CVE Vulnerability Catalog

In the Linux kernel, a vulnerability in wifi: mac80211 was fixed regarding validation of individual TWT parameters before driver setup. ieee80211_process_rx_twt_action() only partially validates a received S1G TWT setup frame before queueing it. An individual agreement can therefore reach ieee80211_s1g_rx_twt_setup() with twt->length too short for the full struct ieee80211_twt_params. The individual path passes twt to drv_add_twt_setup(). Both the tracepoint and the driver callback consume the complete parameters block, not merely req_type. The fix does not pass a short individual agreement to the driver. Broadcast agreements remain unchanged because they are rejected locally after accessing only req_type.

In the Linux kernel, a vulnerability in Bluetooth: ISO was fixed regarding dangling hcon references in iso_conn. After iso_conn_del(), ISO sockets should not dereference the hcon anymore. Currently, clearing iso_conn::hcon relies on iso_conn_del() releasing the last reference to the iso_conn. The fix simplifies this by explicitly clearing conn->hcon in iso_conn_del(), to avoid more complex reasoning on races about who holds the last reference.

In the Linux kernel, a vulnerability in iomap was fixed that caused a deadlock. iomap_split_ioend can split bios that already come from iomap_ioend_bioset and thus deadlock when the bioset is exhausted. The fix adds a separate bio_set to avoid this deadlock. Additionally, iomap_ioend_split_bioset is marked static as it is only used in ioend.c, fixing the sparse warning reported by the kernel test robot.

In the Linux kernel, a vulnerability in mm/percpu-km was fixed that caused bitmap overflow and accounting issues in pcpu_create_chunk(). In pcpu_create_chunk(), nr_pages is the total contiguous backing allocation, i.e., nr_units * pcpu_unit_pages, but pcpu_chunk_populated() uses it to set chunk->populated, whose size is pcpu_unit_pages bitmap. Since bit N in chunk->populated means page offset N inside every unit is backed, when nr_units > 1, the function writes beyond chunk->populated. The fix uses chunk->nr_pages. It also fixes the global pcpu_nr_empty_pop_pages accounting, since pcpu_balance_free() only iterates up to chunk->nr_pages. The issue was introduced by commit a63d4ac4ab609, and later commit b539b87fed37f added pcpu_nr_empty_pop_pages and caused the accounting issue.

In the Linux kernel, the SCTP Adaptation Indication parameter length was not properly validated. A header-only parameter was accepted, leading to an out-of-bounds read and potential disclosure of four receive-buffer tail bytes.

In the Linux kernel's ALSA PCM subsystem, there is an issue with waking linked drain waiters on unlink. This can lead to use-after-free of a stack frame during a later wake-up.

In the Linux kernel's io_uring, there is an issue with preserving per-task restrictions across exec. These restrictions are dropped during task context cleanup, allowing an unrestricted ring to be created after exec.

A vulnerability in the Linux kernel's SPI-NAND driver for Qualcomm chips (spi-qpic-snand) was found. The SET_FEATURE value was written to the register after command execution, causing a one-operation delay. As a result, the chip remained in OTP mode, making the flash memory unusable and the device unbootable.

In the Linux kernel's dasd driver, there is an issue with an undersized format-check buffer. The fmt_buffer_size variable is declared as int, causing truncation of the computed size and potentially leading to out-of-bounds write.

In the Linux kernel's zcrypt driver, there is an issue with incorrect domain value verification for EP11 CPRBs. The wrong upper limit can lead to heap memory access beyond perms->adm when an administrative CPRB is sent.

In the Linux kernel, the CAN J1939 function j1939_session_fresh_new() did not zero the buffer before use, potentially leaving residual data. The fix zeroes the allocated buffer to prevent potential information leakage.

In the Linux kernel, the CAN softing driver's fw_parse() function did not validate that firmware records fit within the firmware image, potentially leading to out-of-bounds reads. Additionally, bounds calculations for DPRAM writes were prone to integer overflow, and the application loader's data copy was not properly bounded.

In the Linux kernel, the VMware driver (drm/vmwgfx) had two sites in vmwgfx_resource.c that assigned boolean literals to the guest_memory_size field, which is an allocation-size field, instead of the adjacent guest_memory_dirty bitfield. This caused guest_memory_size to hold 0 or 1 instead of the actual allocation size, leading to errors in dirty page range calculations and buffer allocation.

In the Linux kernel, the VMware driver (drm/vmwgfx) function vmw_external_bo_copy() did not validate bounds for copy operations on imported dma-buf buffers. Lack of validation could lead to out-of-bounds reads or writes, especially with crafted plane state data.

In the Linux kernel, the hwmon ltc4282 driver had a missing return statement when reading the minimum alarm voltage for the VGPIO channel, causing an out-of-bounds access.

In the Linux kernel, the Bluetooth subsystem (hci_sync) had a theoretical use-after-free (UAF) vulnerability in hci_connect_acl/le_sync() callbacks. If the connection (conn) is freed while the hci_sync task is running, it could lead to use of freed memory.

In the Linux kernel, the SCSI target iblock driver had a bug in iblock_execute_pr_out() where the NULL check for PREEMPT, PREEMPT_AND_ABORT, and RELEASE operations was incorrect. This allows unimplemented hooks (ops->pr_clear) to be called, leading to NULL pointer dereference.

In the Linux kernel's snapshot_page(), __page_2 is read for order-1 folios, but it should only be read when nr_pages > 2. This can cause a page fault during DLPAR memory removal on ppc64le systems.

A use-after-free vulnerability was found in the Linux kernel's Bluetooth SCO subsystem. The issue stems from incorrect reference counting for the sco_conn structure, where the socket did not hold its own reference, leading to a double-free race condition between socket close and disconnection event handling.

In the Linux kernel for RISC-V, a bug was found in the calculation of vmemmap_start_pfn alignment. The issue uses alignment expressed in bytes of struct page storage instead of physical address bytes, causing a warning and potential memory initialization problems on systems like QEMU virt.