CVE Vulnerability Catalog

In the Linux kernel, the powerpc/iommu module has an overflow validation bug in iommu_tce_check_ioba. The unified IOBA checking ignored the npages argument, using a constant value of 1, potentially allowing overflow when npages > 1. The fix accounts for npages, checks arithmetic overflow, and verifies the entire range does not exceed table capacity.

In the Linux kernel, the futex mechanism lacks private hash allocation on vfork(). Since accessing mm via vfork() is feasible, a private hash must be allocated for vfork() and other CLONE_VM users. The fix ensures the private hash is allocated before any private futex waiters exist.

In the Linux kernel, the drm/xe/i2c driver has a use-after-free vulnerability during unbind. The xe_i2c structure is freed before the SGUnit IRQ is disabled, leaving a window where an I2C IRQ can hit freed memory. The fix explicitly disables the I2C IRQ in xe_i2c_remove().

In the Linux kernel, the btrfs filesystem has a vulnerability where cleaning up verity items (rollback_verity, drop_verity_items, btrfs_orphan_cleanup) lacks metadata reservation, causing the whole filesystem to be forced read-only when hitting qgroup limit or lack of space, even though the limit applies to one subvolume only. Leftover items are never removed, making the subvolume unreachable or causing mount failures.

In the Linux kernel, the dev_fill_forward_path() function contains a WARN_ON_ONCE that can be triggered by a routing loop in IPIP and IPv6 tunnels when the route to the tunnel's remote endpoint resolves back to the tunnel itself. This configuration is possible for users with CAP_NET_ADMIN and causes the function to make no progress, triggering the warning when a flowtable tries to offload a flow through the tunnel.

In the Linux kernel, the fbnic network driver has a vulnerability where fbnic_tx_map() skips the doorbell write and completion request for packets with xmit_more set, relying on the packet ending the burst to publish them all. If that packet is dropped (e.g., due to DMA error), no doorbell is written, and descriptors of preceding packets remain invisible to the hardware, potentially causing a transmit queue stall.

A vulnerability in the Linux kernel's sock_gettstamp() function changes socket sk_flags without holding the socket lock. This leads to a race condition between bind() and SIOCGSTAMPNS_NEW ioctl, potentially causing a use-after-free on UDP sockets. The fix locks the socket only when SOCK_TIMESTAMP needs to be set, keeping the common case lockless.

In the Linux kernel, the Cortina (gmac) network driver has a vulnerability where the RX overrun interrupt is reported in interrupt status register 4, but gmac_irq() acknowledges it using the RX descriptor error bit from status register 0. For GMAC0 this writes the GMAC1 overrun bit, while for GMAC1 the shift leaves no bit in the 32-bit register, leading to incorrect interrupt acknowledgment.

In the Linux kernel, the PSP (Packet Security Protocol) mechanism conflicts with TLS ULP in its usage of both skb->decrypted and sk->sk_validate_xmit_skb(). To avoid conflicts, PSP should be mutually exclusive with TLS ULP, the only other user of these fields. Additionally, for future proofing, it would make sense to assert that sk->sk_validate_xmit_skb() is also NULL in both setup paths.

A vulnerability in the Linux kernel's x86 kprobes implementation causes a kernel crash when probing CS CALL instructions using eBPF. The int3_emulate_call() function assumes the CALL instruction is 5 bytes long, but the CS-prefixed CALL instruction is 6 bytes, leading to an incorrect exception return address and a crash. The fix uses the actual instruction length from the instruction decoder instead of the hardcoded CALL_INSN_SIZE macro.

In the Linux kernel, the mvpp2 network driver has a vulnerability where mvpp2_change_mtu() may call mvpp2_bm_switch_buffers(priv, true) without checking whether the number of pools (nrxqs * 2) exceeds MVPP2_BM_MAX_POOLS (8). This can lead to an out-of-bounds access in the priv->page_pool array in mvpp2_bm_init(), as the array is sized to hold MVPP2_PORT_MAX_RXQ entries and the per-CPU scheme doubles the count.

In the Linux kernel, a vulnerability exists in pskb_carve_inside_header() and pskb_carve_inside_nonlinear(), which after removing initial packet bytes do not properly update header pointers (mac_header, network_header, transport_header, csum_start). Leftover stale values point beyond actual data, potentially causing kernel BUG during RDS TCP packet processing.

In the Linux kernel, the amdgpu graphics driver has a vulnerability where nbio_v7_9_handle_ras_controller_intr_no_bifring() dereferences ras and obj without checking for NULL. Both amdgpu_ras_get_context() and amdgpu_ras_find_obj() can return NULL, e.g., during the window between adev->nbio.ras being set and the PCIE_BIF ras object being created, which can cause a crash in hard-IRQ context.

In the Linux kernel's btrfs filesystem, during hole punching and reflinking operations, if inode update fails, the transaction is not aborted. This can lead to persistent inconsistency if the transaction is committed after the failure, as file extent items have been dropped from a range and either a hole was punched or a new file extent item was inserted.

In the Linux kernel, there is a null pointer access bug in the is_include_guest_event() function in the perf subsystem. During module unload with an active perf connection, the pmu pointer is freed, and later closing the connection leads to a null pointer dereference, causing a crash.

In the Linux kernel's 9p filesystem, the v9fs_issue_write() function does not correctly update the i_size and remote_i_size fields after a write if the file was enlarged. The fix updates these fields based on the start position and the count returned by p9_client_write(), assuming that the 9P server returns a reduced count on short writes (e.g., ENOSPC).

In the Linux kernel's ALSA core subsystem, there is a potential use-after-free (UAF) vulnerability after asynchronous sound card release. When the card is released asynchronously via snd_card_free_when_closed(), in-flight tasks may still access the card->dev device after disconnection, leading to UAF. The fix takes a refcount of card->dev at initialization and releases it at the destructor.

In the Linux kernel's ALSA usb-audio driver, a vulnerability was found that causes an out-of-bounds write when handling implicit feedback. The packet count for isochronous URBs is overwritten with a value from the sync source, leading to writes past the iso_frame_desc array. The fix clamps the packet count to the URB capacity.

In the Linux kernel's ALSA virtio driver, the virtsnd_remove() and virtsnd_freeze() functions delete the virtqueues before resetting the device. This allows the device to access freed vring memory. The fix resets the device before deleting the virtqueues to prevent access to freed memory.

In the Linux kernel's ASoC codec rt712-sdca-dmic, the stream_config structure is not initialized before being passed to sdw_stream_add_slave(). The type field may contain garbage, which is later copied to stream->type. The fix zero-initializes stream_config so type defaults to SDW_STREAM_PCM, and uses the snd_sdw_params_to_config() helper.