CVE Vulnerability Catalog

In the Linux kernel, the RDMA/rxe driver has been fixed for a TOCTOU heap overflow in get_srq_wqe(). The function reads num_sge from the shared receive queue buffer mapped into userspace, validates it, but then re-reads the same field to calculate memcpy size, allowing a concurrent thread to modify it and cause a heap buffer overflow.

In the Linux kernel, the RDMA/rxe driver has been fixed for the non-SRQ receive path, where WQE fields were read directly from the shared queue buffer mapped into userspace. This allowed a malicious user to modify fields during processing, leading to out-of-bounds reads.

In the Linux kernel, the md/raid1 and md/raid10 drivers have been fixed to detect the error path using md_cloned_bio() instead of relying on r1_bio or r10_bio->read_slot, which may be NULL or -1 after splitting and resubmitting a failed bio. The previous logic could lead to using GFP_NOIO instead of (GFP_NOIO | __GFP_HIGH), potentially causing a deadlock under memory pressure.

A vulnerability in the Linux kernel's BPF_PROG_QUERY causes an out-of-bounds write when writing the 'query.revision' field to userspace. This occurs when userspace passes a smaller bpf_attr structure (e.g., 40 bytes, before the revision field was added), leading to a write beyond the allocated buffer. The fix propagates the user-provided attribute size to cgroup query handlers and conditionally skips writing the revision field when the buffer is too small.

In the Linux kernel, issues in ath12k_mac_vdev_create() of the ath12k WiFi driver have been fixed, which left the arvif object in an inconsistent state on error paths. The patch adjusts the control flow to ensure proper cleanup on vdev creation failures.

In the Linux kernel, a vulnerability in the BTT (Block Translation Table) mechanism for NVDIMM has been fixed, related to preemption during lane acquisition. The previous spinlock-based recursion model was invalid after lanes became preemptible, potentially leading to silent data corruption. The fix replaces the spinlock with a dynamically allocated per-lane mutex array.

In the Linux kernel, a vulnerability in the BPF mechanism has been fixed that allowed bypassing the exclusivity guarantee of BPF maps. Exclusive maps (created with excl_prog_hash) could be inserted into outer maps (map-of-maps) and mutated by unrelated programs, bypassing program compatibility checks.

In the Linux kernel, a use-after-free vulnerability in the bpffs filesystem has been fixed. A previous patch moved inode cleanup from free_inode() to destroy_inode(), removing the RCU delay and allowing access to freed memory during concurrent RCU pathwalk. The fix restores RCU-delayed freeing of the inode and the i_link buffer.

In the Linux kernel, configfs_lookup() has a bug that leaves a dangling ->s_dentry pointer when inode allocation fails. This leads to a use-after-free during subsequent getdents(2) operations in the directory.

In the Linux kernel, a vulnerability in the amdgpu driver causes a slab-out-of-bounds write during coredump generation after a GPU reset. The issue stems from a race condition between two loops processing GPU rings, where the ring count can change between counting and copying.

In the Linux kernel, the vhost subsystem's vhost_get_avail_idx returns an incorrect value, indicating all entries consumed instead of an index update. This can lead to host livelock when the guest is not making progress, as vhost immediately disables notifications and retries.

In the Linux kernel, the iommu/vt-d subsystem has a bug causing RB-tree corruption in the probe error path. If a device does not support ATS, the RB node remains zeroed, and on a subsequent probe failure, the removal misinterprets it as a tree root, corrupting the tree.

In the Linux kernel, a vulnerability in the zap_pages() function in BPF was fixed, which required holding mmap_lock. Previously, improper locking could lead to synchronization issues and potential use-after-free during memory map operations.

In the Linux kernel, a vulnerability in the OCFS2 filesystem was fixed where FITRIM accepted ranges shorter than the cluster size, leading to arithmetic underflow and potential trimming beyond the requested range. Now ranges shorter than the cluster size are rejected.

In the Linux kernel, a vulnerability in the netfilter cttimeout module was fixed by changing reference counting for timeout policies. Now the refcount is only used for conntrack entries, allowing immediate removal of policies from nfnetlink_cttimeout.

In the Linux kernel BPF mechanism, when freeing bpf_rb_root, the red-black tree node pointers are not cleared. If the object survives the free, it may contain stale pointers to the freed structure, which upon address reuse can lead to incorrect tree removal.

In the Linux kernel kernfs mechanism, there is a race in xattr operations when multiple superblocks with different namespaces share the same kernfs_node. xattr operations are not properly serialized, which can lead to a race in simple_xattr_set().

In the Linux kernel wifi driver wcn36xx, there is a heap overflow due to lack of validation of the HAL response length from firmware. A response larger than 4096 bytes can overflow the hal_buf buffer.

In the Linux kernel wifi driver wcn36xx, there is an out-of-bounds read caused by lack of validation of the firmware-controlled count field in the PRINT_REG_INFO message. An overly large count can lead to reading beyond the buffer.

In the Linux kernel BPF mechanism, there is a lack of rejection of BPF_LSM_CGROUP programs marked as sleepable during load. This can lead to calling sleeping functions in a context where it is not allowed, causing a kernel error.