CVE Vulnerability Catalog

In the Linux kernel's batman-adv (BLA) module, a NULL pointer dereference vulnerability was found. It occurs when a hard interface (hardif) is detached from a mesh interface (meshif) without holding rtnl_lock, causing the meshif pointer to become NULL. Subsequent operations, such as sending an ARP request, trigger the flaw.

In the Linux kernel, a reference leak of tp_vars was found in the batman-adv throughput meter receiver shutdown. The flaw stems from incorrect synchronization between the timer callback and batadv_tp_stop_all(), causing inconsistent resource release.

In the Linux kernel, a vulnerability was found in the batman-adv module where empty VLAN responses could be sent in the Translation Table (TT) protocol. The fix extends previous protections against TT request storms to also prevent sending inconsistent TT entries for replies from the global TT state.

In the Linux kernel's pmbus/adm1266 driver, a vulnerability was found due to missing validation of the record count in the BLACKBOX_INFO response. An attacker can supply an inflated value, causing an out-of-bounds read beyond the allocated buffer and potential memory corruption.

In the Linux kernel hwmon (pmbus/adm1266) driver, a vulnerability was found due to missing validation of block-read response length in GPIO accessors. Functions adm1266_gpio_get() and adm1266_gpio_get_multiple() do not check if the response contains at least 2 bytes, leading to use of uninitialized stack memory when a short response (0 or 1 byte) is received. This data can be leaked to userspace via gpiolib (sysfs or ioctl), causing kernel stack memory disclosure.

In the Linux kernel netfilter/x_tables subsystem, a vulnerability exists where tables (ARP/IP/IPv6) are added to the per-netns list before allocating the hook ops copy. During concurrent netns exit, the pre_exit callback finds the table with a NULL ops pointer, causing a NULL dereference and a general protection fault.

In the Linux kernel, a vulnerability in the NVMe driver causes a bio leak when integrity mapping fails. The issue arises because the local bio variable is always NULL instead of being retrieved directly from the request.

In the Linux kernel powerpc/hv-gpci subsystem, a preempt count leak was found in four sysfs show() functions. These functions call preempt_disable() via get_cpu_var() but fail to call put_cpu_var() on successful reads, causing the preempt counter to accumulate. After repeated reads, the kernel may return to userspace with preemption disabled, leading to SIGSEGV and 'BUG: scheduling while atomic' errors.

A bug in the Linux kernel's netfs_write_begin() function triggers a kernel panic (VM_BUG_ON_FOLIO) when attempting to unlock a folio that is not locked. The issue occurs with approximately 30% probability during repeated runs of the generic/013 test, causing system crashes.

A vulnerability in the Linux kernel's netfs subsystem occurs when netfs_invalidate_folio() fails to clear the dirty bit after all modified data in a folio is removed by truncation. This can cause a kernel oops during subsequent mmap() reads due to a missing netfs_folio structure.

A potential deadlock was discovered in the Linux kernel's write-through mode within the netfs subsystem. The fix ensures netfs_advance_writethrough() always unlocks the supplied folio and marks it dirty if not fully written, preventing deadlocks against mmapped reads and writes.

A vulnerability in the Linux kernel where a reference leak occurs in netfs_write_begin() during error handling. The leak happens when netfs_wait_for_read() returns an error, leaving the request reference unreleased.

In the Linux kernel, netfs_perform_write() mishandles folio->private, potentially causing multiple private data attachments, folio ref leaks, and leaks of netfs_folio structs or netfs_group refs.

A vulnerability in the Linux kernel's bio_integrity_map_user() function mishandles partial pinning by pin_user_pages_fast(), causing a null-pointer dereference and a general protection fault.

In the Linux kernel's Adreno GPU driver, a vulnerability allows a user-triggered crash. On a2xx-a4xx generations, querying UBWC parameters from userspace can cause a NULL pointer dereference.

A race condition in the Linux kernel's ovpn driver can occur when deleting a network interface. In a narrow time window, adding a new peer via netlink may cause the netdevice to hang and prevent its unregistration.

In the Linux kernel's cachefiles subsystem, an error occurs when vfs_mkdir() fails: the error code is not extracted from the returned error pointer, causing the function to return NULL instead of a proper error pointer, which may lead to incorrect behavior.

In the Linux kernel's lm90 driver, a race condition exists between delayed work cancellation (alert_work, report_work) and hwmon device release. Under certain conditions, this can lead to a use-after-free vulnerability.

In the Linux kernel, a vulnerability in the tracing subsystem causes hist_field_name() to return NULL instead of an empty string when the field name is truncated. This leads to NULL pointer dereference in strcat() and strcmp() calls, potentially causing a system crash.

In the Linux kernel, a memory leak of the dynamic software node was found in the GPIO aggregator driver. The node is created for the aggregator platform device when using configfs but is not destroyed upon device deactivation.