CVE Vulnerability Catalog

In the Linux kernel's bcachefs filesystem, a missing bounds check in superblock validation could allow out-of-bounds read. The fix adds the missing check.

In the Linux kernel's fork function, a race condition exists between fork and hugetlbfs file operations. The fix defers linking the file VMA until the VMA is fully initialized.

In the Linux kernel's F2FS filesystem, there is potential corruption when moving a directory, similar to an issue in ext4. The fix addresses this problem.

In the Linux kernel, the Bluetooth subsystem (hci_core) now disables works during hci_unregister_dev because the hci_dev is about to be freed and new submissions should not be allowed.

In the Linux kernel, in the Bluetooth subsystem (hci_conn), the function disable_delayed_work_sync is used instead of cancel_delayed_work_sync, which not only cancels ongoing work but also disables new submissions, which is desirable.

In the Linux kernel, in the DRM/XE driver (guc_submit), a race condition around the suspend_pending field was fixed, which could cause assertions and warnings in certain test scenarios.

An out-of-bounds read was found in the NC-SI OEM response handler of libslirp. A truncated NC-SI OEM Ethernet frame causes ncsi_rsp_handler_oem() to read up to 4 bytes beyond the supplied packet length and reflect the value into the response sent to the guest, resulting in guest-observable disclosure.

In the Linux kernel, in the Bluetooth subsystem (MGMT), possible deadlocks were fixed that could occur due to hci_cmd_sync_dequeue, causing threads to block for extended periods.

In the Linux kernel, in the L2TP subsystem, a possible tunnel refcount underflow was fixed, which could occur during session deletion when the tunnel pointer was invalid.

A vulnerability in the Linux kernel has been resolved regarding the introduction of locking when enabling/disabling SR-IOV, which led to deadlocks.

The faraday-http-cache library stores cached responses in JSON format by default and reads them back using JSON.load, which honors the json_class key and calls json_create on the named class. Response headers are stored verbatim in the cache entry, so a malicious origin server can return a response with a json_class key leading to unsafe deserialization.

A vulnerability has been identified in the Linux kernel in the rtw_core_enable_beacon() function, which reads 4 bytes from an address that is not a multiple of 4. This can lead to system crashes on some devices.