CVE Vulnerability Catalog

In the Linux kernel's batman-adv module, the function batadv_interface_tx() assumes that at least ETH_HLEN bytes are available but does not check this itself. A local user with eBPF TC hook access can truncate the packet and redirect it to a batadv interface, potentially leading to an out-of-bounds read.

In the Linux kernel's batman-adv module, the function batadv_send_tt_request() checks for 'ret == true' instead of 'ret == false' after a failed send buffer allocation. This causes the TT request information not to be cleaned up, potentially leading to request storms.

In the Linux kernel's batman-adv module, when checking data availability for the num_dests field in struct batadv_tvlv_mcast_tracker, offsetof() is used instead of offsetofend(), which always returns 0. This causes the check to always pass, even when only 0 or 1 bytes are available, leading to an out-of-bounds read.

In the Linux kernel's jbd2 module, the function jbd2_journal_initialize_fast_commit() validates journal capacity, but due to an integer underflow on unsigned numbers, the check can be bypassed. This leads to corruption of j_last, j_fc_first, and j_free, resulting in journal abort.

In the Linux kernel's hugetlb module, there is a mismatch between rsvd charge and uncharge in hugetlb cgroup. A single h_cg pointer is overwritten, leading to the wrong cgroup being used during uncharge, causing a page_counter underflow.

In the Linux kernel, the NTFS filesystem centralized $INDEX_ROOT header validation. A dedicated helper was added for stricter validation of $INDEX_ROOT and is used for both directory inodes and named index inodes. This keeps root size and header geometry checks consistent across both read paths.

In the Linux kernel, an ABBA deadlock in the NTFS filesystem was fixed, occurring during writeback of MFT records. The issue appeared after a change in base record lookup and could cause system hangs during xfstests generic/113. The fix removes extent_lock and mrec_lock acquisition from the MFT folio writeback path, eliminating the lock ordering conflict.

In the Linux kernel, the NTFS filesystem avoids heap allocation for free-cluster readahead state. get_nr_free_clusters() allocated a temporary file_ra_state before publishing the free cluster count, and if allocation failed, the worker returned without setting the flag or waking waiters, potentially causing indefinite blocking. Now the state is kept on the stack and passed by address, eliminating the allocation failure path.

In the Linux kernel's NTFS filesystem, the attribute validator did not reject non-resident records for attributes that must be resident. This could lead to incorrect data reads and potential errors. The fix extends the existing check to all resident-only attribute types.

In the Linux kernel's NTFS3 filesystem, the DeleteIndexEntryAllocation function did not bound the memmove length, potentially leading to out-of-bounds access. The fix adds proper checks, including rejecting zero length.

In the Linux kernel's NTFS3 filesystem (fs/ntfs3), during log replay (log_replay) in the analysis pass, the copy_lcns function did not verify that write indices into the page_lcns[] array stay within bounds. A specially crafted log record (LRH) could cause an out-of-bounds write (slab-out-of-bounds), leading to memory corruption.

In the Linux kernel's NTFS3 filesystem, the UpdateResidentValue function did not validate the attribute offset, potentially leading to data size underflow and out-of-bounds read. The fix adds validation at the source.

A vulnerability in the Linux kernel's Landlock mechanism allows bypassing the LANDLOCK_SCOPE_SIGNAL restriction via the asynchronous SIGIO delivery path. A sandboxed process can send a signal (e.g., SIGKILL) to an entire process group, including processes outside its domain that were meant to be protected. The issue stems from incorrect domain recording for process-group targets.

In the Linux kernel for MIPS architecture, there is a critical memory management flaw in the scheduler. When CONFIG_CPUMASK_OFFSTACK is enabled, cpumask_var_t is a pointer, so sizeof(new_mask) evaluates to pointer size, causing copy_from_user() to clobber the mask pointer. Additionally, copying occurs before mask allocation. The fix allocates the mask first and uses cpumask_size() to handle variable-sized masks.

A vulnerability was found in the Linux kernel in the make_uffd_wp_huge_pte() function in fs/proc/task_mmu. The function did not use huge_ptep_modify_prot_start() before modifying a HugeTLB PTE, causing a race condition and loss of hardware Dirty/Accessed bit updates. The fix adds the missing call to ensure PTE consistency.

In the Linux kernel, a bug was found in mm/mm_init regarding uninitialized struct pages for ZONE_DEVICE. When DAX memory is hotplugged into an unoccupied subsection of an early section, section_activate() reuses the unoptimized boot memmap, but compound_nr_pages() still assumes optimization and initializes only a reduced number of pages. The remaining pages are left uninitialized, which can lead to unexpected behavior or crashes.

In the Linux kernel, a bug was found in the mtd: slram module in the register_device() function, where an entry is linked to the global list before all required state is allocated. If a later allocation, memremap(), or mtd_device_register() fails, the partially initialized entry remains on the list, which can lead to dereference or free of invalid state during later cleanup.

In the Linux kernel, a bug was found in the 9p module in the v9fs_dec_count() function, which unconditionally calls drop_nlink() on regular files even when nlink is already zero. In cacheless mode, the client refetches metadata from the server, leading to a race and WARN_ON warning. The fix skips nlink update in cacheless mode.

In the Linux kernel, the rawnand driver has a bug in the condition in the 'nand_select_target()' function. The condition does not correctly check the range of the 'cs' value, which should be in [0:nanddev_ntargets[.

In the Linux kernel, the OCFS2 filesystem has a bug in ocfs2_move_extent that can cause moving data to occupied clusters. During block group scanning, if no free run is found, phys_cpos remains unchanged, potentially leading to overwriting data belonging to another inode.