CVE Vulnerability Catalog

In the Linux kernel, the nft_fib netfilter module has a NULL pointer dereference vulnerability when a fib expression is used in a netdev egress base chain. Validation incorrectly accepts the egress hook, leading to a system crash.

In the Linux kernel, the nf_conntrack_sip netfilter module lacks validation of skb_dst() before accessing it. When routing information is unavailable (e.g., in tc ingress or openvswitch), a crash may occur.

In the Linux kernel, the nft_set_pipapo netfilter module has a vulnerability that leaks a bad clone into a future transaction. Memory allocation failure can lead to out-of-bounds writes during subsequent operations.

In the Linux kernel, the nf_conntrack_reasm netfilter module has a vulnerability due to an incorrect mac_header adjustment after IPv6 defragmentation. This can lead to incorrect reporting of a MAC header presence.

In the Linux kernel, the netfilter nf_conncount module has a vulnerability in the tuple deduplication logic due to incorrect zone comparison. Passing the zone direction bitmask as the direction argument causes different zones to be treated as equal, leading to incorrect connection counting and bypass of connlimit limits.

In the Linux kernel GPU buddy subsystem, an alignment issue was found in the try_harder function. When a candidate was not aligned to min_block_size, the returned range could have an incorrect offset. The fix aligns candidates down to min_block_size instead of rejecting the request, ensuring correct operation.

In the Linux kernel SELinux module, connect-related permissions were not checked when using TCP Fast Open. The fix adds a call to selinux_socket_connect() in the socket_sendmsg() hook when MSG_FASTOPEN is used.

In the Linux kernel SELinux module, selinux_sctp_bind_connect() dereferenced sk->sk_socket, which could cause issues when the hook was invoked from the ASCONF softirq path. The fix refactors the code to use struct sock * directly and avoid sk_socket dereference.

In the Linux kernel batman-adv, a use-after-free issue was found due to potential buffer reallocation by pskb_may_pull() in batadv_interface_rx(). The fix reassigns the ethernet header pointer after reallocation.

In the Linux kernel's batman-adv module, after pskb_may_pull() is called by batadv_bla_is_backbone_gw(), the skb buffer may be reallocated. The gateway address pointer was not reassigned after this reallocation, potentially leading to a use-after-free.

In the Linux kernel's batman-adv module, the function batadv_interface_tx() assumes that at least ETH_HLEN bytes are available but does not check this itself. A local user with eBPF TC hook access can truncate the packet and redirect it to a batadv interface, potentially leading to an out-of-bounds read.

In the Linux kernel's batman-adv module, the function batadv_send_tt_request() checks for 'ret == true' instead of 'ret == false' after a failed send buffer allocation. This causes the TT request information not to be cleaned up, potentially leading to request storms.

In the Linux kernel's batman-adv module, when checking data availability for the num_dests field in struct batadv_tvlv_mcast_tracker, offsetof() is used instead of offsetofend(), which always returns 0. This causes the check to always pass, even when only 0 or 1 bytes are available, leading to an out-of-bounds read.

In the Linux kernel's jbd2 module, the function jbd2_journal_initialize_fast_commit() validates journal capacity, but due to an integer underflow on unsigned numbers, the check can be bypassed. This leads to corruption of j_last, j_fc_first, and j_free, resulting in journal abort.

In the Linux kernel's hugetlb module, there is a mismatch between rsvd charge and uncharge in hugetlb cgroup. A single h_cg pointer is overwritten, leading to the wrong cgroup being used during uncharge, causing a page_counter underflow.

In the Linux kernel, the NTFS filesystem centralized $INDEX_ROOT header validation. A dedicated helper was added for stricter validation of $INDEX_ROOT and is used for both directory inodes and named index inodes. This keeps root size and header geometry checks consistent across both read paths.

In the Linux kernel, an ABBA deadlock in the NTFS filesystem was fixed, occurring during writeback of MFT records. The issue appeared after a change in base record lookup and could cause system hangs during xfstests generic/113. The fix removes extent_lock and mrec_lock acquisition from the MFT folio writeback path, eliminating the lock ordering conflict.

In the Linux kernel, the NTFS filesystem avoids heap allocation for free-cluster readahead state. get_nr_free_clusters() allocated a temporary file_ra_state before publishing the free cluster count, and if allocation failed, the worker returned without setting the flag or waking waiters, potentially causing indefinite blocking. Now the state is kept on the stack and passed by address, eliminating the allocation failure path.

In the Linux kernel's NTFS filesystem, the attribute validator did not reject non-resident records for attributes that must be resident. This could lead to incorrect data reads and potential errors. The fix extends the existing check to all resident-only attribute types.

In the Linux kernel's NTFS3 filesystem, the DeleteIndexEntryAllocation function did not bound the memmove length, potentially leading to out-of-bounds access. The fix adds proper checks, including rejecting zero length.