CVE Vulnerability Catalog

In FRRouting (FRR) up to version 7.3.1, when using the split-config feature, the init script creates an empty config file with world-readable default permissions, potentially leading to information leakage via frr.in and frrcommon.sh.in tools.

A flaw was found in the libnbd library where a malicious actor could exploit a specially crafted URI to convince libnbd to open it. The vulnerability arises from the incorrect interpretation of non-standard hostnames starting with '-o' as arguments to the SSH process.

In the Linux kernel's drm/amdgpu/mes driver, a use-after-free issue exists. The fix removes the fence fallback timer to eliminate random errors.

In the Linux kernel, in the sc16is7xx serial driver, a TX FIFO corruption was fixed that could occur when a packet was received on channel A at almost the same time as a packet was about to be transmitted on channel B.

In the Linux kernel, in the Btrfs filesystem, an issue with readahead on the relocation inode was fixed when the filesystem uses a RAID stripe tree (RST), which could cause ENOENT errors.

In the Linux kernel, in the L2TP subsystem, a possible tunnel refcount underflow was fixed, which could occur during session deletion when the tunnel pointer was invalid.

In the Linux kernel, in the Bluetooth subsystem (MGMT), possible deadlocks were fixed that could occur due to hci_cmd_sync_dequeue, causing threads to block for extended periods.

In the Linux kernel, in the DRM/XE driver (guc_submit), a race condition around the suspend_pending field was fixed, which could cause assertions and warnings in certain test scenarios.

In the Linux kernel, in the Bluetooth subsystem (hci_conn), the function disable_delayed_work_sync is used instead of cancel_delayed_work_sync, which not only cancels ongoing work but also disables new submissions, which is desirable.

In the Linux kernel's btrfs filesystem, a use-after-free of the block device file occurs in __btrfs_free_extra_devids(). The issue may arise when mounting two btrfs images with the same fsid.

In the Linux kernel's F2FS filesystem, there is potential corruption when moving a directory, similar to an issue in ext4. The fix addresses this problem.

In the Linux kernel's fork function, a race condition exists between fork and hugetlbfs file operations. The fix defers linking the file VMA until the VMA is fully initialized.

In the Linux kernel's bcachefs filesystem, a missing bounds check in superblock validation could allow out-of-bounds read. The fix adds the missing check.

In the Linux kernel's networking subsystem, a dangling sk pointer is left when socket creation fails, potentially leading to use-after-free when __sock_release() is called with an fentry probe.

In the Linux kernel, the drm/amdgpu driver changed the handling of the vm->task_info object. The object is now dynamically allocated and reference-counted, improving safety and stability.

In the Linux kernel, a race condition was fixed in the OA TC6 network driver between reference pointers for TX packets. The issue involves managing two skb pointers for packets enqueued from the network stack.

In the Linux kernel, RCU protection was added for the conventional zones bitmap of a disk (conv_zones_bitmap) in the block layer. This prevents invalid memory references during disk revalidation.

In the Linux kernel, a double accounting race was fixed in Btrfs when btrfs_run_delalloc_range() fails. The issue occurs when block size is smaller than page size and can lead to kernel crash.

In the Linux kernel, the BPF verifier now tracks the changes_pkt_data property for global functions. It invalidates packet pointers in the current state after calling certain helpers.

In the Linux kernel, the BPF verifier now checks the changes_pkt_data property for extension programs. It decides whether to invalidate all packet pointers in the current state based on this property.