CVE Vulnerability Catalog

In the Linux kernel, the OCFS2 filesystem has a bug in ocfs2_sum_rightmost_rec that can lead to an array-index-out-of-bounds (UBSAN) when on-disk data is corrupted. The function does not validate l_next_free_rec before using it to index the l_recs array.

In the Linux kernel, a vulnerability in the OCFS2 filesystem allows acceptance of invalid i_mode values in dinodes. Lack of POSIX file type validation can lead to processing of forged metadata, resulting in incorrect system behavior. The patch adds structural checks rejecting dinodes with non-canonical i_mode types.

In the Linux kernel, the thunderbolt network driver (tbnet) lacks a bound on frame_count to the maximum number of skb fragments, leading to out-of-bounds write past frags[] and memory corruption. A malicious peer can send a packet with many small frames to trigger the overflow.

In the Linux kernel for the OpenRISC architecture, there is a jump_label SMP syncing issue. Incorrect icache invalidation on remote cores can cause static keys to remain stale after updates.

In the Linux kernel, the TPM driver (tpm2-sessions) function tpm_buf_append_salt() calls asynchronous KPP operations without setting a completion callback and immediately frees the request, leading to use-after-free. The issue occurs automatically during entropy polling.

In the Linux kernel, the Tegra DMA driver (dmaengine) incorrectly calculates burst size, which can cause DMA transfers to hang when the transfer length is not a multiple of the max burst size. The fix reduces burst size to the largest power-of-2 that evenly divides the transfer length.

In the Linux kernel dw-edma driver, the DONE_INT_MASK and ABORT_INT_MASK registers are shared by all DMA channels, and modifying them requires a non-atomic read-modify-write sequence. This can lead to race conditions when two channels call dw_edma_v0_core_start() concurrently. A spinlock has been added to serialize access to these registers.

In the Linux kernel rz-dmac driver, the interrupt is requested before full initialization, which can lead to invalid memory access because the interrupt handler may access uninitialized data. The fix moves interrupt requests after setup is complete and uses dmam_alloc_coherent().

In the Linux kernel dell-laptop driver, dell_init() does not clean up all resources if LED or backlight registration fails. The fix adds missing cleanup calls before returning an error.

In the Linux kernel ISST driver, after resume, SST-PP control is only restored to power domain 0, even though values are stored for all domains. The fix uses pd_info->sst_base instead of power_domain_info->sst_base.

In the Linux kernel i2c-imx driver, the interrupt-driven path rejects an SMBus block read with a byte count of 0 as -EPROTO, but does not send NACK+STOP, causing the I2C bus to lock up. The fix accepts count=0 and sends NACK and STOP.

In the Linux kernel, the xfrm_interface module lacks a CAP_NET_ADMIN requirement in the interface's network namespace during changelink operations. A caller privileged only in one namespace can modify an interface in another namespace, breaking isolation.

A vulnerability was discovered in the Linux kernel TPM character device drivers. Due to FMODE_PREAD and FMODE_PWRITE flags being left enabled, positional read/write operations (pread/pwrite) could lead to out-of-bounds heap reads and out-of-bounds zero writes. The issue is fixed by calling nonseekable_open(), which causes positional operations to fail with -ESPIPE.

A vulnerability in the Linux kernel's SPI driver for i.MX devices (spi-imx) was found. When DMA is selected but the DMA descriptor cannot be prepared, the driver falls back to PIO without undoing DMA configuration, leading to corrupted data transfers. This affects e.g. i.MX8MP boards with Infineon SLB9670 TPM, where data is shifted and the device fails.

In the Linux kernel, the spi-uniphier driver has an initialization order issue: devm_request_irq() is called before initializing the completion used by the interrupt handler. This can lead to calling complete() on an uninitialized completion, causing undefined behavior (observed with KASAN).

In the Linux kernel, the CAN ISO-TP module has an RCU synchronization issue in isotp_release(). When NETDEV_UNREGISTER runs first, the function skips synchronization, potentially cancelling a timer while isotp_rcv() is still executing and about to re-arm it, leading to a use-after-free. The fix makes isotp_release() always call synchronize_rcu() before cancelling timers.

A use-after-free vulnerability was found in the Linux kernel's CAN ISO-TP module (can/isotp). The issue occurs during concurrent network device unregistration (NETDEV_UNREGISTER) and socket release (isotp_release), potentially leading to use of freed memory.

In the Linux kernel, a vulnerability in the CAN ISO-TP subsystem was fixed regarding unsynchronized TX state machine transitions. Different contexts (sendmsg, RX path, timers) could act on stale state, corrupting unrelated transfers. The fix serializes the full TX claim lifecycle under so->rx_lock.

A use-after-free (UAF) vulnerability was found in the Linux kernel's CAN BCM (Broadcast Manager) module, specifically in the hrtimer. The issue stems from a missing RX_NO_AUTOTIMER flag check in the packet RX fast-path, allowing the timer to be re-armed after call_rcu() has scheduled memory deallocation. The fix defers timer cancellation and memory freeing to a dedicated workqueue and holds a socket reference until the deferred work completes.

In the Linux kernel, the CAN BCM module has a race condition between lockless reads of bo->ifindex and bo->bound and their locked modifications. This can cause a socket bound to a specific CAN interface to also match 'any' interface. Additionally, bcm_rx_setup() may silently return success when the device disappears concurrently instead of reporting -ENODEV.