CVE Vulnerability Catalog

In the Linux kernel, the XFS filesystem's xfs_rtginode_ensure() treats every error from xfs_rtginode_load() other than -ENOENT as success. This can leave the realtime group inode unset after an I/O, allocation, or corruption error, and growfs continues as though the inode had been loaded.

In the Linux kernel, the XFS filesystem has a vulnerability due to an off-by-one error in the validation of the root level of the rtrefcount B-tree. A crafted filesystem image with metadir, realtime, and reflink enabled can cause a slab-out-of-bounds write during mount or recovery, leading to a kernel panic.

In the Linux kernel XFS filesystem, during log recovery, the function xlog_recover_do_reg_buffer() copies data into a buffer based on a dirty bitmap without proper bounds checking. An attacker can supply a crafted filesystem image that causes an out-of-bounds write and corrupts the kernel heap. The issue is fixed by replacing the ASSERT with a real XFS_IS_CORRUPT() check that aborts recovery with -EFSCORRUPTED.

In the Linux kernel XFS filesystem, during directory tree repair, a self-referential directory may be detected. In such a case, the repair code attempts to lock the same inode twice (double iolock/ilock), leading to a deadlock. The fix detects this corner case and handles it appropriately.

In the Linux kernel XFS filesystem, the function xfs_dq_get_next_id() acquires the ILOCK on the quota inode before calling xfs_iread_extents(). If xfs_iread_extents() fails, the function returns without releasing the lock, causing a lock leak. This can leave the quota inode locked and cause subsequent quota operations to hang.

In the Linux kernel XFS filesystem, during AGI repair, the function xrep_iunlink_walk_ondisk_bucket may attempt to use the pointer sc->sa.agi_bp, which can be null if the buffer verifier fails. The fix uses ragi->agi_bp instead, which skips verifier checks, to avoid walking off the end of memory.

In the Linux kernel XFS filesystem, during online fsck, the function xrep_iunlink_resolve_bucket is still vulnerable to infinite loops coming from next_unlinked pointers. The fix remembers which inodes have already been seen and checks new agino pointers against that to detect loops.

In the Linux kernel XFS filesystem, the function xrep_tempfile_create can lead to a use-after-free (UAF) if the tempfile creation code fails after setting sc->tempip. The fix addresses this issue.

In the Linux kernel XFS filesystem, during exchange-range operations with the XFS_EXCHMAPS_INO1_WRITTEN flag, the function xmi_can_exchange_reflink_flags() may move the reflink flag to another file, but not all mappings are exchanged, which can lead to clearing the reflink flag on a file that still has shared written extents. This can result in data corruption. The fix disables the reflink flag exchange when XFS_EXCHMAPS_INO1_WRITTEN is requested.

In the Linux kernel XFS filesystem, the function xlog_recover_dquot_commit_pass2() validates the recovered dquot with xfs_dqblk_verify(). On failure, it sets error = -EFSCORRUPTED and jumps to out_release, but out_release unconditionally returns 0, so the error is discarded. This allows a corrupt quota buffer to be written back to disk.

A vulnerability in the Linux kernel's Ceph filesystem can cause read operations to hang indefinitely. The issue stems from an incorrect mds_wanted flag state, where a client may wait forever for FILE_RD rights after they were revoked by the MDS. The patch introduces a bounded wait and forces a synchronous OPEN renew when the required caps are not actually held.

In the Linux kernel, the ASoC tas2562 driver's tas2562_volume_control_put() function does not validate the value written by userspace. This value is used as an index into a fixed-size array, which can lead to buffer overflow and writing incorrect data to the device.

A vulnerability in the Linux kernel's ASoC SOF subsystem affects IPC payload handling for copier widgets. After suspend/resume, the ipc_config_data buffer is not refreshed, causing stale DMA channel assignments to be sent to firmware, leading to errors and crashes. The fix refreshes copier_data and dma_config_tlv before sending the IPC message.

In the Linux kernel, the optee ffa driver's optee_ffa_lend_protmem function does not check if the allocated pointer is NULL. Under memory pressure, this can lead to a null pointer dereference.

In the Linux kernel, the clk spacemit k3 driver does not mark the HDMA clock as critical. This clock is responsible for the internal TCM access path of the X100 RISC-V core, and turning it off can cause the system to hang, e.g., on a page fault during vector access.

In the Linux kernel, the crypto tegra driver's tegra_gcm_do_one_req() function incorrectly calculates rctx->cryptlen, which can lead to a write beyond the rctx->dst_sg buffer during decryption if ctx->authsize remains zero.

In the Linux kernel, the af_unix function unix_del_edge() does not unlink the scc_entry before freeing the vertex, which can lead to partial freeing of a dead SCC by the garbage collector, causing errors.

In the Linux kernel, the ovpn driver's ovpn_crypto_kill_key function assumes both crypto slots are populated and dereferences each slot before checking it. This can lead to a NULL pointer dereference when a peer has only one key or when the key to be removed is not present.

In the Linux kernel, the ovpn driver's crypto completion callbacks hold references to the key slot and peer. If the peer reference is released before the callback finishes, it can lead to use-after-free or scheduling an RCU callback after rcu_barrier has run, risking a crash.

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of the host application via crafted prompt inputs that cause the model to generate executable Python expressions evaluated without a sandbox.