CVE Vulnerability Catalog

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a lack of range checking for read/write region indexes. The introduction of the capability chain clamped indexes only for capabilities, but not for existing regions.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is an out-of-bounds check on the CCW array. The loop may check a 257th element, which is out of bounds.

In the Linux kernel, in the s390/vfio_ccw subsystem, cleanup of cp resources is performed in fsm_notoper(), which can be called asynchronously while holding other locks. This can lead to deadlocks or malfunction.

In the Linux kernel, in the s390/vfio_ccw subsystem, the scope of io_mutex has been expanded to close remaining synchronization gaps. It also takes advantage of moving cp_free() to a workqueue, allowing safe lock management.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a lack of locking mechanism for the CRW region, which relies solely on asynchronous hardware events. A lock has been added to ensure consistent reading of the payload list.

In the Linux kernel, the xcrb_msg_to_type6cprb_msgx() function for s390/zcrypt lacks proper input validation, leading to integer overflow, missing minimum size validation, and arithmetic overflow in sum calculations. This can result in undersized buffer allocations, uninitialized memory access, and buffer overflows.

In the Linux kernel, the xcrb_msg_to_type6_ep11cprb_msgx() function for s390/zcrypt lacks minimum size validation, has arithmetic overflow in length calculations, and improper ASN.1 payload parsing. This can lead to uninitialized memory access and buffer overflows.

In the Linux kernel, the zcrypt_msgtype6_send_ep11_cprb() function for s390/zcrypt uses fragile struct overlays to access and modify the domain field in the EP11 CPRB payload, causing maintainability and security concerns. It lacks validation of actual ASN.1 encoding and has error-prone length format detection.

In the Linux kernel, the amdgpu driver's AMDGPU_GEM_CREATE checked domain bits against AMDGPU_GEM_DOMAIN_MASK but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA, causing amdgpu_bo_placement_from_domain() to exceed AMDGPU_BO_MAX_PLACEMENTS and hit BUG_ON().

In the Linux kernel, the amdgpu driver incorrectly calculates the minimum size for UVD decode images because it uses width instead of pitch. Additionally, it does not reject pitch over 4096, which could lead to overflow.

In the Linux kernel, the XFS filesystem's xfs_rtginode_ensure() treats every error from xfs_rtginode_load() other than -ENOENT as success. This can leave the realtime group inode unset after an I/O, allocation, or corruption error, and growfs continues as though the inode had been loaded.

In the Linux kernel, the XFS filesystem has a vulnerability due to an off-by-one error in the validation of the root level of the rtrefcount B-tree. A crafted filesystem image with metadir, realtime, and reflink enabled can cause a slab-out-of-bounds write during mount or recovery, leading to a kernel panic.

In the Linux kernel XFS filesystem, during log recovery, the function xlog_recover_do_reg_buffer() copies data into a buffer based on a dirty bitmap without proper bounds checking. An attacker can supply a crafted filesystem image that causes an out-of-bounds write and corrupts the kernel heap. The issue is fixed by replacing the ASSERT with a real XFS_IS_CORRUPT() check that aborts recovery with -EFSCORRUPTED.

In the Linux kernel XFS filesystem, the function xrep_tempfile_create can lead to a use-after-free (UAF) if the tempfile creation code fails after setting sc->tempip. The fix addresses this issue.

In the Linux kernel XFS filesystem, during exchange-range operations with the XFS_EXCHMAPS_INO1_WRITTEN flag, the function xmi_can_exchange_reflink_flags() may move the reflink flag to another file, but not all mappings are exchanged, which can lead to clearing the reflink flag on a file that still has shared written extents. This can result in data corruption. The fix disables the reflink flag exchange when XFS_EXCHMAPS_INO1_WRITTEN is requested.

A vulnerability in the Linux kernel's Ceph filesystem can cause read operations to hang indefinitely. The issue stems from an incorrect mds_wanted flag state, where a client may wait forever for FILE_RD rights after they were revoked by the MDS. The patch introduces a bounded wait and forces a synchronous OPEN renew when the required caps are not actually held.

In the Linux kernel, the ASoC tas2562 driver's tas2562_volume_control_put() function does not validate the value written by userspace. This value is used as an index into a fixed-size array, which can lead to buffer overflow and writing incorrect data to the device.

In the Linux kernel, the clk spacemit k3 driver does not mark the HDMA clock as critical. This clock is responsible for the internal TCM access path of the X100 RISC-V core, and turning it off can cause the system to hang, e.g., on a page fault during vector access.

In the Linux kernel, the crypto tegra driver's tegra_gcm_do_one_req() function incorrectly calculates rctx->cryptlen, which can lead to a write beyond the rctx->dst_sg buffer during decryption if ctx->authsize remains zero.

In the Linux kernel, the af_unix function unix_del_edge() does not unlink the scc_entry before freeing the vertex, which can lead to partial freeing of a dead SCC by the garbage collector, causing errors.