs3svc_encode_getaclres in nfsd was fixed, occurring in error cases when dentry may be NULL.

In the Linux kernel, a vulnerability in scsi/libfc was fixed, addressing an array index out of bound exception in fc_rport_prli_resp().

In the Linux kernel CIFS module, there is a NULL pointer dereference vulnerability in cifs_compose_mount_options(). The optional @ref parameter may contain a NULL node_name, leading to a NULL pointer dereference.

In the Linux kernel, the SCSI target subsystem has a NULL pointer dereference when completing XCOPY operations. The function target_complete_cmd() uses the se_tpg_wwn pointer, which is NULL for the global tpg used by XCOPY, leading to a panic. The fix checks if se_tpg_wwn is NULL and then uses se_cmd->cpuid.

In the Linux kernel's NFS, a use-after-free occurs in nfs4_init_client() when attempting to mount two different exports through two different NICs belonging to the same server. KASAN reported the issue.

W jądrze systemu Linux naprawiono podatność związaną z użyciem po zwolnieniu pamięci w funkcji gfs2_glock_shrink_scan. Problem dotyczył niewłaściwego zarządzania flagą GLF_LRU, co mogło prowadzić do nieprawidłowego usuwania glocków z listy LRU.

In the Linux kernel, the AMD Display Manager (DMUB) driver has a memory leak during system suspend/resume operations. The initialization function allocates memory on every resume, leading to a growing leak.

In the Linux kernel, the TCP option parser in synproxy (synproxy_parse_options) could read one byte out of bounds. When the length is 1, the execution flow enters the loop, reads one byte of the opcode, and if the opcode is neither TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, exceeding the length of 1. The fix adds an early return when length < 0.

In the Linux kernel's mptcp (Multipath TCP), the TCP option parser (mptcp_get_options) can read one byte out of bounds when the option length is 1. The fix is inspired by a similar fix for IPv4 TCP.

In the Linux kernel, the CAN J1939 subsystem has a Use-after-Free vulnerability. The issue is that a skb is taken from the session queue without incrementing the ref count, which can lead to use-after-free if the skb is concurrently taken from the queue due to a CTS.