CVE Vulnerability Catalog

In the Linux kernel's NTFS3 filesystem (ntfs3), a vulnerability was found involving the use of an uninitialized 'lcn' variable in the ntfs_iomap_begin() function. The issue occurs when the block length (len) is zero, causing 'lcn' to be used before initialization.

In the Linux kernel USB Type-C driver, an error pointer dereference was found. The function does not properly check the partner registration result, which can lead to ERR_PTR dereference and potential system crash.

In the NTFS3 file system in the Linux kernel, a bug was found where the run load for VCN0 is missing in the attr_data_get_block_locked() function. This can lead to incorrect reads and trigger a WARN_ON(1) warning.

In the Linux kernel's NTFS3 filesystem, a vulnerability was found where the volume label is not properly null-terminated after UTF-16 to UTF-8 conversion. The ntfs_fill_super() function fails to add a trailing NUL, potentially causing out-of-bounds read when the label is displayed via ntfs3_label_show().

In the Linux kernel, the dell-wmi-sysman driver for x86 platforms has a vulnerability where firmware-provided strings are aggregated into fixed 512-byte buffers using strcat() without checking remaining space. This could lead to a buffer overflow if the combined strings exceed the buffer size.

In the Linux kernel, an integer overflow vulnerability was found in the sbc_execute_unmap() function of the SCSI target subsystem. The lack of protection against LBA + range wrapping on 64-bit overflow can lead to incorrect bounds checking.

In the Linux kernel, the ccu_mix driver for Spacemit SoCs has an inverted condition in ccu_mix_trigger_fc() that skips frequency change triggering. This causes kernel panics during cpufreq scaling.

In the Linux kernel F2FS filesystem, a bug causing a crash (BUG) during garbage collection (GC) was found. The issue occurs when an already updated page is re-read from disk, triggering a VM_BUG_ON_FOLIO assertion.

A vulnerability in the Linux kernel's F2FS filesystem causes data loss when fsync on a newly created file runs concurrently with a checkpoint operation. Incorrect use of nat_entry flags leads to premature assumption that the checkpoint has completed, resulting in data loss after a power failure.

In the Linux kernel, the EROFS filesystem vulnerability was found where the `lcn` variable was typed as `unsigned long`, which is only 32 bits wide on 32-bit platforms. This causes truncation of the `(lcn << lclusterbits)` shift beyond 4 GiB, potentially leading to block addressing errors.

In the Linux kernel's net/sched/act_mirred module, a bug was found in the tcf_blockcast_redir function. When iterating block ports to redirect packets to multiple devices, the mac_header_xmit flag was queried from the wrong device (the next in iteration, not the one being sent to). This causes incorrect decisions about pushing or pulling the MAC header, leading to skb header corruption and, in worst cases, a kernel panic due to headroom exhaustion.

In the Linux kernel's macvlan driver, the macvlan_get_size() function does not reserve space for the IFLA_MACVLAN_BC_CUTOFF attribute. This causes -EMSGSIZE errors and a WARN_ON in rtnetlink when dumping the interface if bc_cutoff is set to a value other than 1.

In the Linux kernel, a vulnerability occurs when an IPv6 nexthop is replaced with an IPv4 nexthop without updating the has_v4 flag in all groups containing this nexthop. This allows IPv6 routes to reference groups with only AF_INET members, causing a NULL pointer dereference and system panic.

A race condition was found in the Linux kernel's ice driver during TX timestamp ring cleanup. Lack of proper synchronization between ice_free_tx_tstamp_ring() and ice_tx_map() can lead to a NULL pointer dereference.

In the Linux kernel's ice driver, a potential NULL pointer dereference was found in the error path of ice_set_ringparam(). The issue occurs because tstamp_ring is nullified without clearing the ICE_TX_RING_FLAGS_TXTIME flag, leading to a NULL dereference in ice_free_tx_tstamp_ring() if ice_setup_tx_ring() fails.

A vulnerability in the Linux kernel netfilter xtables module incorrectly uses NFPROTO_UNSPEC in the xt_mac, xt_owner, xt_physdev, and xt_realm extensions. This causes filtering rules to be applied to unexpected protocol families, potentially leading to firewall misconfiguration.

In the Linux kernel's dualpi2 queuing discipline (net/sched), a vulnerability was found in the draining of both C-queue and L-queue during configuration change. The dualpi2_change() function incorrectly handled cases where packets were only in the L-queue, leading to a NULL pointer dereference.

In the Linux kernel, a durable file descriptor leak was found in ksmbd during durable v2 open when ClientGUID mismatches. The reference obtained from ksmbd_lookup_fd_cguid() is not released in the mismatch path, causing resource leaks.

In the Linux kernel's RDS subsystem, a vulnerability was found where the per-item info buffer is not zeroed before being passed to visitor functions. This leads to kernel stack data leakage to user space when the RDS connection is not in RDS_CONN_UP state.

In the Linux kernel, the vsock/virtio driver had a bug in virtio_transport_init_zcopy_skb() that used an already-consumed iterator (iter->count) for pinned-pages accounting, skipping RLIMIT_MEMLOCK enforcement on the last skb. This could lead to uncontrolled memory usage.