CVE Vulnerability Catalog

In the Linux kernel capable_wrt_mount() function, a vulnerability exists due to not rejecting detached mounts. If a mount is detached between checks, the function may dereference NULL, leading to kernel panic.

In the Linux kernel, the iosm driver for WWAN modems has a vulnerability due to missing validation of modem-supplied offsets and lengths in the MUX downlink decoder. A malicious modem can cause out-of-bounds reads and infinite loops in the decoder, leading to system crashes or memory disclosure.

In the Linux kernel's memory compaction module (mm/compaction), the compaction_free() function does not properly handle the failure case of free_pages_prepare(). Failed pages should not be added back to cc->freepages for future use, as they can be either PageHWPoison or free_page_is_bad() and might cause data corruption.

In the Linux kernel, in the mac802154 subsystem, interface removal does not use RCU, which can lead to use-after-free during asynchronous transmit completion. The fix changes list_del() to list_del_rcu() to ensure safe removal in RCU context.

In the Linux kernel, in the IPVS subsystem, the set_sctp_state() function incorrectly calculates the offset for IPv6 SCTP packets with extension headers, leading to incorrect state machine behavior. The fix uses the parsed transport offset passed from ip_vs_set_state() to correctly read the SCTP header.

In the Linux kernel, in the macsec_encrypt() function, an unset MAC header is read, leading to an out-of-bounds read (12-byte over-read) and data leak to the wire. The fix uses skb_eth_hdr() instead of eth_hdr() to correctly obtain the L2 header.

In the Linux kernel, in the dibs loopback driver, the move_data() function does not validate that offset and size do not exceed the DMB length, which can lead to out-of-bounds write. The fix adds an explicit bounds check before memcpy, returning -EINVAL for invalid requests.

In the Linux kernel's tracing/osnoise module, there is a missing synchronize_rcu() call during unregistering. This can lead to use-after-free when RCU readers are still traversing the instance list.

In the Linux kernel's pmdomain module for i.MX93, there is an issue with shared control bits for clock and reset between DSI and CSI domains. This can lead to incorrect behavior if one domain disables shared resources while the other is still active.

In the rt2x00 driver in the Linux kernel, rt2x00lib_probe_dev() uses the full teardown path for all probe failures, even when work structures are not yet initialized. This can lead to invalid work drains and DEBUG_OBJECTS reports.

In the brcmfmac driver in the Linux kernel, there is a heap overflow when processing short authentication frames. The frame length can be less than the management header, causing arithmetic wrap and copying a huge amount of data beyond the buffer.

In the Linux kernel's Bluetooth btrtl driver, there is a vulnerability due to improper bounds checking of firmware patches. A too-short patch can cause arithmetic underflow and lead to oversized read/write during Bluetooth setup.

In the Linux kernel's powerpc/spufs driver, there is an out-of-bounds access in spufs_mem_mmap_access(). The offset is checked against vm_end instead of the local store size, allowing access beyond the buffer.

In the Linux kernel, the mask_user_address() function incorrectly checks for CONFIG_E500 instead of CONFIG_PPC_E500, preventing mask_user_address_isel() from being used on E500 hardware. The fix corrects the check to use the proper name.

In the Linux kernel's cfg80211 subsystem, a vulnerability exists due to missing validation of the EHT MLE type and size before reading the MLD ID. A malicious access point can send a short EHT MLE in an MBSSID beacon, leading to an out-of-bounds read by ieee80211_mle_get_mld_id(). The fix adds validation before the read.

In the Linux kernel, the ieee80211_mle_common_size() function has an issue with validating the common info length in MLE elements. For Reconfiguration and Priority Access types, the length is not correctly checked, potentially leading to improper reads. The fix accounts for the Reconfiguration length and validates the length for all known MLE types.

In the Linux kernel's mac80211 subsystem, a vulnerability exists due to missing validation of extension frame layout before processing. Unsupported extension subtypes can reach code that reads regular headers, potentially leading to improper reads. The fix adds validation and appropriate processing paths for S1G beacon frames.

In the Linux kernel's mchp23k256 driver for MTD, there is an issue with selecting chip capacity data: the driver uses of_device_get_match_data(), which when matched via SPI id table leads to using default data instead of the correct one. The fix changes to spi_get_device_match_data() to use SPI table data when OF data is absent.

In the Linux kernel's NAND driver lpc32xx_slc, there is an issue with DMA timeout handling: lpc32xx_xmit_dma() ignores the result of wait_for_completion_timeout(), causing a timed-out DMA transfer to be reported as successful. The fix returns -ETIMEDOUT and terminates the DMA channel before unmapping the scatterlist.

In the Linux kernel BPF subsystem, the verifier rejects variable offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. The issue arises because constant offsets were moved to reg->var_off, while __check_buffer_access() only checks the instruction offset. For writable raw tracepoints, an access with a negative offset can wrap the calculated end, allowing a program to bypass validation.