CVE Vulnerability Catalog

In the Linux kernel accel/amdxdna driver, amdxdna_drm_sync_bo_ioctl() for SYNC_DIRECT_FROM_DEVICE passes the BO's client pointer to amdxdna_hwctx_sync_debug_bo() instead of the ioctl file's client. This causes the wrong client to be used as the handle namespace and hardware context owner, potentially leading to synchronization errors. The fix passes filp->driver_priv instead.

In the Linux kernel accel/ivpu driver, fw_log_from_bo() does not check that the log size is at least the header size. When the log is smaller, fw_log_print_buffer() computes data_size with an underflow, leading to reads far past the small real data region of the BO. A size of 0 also causes infinite looping. The fix rejects logs whose size is smaller than the header.

In the Linux kernel, a use-after-free vulnerability was found in the resctrl subsystem during unmount. A concurrent reader of a monitoring event file may access already freed memory because the RDT_DELETED flag is not set for the default resource group. The fix sets this flag unconditionally and prevents remounting when there are pending readers.

In the mlx5e driver for Mellanox network cards, a use-after-free vulnerability was found in MACsec handling. Deleting an RX SC freed the metadata_dst object without respecting the reference count, which could lead to use of freed memory by a concurrent packet receive process. Additionally, publishing an element in the xarray before metadata_dst initialization could expose incomplete data.

A use-after-free vulnerability was found in the Linux kernel's user_event_mm_dup() function related to the user_events mechanism. The issue occurs during fork() when the enabler list is traversed without locking while another thread removes an enabler, leading to use of freed memory. An unprivileged attacker can trigger this bug, resulting in a system crash or potential privilege escalation.

In the Linux kernel, the CPU hotplug mechanism has a bug in cpuhp_invoke_callback() that hides the original error during rollback of earlier callbacks. The ret variable is reused to store the rollback result, which can mask the original error.

In the Linux kernel, the CPU hotplug mechanism has a buffer overflow vulnerability in states_show(). The function writes hotplug state names to a sysfs buffer using sprintf(), which can write past the end of the PAGE_SIZE buffer when many states are registered.

In the Linux kernel, the SIT driver's ipip6_changelink() did not check CAP_NET_ADMIN in the tunnel's network namespace. A caller privileged in the device's netns but not in the tunnel's netns could modify the tunnel. Added rtnl_dev_link_net_capable() check at the beginning.

In the Linux kernel, the act_ct module's tcf_ct_handle_fragments() does not save and restore skb->cb during defragmentation. This causes loss of qdisc metadata like pkt_segs and can trigger WARN_ON_ONCE(). Added save and restore of tc_skb_cb.

In the Linux kernel, the IP6VTI driver's vti6_changelink() did not check CAP_NET_ADMIN in the tunnel's network namespace. A caller privileged in the device's netns but not in the tunnel's netns could modify the tunnel. Added rtnl_dev_link_net_capable() check at the beginning.

In the Linux kernel, the IPVTI driver's vti_changelink() did not check CAP_NET_ADMIN in the tunnel's network namespace. A caller privileged in the device's netns but not in the tunnel's netns could modify the tunnel. Added rtnl_dev_link_net_capable() check at the beginning.

In the Linux kernel, the IPIP driver's ipip_changelink() did not check CAP_NET_ADMIN in the tunnel's network namespace. A caller privileged in the device's netns but not in the tunnel's netns could modify the tunnel. Added rtnl_dev_link_net_capable() check at the beginning.

In the Linux kernel, the ip6_gre driver has a vulnerability where CAP_NET_ADMIN is not required in the tunnel's network namespace during changelink operations. A caller privileged in the device's namespace but not in the tunnel's namespace can modify a tunnel residing in another namespace.

In the Linux kernel, the ip6_tunnel driver has a vulnerability where CAP_NET_ADMIN is not required in the tunnel's network namespace during changelink operations. A caller privileged in the device's namespace but not in the tunnel's namespace can modify a tunnel residing in another namespace.

A vulnerability was found in the Linux kernel's legacy netlink interface for IEEE 802.15.4. The LLSEC dump operations in the IEEE802154_NL family lacked the required administrative permission flag, allowing any local user to read raw 16-byte AES-128 keys from the kernel key table. The issue affects only the legacy API, while the modern nl802154 family is properly secured.

In the Linux kernel, the octeontx2-af (cn10k) driver has a vulnerability due to lack of validation of the base_pcifunc field in rvu_mbox_handler_lmtst_tbl_setup(). This allows a VF function to read the physical LMTLINE address of another function if base_pcifunc points outside its own PF space. The fix rejects the request with -EPERM when base_pcifunc is not a valid function under its own PF.

In the Linux kernel on LoongArch architecture, a vulnerability was found related to missing dirty page tracking in pte_wrprotect() and pmd_wrprotect(). When hardware page table walker (PTW) is enabled, it may set _PAGE_DIRTY without setting _PAGE_MODIFIED, leading to loss of dirty information during copy-on-write (fork). As a result, a page may be considered clean and freed without writeback, causing data corruption.

In the Linux kernel IPMI subsystem, a vulnerability exists where the user refcount is underflowed during event delivery. On delivery failure, the rollback path decrements the refcount excessively, potentially leading to use-after-free or a refcount_t warning.

In the Linux kernel network scheduler sch_multiq, a vulnerability exists due to direct dequeue call instead of using peek and qdisc_dequeue_peeked. When the child is non-work-conserving, direct dequeue can lead to qlen/backlog desync and potential kernel panic.

In the Linux kernel network scheduler sch_taprio, a vulnerability exists due to direct dequeue call instead of using peek and qdisc_dequeue_peeked. When the child is non-work-conserving, direct dequeue can lead to qlen/backlog desync and potential kernel panic.