CVE Vulnerability Catalog

In the Linux kernel's AHCI driver (libahci), for controllers with the AHCI_HFLAG_32BIT_ONLY flag, the PxCLBU and PxFBU registers are not cleared, causing issues with JMicron JMB585 controllers. The fix explicitly clears these registers to ensure proper operation with 32-bit DMA.

In the Linux kernel's CIFS filesystem, the cifs_chan_skip_or_disable() function uses a server pointer after dropping the channel reference, leading to use-after-free. The fix signals the channel and primary server and captures the primary server pointer before dropping the channel reference.

A use-after-free vulnerability was found in the Linux kernel's POSIX timer cleanup mechanism during exec() by a non-leader thread. The bug occurs when operations after de_thread() (such as exec_mmap()) fail, leading to freeing a timer that is still queued, followed by a subsequent removal from the rbtree.

A vulnerability in the Linux kernel's fs/dax subsystem can cause a kernel panic during VM boot with DAX-enabled storage. The issue is the lack of a check for empty or zero entries in the xarray before calling dax_to_folio() in dax_associate_entry(), dax_disassociate_entry(), and dax_busy_page(). A previous fix (commit 98c183a4fccf) added guards but they still come after dax_to_folio(), leaving the problem unresolved.

In the Linux kernel, a race condition in POSIX CPU timers can lead to use-after-free (UAF). The issue stems from losing the distinction between 'timer on expiry list' and 'delivery canceled' after changing the 'firing' flag to boolean. The fix checks whether the timer is on the expiry list instead of relying on the flag.

In the Linux kernel, in RDS IB code, rds_ib_cm_connect_complete() calls rds_conn_destroy() on protocol version mismatch, leading to a deadlock in workqueue. The fix changes it to rds_conn_drop(), which schedules connection shutdown asynchronously.

A use-after-free vulnerability exists in the Linux kernel signal handling mechanism, caused by a race condition during exec() by a non-leader thread. A SIGEV_THREAD_ID timer created against the leader's tid may point to the thread calling execve() after tid exchange, leading to incorrect signal queueing and use of freed memory. The issue is fixed by flushing task pending signals earlier in exit_signals() and preventing signal queueing for tasks with PF_EXITING set.

In the Linux kernel, in TCP code, old ACKs (before SND.UNA) are excluded from the fast path and directed to the slow path, where they are properly validated according to RFC5961. This prevents acceptance of old ACKs and modification of connection state before validation.

In the Linux kernel, in swiotlb code, swiotlb_bounce() uses an incorrect address for highmem page lookup, which can lead to read/write from the wrong memory page. The fix uses the adjusted orig_addr for both operations.

In the Linux kernel, in RDMA/ucma code, there is a race between multicast join and leave operations that can lead to use-after-free (UAF). The fix holds the mutex throughout from join to copy_to_user to prevent leave from missing the join.

In the Linux kernel, in RDMA/core code, iwpm_get_nlmsg_request() initializes the refcount after adding to the global list, which can lead to a refcount bug. The fix initializes kref before list_add_tail() and initializes all fields before adding to the list.

In the Linux kernel, in openvswitch code, ovs_ct_get_conn_labels() may add a labels extension to a confirmed conntrack entry, which can lead to reallocation and freeing of the extension block during concurrent access. The fix adds the extension only for unconfirmed conntracks.

In the Linux kernel, in nfsd code, handling of NFSEXP_PNFS in the netlink codepath is incorrect because the move of the check to callers did not account for the new call in nfsd4_setup_layout_type(). The fix corrects this check.

In the Linux kernel on arm64, during hibernation, swsusp_arch_suspend_exit() fails to pass arguments to the HVC_SET_VECTORS call, leaving EL2 vectors incorrectly set after resume. This leads to a use-after-free of the vectors page, potentially causing a system hang after resuming from hibernation.

In the Linux kernel for arm64, percpu operations on 8- and 16-bit types using LSE instructions do not include the size suffix, causing incorrect 32-bit memory accesses instead of the intended 8 or 16 bits. The fix appends the 'sfx' suffix to the LSE instruction.

In the Linux kernel Bluetooth module (hci_codec), the Read Local Supported Codecs parsers do not properly validate the vendor codec count length, potentially leading to out-of-bounds reads. The fix uses skb_pull_data() to validate and consume codec headers before using their count.

In the Linux kernel Bluetooth module (hci_sync), hci_dev_close_sync() clears the local codec list without holding hdev->lock, leading to a use-after-free during concurrent BT_CODEC queries. The fix takes the lock around the clear operation.

In the Linux kernel btrfs filesystem, mark_block_group_to_copy() iterates over the commit root without locking, leading to a use-after-free during concurrent transaction commits. The fix uses path->need_commit_sem to protect the commit root search.

In the Linux kernel btrfs filesystem, btrfs_rebuild_free_space_tree() does not clear the BTRFS_FS_CREATING_FREE_SPACE_TREE flag on error paths, potentially causing delayed reference processing to be skipped. The fix clears the flag on all failure paths.

In the Linux kernel dma-buf/dma-fence module, a previous fix changed the signaling check to an ops pointer check, causing loss of RCU protection after signaling for many dma_fence implementations, leading to use-after-free. The fix adds an additional signaling check alongside the ops pointer check.