CVE Vulnerability Catalog

In the Linux kernel, the RDMA/mlx5 driver has an undefined shift of user RQ WQE size. set_rq_size() computes the size as "1 << rq_wqe_shift" based on user-provided value, which is only checked to be greater than 32, so shifts of 32 are still accepted. A shift of 31 also overflows a signed integer, leading to undefined behavior. The fix uses check_shl_overflow() to compute the size and rejects invalid values.

In the Linux kernel, the RDMA/mlx5 driver has a bug where it frees the software-provided UAR index instead of the hardware-provided one. The fix is to free the UAR index returned by the hardware.

In the Linux kernel, the ASoC codec driver hdac_hdmi has a vulnerability due to lack of validation of the enum value before using it as an index into the texts array. hdac_hdmi_set_pin_port_mux() uses the enum value to index the array before calling snd_soc_dapm_put_enum_double(), which validates the range. An out-of-range value can cause an out-of-bounds read. The fix moves the lookup after the helper has accepted the value.

In the Linux kernel, the ASoC driver for Meson AIU has put callbacks for HDMI and internal codec muxes that use the written enum value before checking its validity. This can lead to improper behavior or potential errors.

In the Linux kernel, the ASoC driver for Freescale fsl_audmix has functions fsl_audmix_put_mix_clk_src() and fsl_audmix_put_out_src() that convert the user-provided enum value before checking if it is within range. This can lead to incorrect memory access or errors.

In the Linux kernel, the ASoC driver for Tegra210 AHUB has function tegra_ahub_put_value_enum() that reads e->values[item[0]] before checking if item[0] is within range. This allows an out-of-range read of the values array.

A use-after-free vulnerability was found in the Linux kernel's fib_leaf_notify() function for IPv4. During dumping of fib_info under RCU, functions like nsim_fib4_prepare_event() call fib_info_hold() without checking if the object still exists, leading to use-after-free. The issue was reported by syzbot.

In the Linux kernel, fib_rules_dump() calls fib_rule_get() during RCU dump, which can cause refcount issues if the rule is dying. The fix uses refcount_inc_not_zero().

In the Linux kernel, netif_rxq_cleanup_unlease() has reversed order: DMA mappings are revoked before stopping the queue. This can allow the device to DMA to a stale address. The fix swaps the calls.

In the Linux kernel, TIPCv2 mutating netlink operations lacked admin permission checks, allowing unprivileged local processes to change TIPC state. The fix adds CAP_NET_ADMIN requirement.

In the Linux kernel TIPC subsystem, the CONN_ACK handler did not validate the ack count, allowing an oversized ack to underflow snt_unacked and permanently stall the connection's send side.

In the Linux kernel TIPC subsystem, peer-advertised service ranges were not validated for lower <= upper, allowing inverted ranges to leak memory in the binding table.

In the Linux kernel IOMMU DMA subsystem, the P2PDMA path incorrectly assigned the DMA length from the head segment instead of the current segment, corrupting lengths for multi-segment scatterlists.

In the Linux kernel CXL region subsystem, cxl_cancel_auto_attach() used cxled->pos as an index into p->targets[], but it could be a negative errno, causing out-of-bounds access.

In the Linux kernel, the handshake subsystem now requires admin permission for the DONE command. Previously, DONE had no privilege check, allowing an unprivileged process to send a forged DONE with status 0, causing the kernel to treat the handshake as successful, or with a non-zero status, tearing down a legitimate in-flight handshake.

A vulnerability in the Linux kernel's network watchdog code (net/sched/sch_generic.c) involves races in reference tracking. Lack of synchronization between netdev_watchdog_up() and dev_watchdog() can lead to list corruption and system crash.

In the Linux kernel, the KCM module's kcm_attach() and kcm_unattach() functions replace callback pointers (sk_data_ready, sk_write_space) on a live TCP socket without using WRITE_ONCE(). This can lead to inconsistent observations of these fields on other CPUs and incorrect callback invocations.

In the Linux kernel, the netfilter nf_dup_netdev module's nft_dup and nft_fwd functions have been updated to use the nf_dev_xmit_recursion() helpers. Additionally, bottom halves (BH) are disabled during skb transmission to prevent migration to a different CPU and imbalanced decrementation of recursion counters.

In the Linux kernel, the BPF mechanism for uprobe_multi data lacked an access_ok check before using __get_user, potentially allowing unauthorized access to user memory. The fix adds proper bounds checking.

A use-after-free vulnerability was found in the Linux kernel's udp_bpf_recvmsg() function for sockmap. The issue stems from missing serialization of access to the sk_msg structure, which can lead to use of freed memory during concurrent reads. The fix restores lock_sock() in this function.