CVE Vulnerability Catalog

In the Linux kernel, the NTFS3 filesystem has a vulnerability involving the use of an uninitialized variable lcn. When the sought VCN is not found in runs[0], run_lookup() returns false, leading to premature exit from attr_data_get_block_locked() without initializing lcn, triggering a KMSAN bug. The fix moves the clen check before the lcn check in ni_seek_data_or_hole().

In the Linux kernel's NTFS3 filesystem (fs/ntfs3), there is a buffer overflow vulnerability. During mounting of a dirty NTFS volume, log_replay() allocates one_page_buf using the host page size, then may adopt a larger on-disk page size from the restart area. If the on-disk page size is larger than the initial allocation, the buffer remains undersized, and a subsequent read of log->page_size bytes into it causes an overflow.

In the Linux kernel's xprtrdma subsystem, a vulnerability was found due to a kref imbalance when handling the ADDR_CHANGE event. If this event arrives before ESTABLISHED, an ep_put is called without a matching ep_get, leading to a kref underflow and use-after-free during disconnect.

In the Linux kernel's xprtrdma subsystem, a vulnerability exists where the reply credit grant is not sanitized before use. A malicious peer can send a reply with an unknown XID and an inflated credit, causing excessive allocation and posting of Receive WRs, exceeding the re_max_requests limit.

In the Linux kernel's xprtrdma subsystem, a vulnerability allows a remote peer to drain the client's posted Receive queue by sending a sustained stream of malformed replies (too short or with an unrecognized RPC/RDMA version). Each such reply consumes a posted Receive without replacing it, eventually stalling the transport until reconnect.

In the Linux kernel's AppArmor module, a race condition exists in Unix socket mediation when peer_path is used. Accessing the path outside the state lock allows a race with unix_release_sock(), potentially leading to use-after-free.

In the Linux kernel's AppArmor module, a refcount leak exists when updating sk_ctx. update_sk_ctx() transfers the plabel reference, but the caller unconditionally puts it, leading to a refcount imbalance.

In the Linux kernel's AppArmor module, a vulnerability exists where the label build is checked before the no_new_privs test. aa_change_profile() builds a replacement label that can return NULL or ERR_PTR, but the result is passed to aa_label_is_unconfined_subset() before the IS_ERR_OR_NULL() check, potentially dereferencing an invalid label.

In the Linux kernel's AppArmor module, a resource leak exists in aa_label_alloc(). The function allocates a secid before allocating or taking the label proxy. If the later proxy step fails, the error path only frees the label memory, leaking resources initialized by aa_label_init().

In the Linux kernel, the AppArmor module has a bug where an uninitialized pointer is passed to audit_log_untrustedstring(). The bug was introduced by commit 4a134723f9f1 and can lead to a page fault during file operations when the path is replaced by aa_null.dentry. The issue was observed on kernel 7.0.2 openSUSE Tumbleweed.

In the Linux kernel, the MIPI I3C HCI driver has a race in i3c_hci_addr_to_dev() that traverses the I3C device list without proper locking. The fix introduces a dedicated lookup table and synchronization via hci->lock.

In the Linux kernel's i915 (drm) driver, intel_crtc_put_color_blobs() releases CRTC color blob references but does not clear the pointers. This can lead to double-free when the CRTC state is cleaned up again.

In the Linux kernel's xfrm module, xfrm_selector_match() can perform a shift-out-of-bounds for an AF_UNSPEC selector with a large prefixlen. The fix adds validation of families and prefix lengths.

In the Linux kernel's amdkfd (drm) driver, kfd_criu_resume_svm() does not remove elements from the list before freeing memory, leading to use-after-free and double-free. The fix adds list_del() before kfree().

In the Linux kernel, the ALSA USB-audio driver for Qualcomm platforms has a vulnerability due to missing validation of the interface index in the stream disable path. A disable request with an invalid interface can lead to NULL pointer dereference or out-of-bounds memory access, potentially causing a system crash or memory corruption.

A vulnerability in the Linux kernel's flow_dissector mechanism unconditionally reads Ethernet addresses (ETH_ADDRS) from the packet header, even when the device has no link-layer header (e.g., TUN in L3 mode). This leads to reading uninitialized skb memory, which can be used as a key in a rhashtable, potentially causing unpredictable TC filter matching. The fix adds checks for device type (ARPHRD_ETHER) and whether the MAC header is set.

In the Linux kernel, the md/raid1 module has a vulnerability involving writes_pending and barrier reference leaks on write failures. Some error paths in raid1_write_request() complete the bio without calling md_write_end(), leading to unbalanced counters.

In the Linux kernel, the md/raid10 module has a vulnerability involving writes_pending and barrier reference leaks on discard failures. Some error paths in raid10_handle_discard() complete the bio without calling md_write_end() or allow_barrier(), leading to unbalanced counters.

In the Linux kernel, in the netfilter/ipset module, kfree_rcu() was called before rcu_assign_pointer() when handling the comment extension, which is incorrect order. The order was fixed so that rcu_assign_pointer() is called first.

In the Linux kernel, in the netfilter/ipset module, when destroying a set, cancel_delayed_work_sync() was called while gc unconditionally calls queue_delayed_work(), which can prevent proper shutdown of gc. This was fixed.