CVE Vulnerability Catalog

A vulnerability has been identified in the Linux kernel within the ibmasm_send_i2o_message() function, which may lead to a heap over-read. A root user can exploit unvalidated header fields, resulting in reading data beyond the allocated memory area.

A vulnerability in the Linux kernel related to integer overflow in the run_unpack() function during volume boundary checks has been resolved. This issue occurred due to the use of raw addition, which could bypass validation for large lcn and len values.

A vulnerability has been identified in the Linux kernel caused by a race condition between the m2m job_abort and device_run functions, leading to kernel panic. The issue occurs when v4l2_m2m_ctx_release() frees m2m_ctx while v4l2_m2m_try_run() attempts to call device_run with the same context.

A vulnerability related to Bluetooth event handling has been fixed in the Linux kernel, which could lead to a potential use-after-free (UAF) in SSP key handling.

A vulnerability related to string buffer overrun in the AppArmor module has been identified in the Linux kernel. The issue occurs when booting Ubuntu 26.04 on ARM64 architecture, leading to memory errors.

A vulnerability in the Linux kernel's SELinux module was found, involving incorrect access checks for mmap() and mprotect() operations on overlayfs filesystems. The enforcement of access controls for backing files was missing during these operations.

A vulnerability in the Linux kernel related to improper resource management in the __rds_rdma_map() function has been fixed. The issue occurred when copying the generated cookie back to user space failed, which could lead to improper resource freeing.

A vulnerability has been identified in the Linux kernel within the Ceph filesystem that allows unsafe re-adding of negative dentries to the hashed list. This issue can lead to data structure corruption, resulting in process hangs.

A vulnerability has been identified in the Linux kernel related to use-after-free in the driver removal function. The issue occurs when a packet arrives after destroy_workqueue() is called but before sock_release(), leading to a use-after-free error.

A vulnerability has been identified in the Linux kernel that allows reading bitmap data from spare disks that are not fully synchronized. The lack of an In_sync flag check may lead to reading stale or uninitialized bitmap data.

A vulnerability in the Linux kernel related to validating ICMP reply types before using ICMP pointers has been resolved. Extended echo replies use ICMP_EXT_ECHOREPLY, which is outside the range covered by icmp_pointers[].

A vulnerability has been identified in the Linux kernel within the vfio/cdx module, which involves a lack of synchronization during operations on the cdx_irqs array. This can lead to a use-after-free situation due to concurrent calls, posing a risk of system instability.

A vulnerability in the Linux kernel's authencesn cryptographic mechanism allows using an undersized hash digest (1-3 bytes) during instance creation, leading to an out-of-bounds memory access when handling the ESN sequence number.

A vulnerability has been identified in the ks8851 driver in the Linux kernel that leads to a deadlock when processing TX and RX packets simultaneously. The issue occurs when BH is enabled during the allocation of buffers for received packets.

A vulnerability has been identified in the Linux kernel that allows re-entry into the slab allocator in NMI context, leading to slab state corruption. This issue occurs in uniprocessor (UP) systems and can be triggered by the kmalloc_nolock() function.

A vulnerability in the Linux kernel has been resolved in the smc_clc_wait_msg function. The issue involved handling connection declines during the early handshake stage, which could lead to incorrect updates of the link group synchronization state.

A vulnerability has been identified in the Linux kernel within libceph that may lead to a null pointer dereference in the ceph_handle_auth_reply() function. The issue occurs when a CEPH_MSG_AUTH_REPLY message contains zero values for both protocol and result, which is not currently treated as an error.

A vulnerability has been identified in the Linux kernel that allows for out-of-bounds read in the ibmasm_handle_mouse_interrupt() function. The issue occurs when the reader or writer indices exceed the allowed queue size, potentially leading to unintended reads from device registers.

A vulnerability has been identified in the Linux kernel that allows improper memory access due to lack of validation of the node identifier in the si_meminfo_node() function. Privileged users can exploit the DAMON tool to trigger this error.

A vulnerability has been identified in the Linux kernel related to socket migration in the SO_REUSEPORT group, which may lead to blocking of waiting threads. After socket migration, the new listener does not notify waiters about the availability of a connection, potentially causing them to remain asleep indefinitely.