CVE Vulnerability Catalog

In the Linux kernel, ntfs_dio_zero_range() in the ntfs driver returns either 0 or a negative errno from blkdev_issue_zeroout(); it never returns a positive value. The zeroing failure check in ntfs_attr_fallocate() therefore never fired, so a failed zeroing operation was silently ignored and newly allocated clusters were folded into initialized_size.

In the Linux kernel, is_boot_sector_ntfs() in the ntfs driver checks the boot sector's sectors_per_cluster field with a range test that rejects 0x81..0xf3 but accepts 0 and other non-power-of-two counts. A zero value reaches parse_ntfs_boot_sector(), where ffs(0) is 0, making the shift undefined.

A vulnerability in the Linux kernel BPF verifier allows it to incorrectly infer that a pointer is non-null. The bug occurs when comparing two pointers where one has a type without the PTR_MAYBE_NULL flag but can still be NULL at runtime. As a result, the verifier fails to catch a null pointer dereference, potentially leading to a crash or unauthorized code execution.

In the Linux kernel, ntfs_set_ea() in the ntfs driver unconditionally updates the HasEA flag based on ea_info_qsize in its exit path. When an error occurs before ea_info_qsize is updated, NInoClearHasEA() hides existing on-disk extended attributes (EAs) until the inode is evicted.

In the Linux kernel, the BPF verifier could incorrectly downgrade scalar zero spills to STACK_ZERO when part of the spilled bytes were already dead. This broke precision propagation chains and could lead to incorrect verification of BPF programs. The fix simply avoids converting zero spills to STACK_ZERO.

In the Linux kernel's stmmac network driver, stmmac_tso_xmit() failed to unmap DMA mappings created for the linear part and earlier fragments of an skb when mapping a subsequent fragment failed. This led to a DMA mapping leak. The fix releases descriptors and DMA mappings using stmmac_free_tx_buffer() and stmmac_release_tx_desc().

In the Linux kernel's scsi mpi3mr driver, mpi3mr_sas_port_add() does not check the NULL return value from sas_port_alloc_num() on memory allocation failure, leading to a NULL pointer dereference. Additionally, if sas_port_add() fails, the allocated port is not freed, leaking the sas_port structure. The fix adds a NULL check and calls sas_port_free().

In the Linux kernel's scsi mpi3mr driver, mpi3mr_sas_port_add() does not release the target device (tgtdev) reference in the out_fail error path if the reference was previously acquired by mpi3mr_get_tgtdev_by_addr(). This leads to a reference count leak and prevents the target device structure from being freed. The fix adds a tgtdev put in the out_fail path guarded by a NULL check.

In the Linux kernel's SMB client, smb3_insert_range() does not check whether the new file size (i_size + len) is valid. This allows FALLOC_FL_INSERT_RANGE to bypass RLIMIT_FSIZE, exceed s_maxbytes, or produce a size outside the loff_t range. The fix uses check_add_overflow() to calculate the new EOF and validates it with inode_newsize_ok().

In the Linux kernel SMB client, smb3_zero_range() may extend a file's EOF without checking RLIMIT_FSIZE when FALLOC_FL_ZERO_RANGE is used without FALLOC_FL_KEEP_SIZE. The fix calls inode_newsize_ok() before sending the zero-range request when the operation would extend EOF.

In the Linux kernel SMB client, smb3_insert_range() and smb3_collapse_range() failed to properly invalidate the page cache when the offset or old EOF was not page-aligned. Boundary pages were only partially zeroed and remained uptodate, so the client could return stale data after a successful insert/collapse range operation.

A flaw was found in the Linux kernel SMB/CIFS client where server-side range operations (zero range, punch hole, insert range, collapse range) modified file contents without invalidating the FS-Cache cookie. As a result, subsequent reads could return stale data cached before the range operation.

A vulnerability in the Linux kernel's SCTP implementation causes a soft lockup due to inconsistent parameter iteration in ASCONF-ACK handling. A crafted ASCONF-ACK packet can trigger an infinite loop in softirq context, leading to a remote denial of service. Additionally, missing length validation for SCTP_PARAM_ERR_CAUSE allows an out-of-bounds read.

In the Linux kernel msc313e watchdog driver, msc313e_wdt_probe() does not set the platform device driver data, so dev_get_drvdata() in msc313e_wdt_suspend() and msc313e_wdt_resume() returns NULL, leading to a NULL pointer dereference. The fix sets the platform device driver data in msc313e_wdt_probe().

In the Linux kernel netfs subsystem, a subrequest reference leak occurs in netfs_unbuffered_write() when subreq->io_iter ends up zero length during preparation. The fix addresses this reference leak.

In the Linux kernel netfs subsystem, when netfs_alloc_subrequest() fails, subreq is NULL, and netfs_prepare_write() then tries to initialize its members, leading to a NULL pointer dereference. The fix properly handles the netfs_prepare_write() error.

In the Linux kernel, parse_dacl() in ksmbd silently accepted truncated ACEs and allocation failures, allowing set_info_sec() to continue with an incomplete ACL conversion. The fix propagates parsing and allocation errors to parse_sec_desc() so malformed security descriptors are rejected before inode attributes or ACL xattrs are updated.

In the Linux kernel, ksmbd allows a client to include many structurally valid but unmapped SIDs in a DACL, causing hundreds of kernel error messages per request. The fix rate-limits the logging of these mapping failures.

A vulnerability in the Linux kernel's Bluetooth subsystem (hci_core) involves a race condition during device registration. The power_on work item is queued before full initialization, and concurrent execution can lead to using an uninitialized mutex in msft_do_close(), triggering DEBUG_LOCKS warnings and potential instability.

In the Linux kernel, several places in IPv6 multicast where RCU-protected lists were updated without rcu_assign_pointer() were fixed. The fix ensures consistent use of rcu_assign_pointer() along with appropriate dereference helpers.