CVE Vulnerability Catalog

In the Linux kernel, ecryptfs_exorcise_daemon() dropped queued messages from a dying daemon without holding ecryptfs_msg_ctx_lists_mux, but ecryptfs_msg_ctx_alloc_to_free() requires that lock. This created a race with other users of the global message context list.

In the Linux kernel, ecryptfs_parse_packet_set() calculated the remaining packet buffer size as PAGE_SIZE - 8, even though for version 1 headers the packet set starts later in the header. This could overstate the available buffer and lead to parsing errors.

In the Linux kernel, parse_tag_3_packet() fails to bound encrypted_key_size against ECRYPTFS_MAX_KEY_BYTES (64). When encrypted_key_size exceeds 64, decrypt_passphrase_encrypted_session_key() performs two out-of-bounds writes, corrupting the ecryptfs_auth_tok and ecryptfs_crypt_stat structures. Only AES-192 (cipher code 0x08) triggers this because it sets crypt_stat->key_size = 24 independently of encrypted_key_size.

In the Linux kernel, ecryptfs_parse_tag_70_packet() subtracted fixed metadata fields from the parsed packet body size to derive the encrypted filename size. A malformed packet with a body smaller than those fixed fields could underflow that size calculation.

In the Linux kernel, ecryptfs_send_message_locked() moved a message context from the free list to the allocated list before sending the request to the userspace daemon. If ecryptfs_send_miscdev() failed, the context was left on the allocated list and could not be reused.

In the Linux kernel, in the erofs filesystem, z_erofs_gbuf_nrpages is advanced only after every global buffer has been grown. If a resize fails after some buffers were enlarged, a retry revisits those enlarged buffers, which can lead to allocation errors or pointer array overflow.

In the Linux kernel, ext2_setsize() and ext2_xattr_set2() contained a construct that for IS_SYNC inodes called sync_inode_metadata() instead of marking the inode dirty. Since sync_inode_metadata() only acts if the inode is already dirty, inode updates could be lost.

A use-after-free vulnerability exists in the Linux kernel's fanotify subsystem regarding file range information. A pointer to the range position stored on the triggering task's stack is saved in a heap-allocated permission event, and when a signal interrupts the triggering task, the stack frame is unwound while the event reader still dereferences that pointer. This causes a stale stack value to be copied to userspace.

In the Linux kernel's fbdev omapfb panel-dsi-cm driver, the ddata->lock mutex is initialized after the display is registered. Once omapdss_register_display() publishes the display, another consumer can invoke a dsicm callback that takes this uninitialized mutex. This can lead to improper operation or a crash.

In the Linux kernel's fbdev uvesafb driver, uvesafb_init() registers the v86d connector callback before registering the platform driver. If platform_driver_register() fails, the function returns the error without unregistering the connector callback, leaving it registered. The later platform-device failure path already performs this unregistration.

In the Linux kernel forcedeth driver, the loops in nv_suspend() and nv_resume() use 'i <= register_size/sizeof(u32)', causing one extra iteration and an out-of-bounds access to the saved_config_space array. On VER3 devices the last iteration reads past the array and, on resume, performs an MMIO write one dword past the mapped register window. The bug is reported by UBSAN and, with CONFIG_UBSAN_TRAP=y, traps and aborts the running kernel code.

In the Linux kernel's hsi omap_ssi_core driver, the OMAP SSI driver uses a synthetic HSI controller device allocated via hsi_alloc_controller(), which does not go through the normal OF/platform device initialization path. As a result, the embedded struct device does not have a DMA mask initialized by default. After recent DMA API hardening changes, dma_map_sg() and related helpers require a valid dma_mask, otherwise the driver may crash or trigger warnings.

In the Linux kernel's hugetlb subsystem, __unmap_hugepage_range can adjust reservations since commit df7a6d1f6405. When a folio is mapped in both a parent and a child, and the parent unmaps the range first, the reservation adjustment causes an underflow of the reserved count. Once the child unmaps the range, the count is restored. The fix checks the mapcount before adjusting the reservation.

In the Linux kernel, the ghes_handle_arm_hw_error() function (ACPI APEI GHES) reduces the remaining length by sizeof(err) (pointer size) instead of sizeof(*err) (structure size) after skipping the cper_sec_proc_arm header. This overestimates the bytes left for cper_arm_err_info records and can cause the parser to read past the CPER section when err_info_num is large enough.

In the Linux kernel, the query_capability() function (ACPI pfr_update) copies four ACPI buffer objects returned by firmware _DSM into fixed-size u8[16] fields in struct pfru_update_cap_info using memcpy with the firmware-supplied length. If the firmware returns buffer.length > 16, memcpy writes past the destination array, causing a stack buffer overflow.

The Linux kernel has a bug in ata_format_dsm_trim_descr(), which builds the ATA TRIM descriptor in a 2048-byte buffer. On devices with a logical sector size larger than 2048 bytes (e.g. 4Kn with 4096-byte sectors), the function can never return the expected sector size, so every TRIM is rejected with a parameter list length error and triggers WARN_ON() splats.

In the Linux kernel, in the auxdisplay charlcd driver, with CONFIG_CHARLCD_BL_FLASH enabled, charlcd_init() schedules bl_work before charlcd_register() calls misc_register(). If registration fails, the caller frees the charlcd object while delayed work still contains its address, leading to a use-after-free.

The Linux kernel did not validate user space vector alignment when building a bio from iov_iter. Bio-based block drivers did not necessarily check the alignment split, potentially causing incorrect behavior. The fix validates vectors against the device's dma_alignment and rejects misaligned ones with -EINVAL.

The Linux kernel's eir_get_service_data() function in the Bluetooth EIR module contains an out-of-bounds read. Incorrect recalculation of eir_len when skipping fields causes the pointer to walk past the le_per_adv_data[] buffer into the rest of struct hci_conn. The fix recomputes eir_len from the end of the buffer each iteration.

A bug in the Linux kernel's BPF x86 JIT was fixed regarding per-CPU address resolution into an extended register. The REX prefix was built using REX.B instead of REX.R, causing the high register bit to be lost and the per-CPU address to be written to the wrong register (e.g. R5 instead of R8). This led to dereferencing an invalid pointer and a kernel panic.