CVE Vulnerability Catalog

In the Linux kernel's NTFS3 filesystem (fs/ntfs3), during log replay (log_replay) in the analysis pass, the copy_lcns function did not verify that write indices into the page_lcns[] array stay within bounds. A specially crafted log record (LRH) could cause an out-of-bounds write (slab-out-of-bounds), leading to memory corruption.

In the Linux kernel's NTFS3 filesystem, the UpdateResidentValue function did not validate the attribute offset, potentially leading to data size underflow and out-of-bounds read. The fix adds validation at the source.

A vulnerability in the Linux kernel's Landlock mechanism allows bypassing the LANDLOCK_SCOPE_SIGNAL restriction via the asynchronous SIGIO delivery path. A sandboxed process can send a signal (e.g., SIGKILL) to an entire process group, including processes outside its domain that were meant to be protected. The issue stems from incorrect domain recording for process-group targets.

In the Linux kernel for MIPS architecture, there is a critical memory management flaw in the scheduler. When CONFIG_CPUMASK_OFFSTACK is enabled, cpumask_var_t is a pointer, so sizeof(new_mask) evaluates to pointer size, causing copy_from_user() to clobber the mask pointer. Additionally, copying occurs before mask allocation. The fix allocates the mask first and uses cpumask_size() to handle variable-sized masks.

A vulnerability was found in the Linux kernel in the make_uffd_wp_huge_pte() function in fs/proc/task_mmu. The function did not use huge_ptep_modify_prot_start() before modifying a HugeTLB PTE, causing a race condition and loss of hardware Dirty/Accessed bit updates. The fix adds the missing call to ensure PTE consistency.

In the Linux kernel, a bug was found in mm/mm_init regarding uninitialized struct pages for ZONE_DEVICE. When DAX memory is hotplugged into an unoccupied subsection of an early section, section_activate() reuses the unoptimized boot memmap, but compound_nr_pages() still assumes optimization and initializes only a reduced number of pages. The remaining pages are left uninitialized, which can lead to unexpected behavior or crashes.

In the Linux kernel, a bug was found in the mtd: slram module in the register_device() function, where an entry is linked to the global list before all required state is allocated. If a later allocation, memremap(), or mtd_device_register() fails, the partially initialized entry remains on the list, which can lead to dereference or free of invalid state during later cleanup.

In the Linux kernel, a bug was found in the 9p module in the v9fs_dec_count() function, which unconditionally calls drop_nlink() on regular files even when nlink is already zero. In cacheless mode, the client refetches metadata from the server, leading to a race and WARN_ON warning. The fix skips nlink update in cacheless mode.

In the Linux kernel, the rawnand driver has a bug in the condition in the 'nand_select_target()' function. The condition does not correctly check the range of the 'cs' value, which should be in [0:nanddev_ntargets[.

In the Linux kernel, the OCFS2 filesystem has a bug in ocfs2_move_extent that can cause moving data to occupied clusters. During block group scanning, if no free run is found, phys_cpos remains unchanged, potentially leading to overwriting data belonging to another inode.

In the Linux kernel, the OCFS2 filesystem has a bug in ocfs2_sum_rightmost_rec that can lead to an array-index-out-of-bounds (UBSAN) when on-disk data is corrupted. The function does not validate l_next_free_rec before using it to index the l_recs array.

In the Linux kernel, a vulnerability in the OCFS2 filesystem allows acceptance of invalid i_mode values in dinodes. Lack of POSIX file type validation can lead to processing of forged metadata, resulting in incorrect system behavior. The patch adds structural checks rejecting dinodes with non-canonical i_mode types.

In the Linux kernel, the thunderbolt network driver (tbnet) lacks a bound on frame_count to the maximum number of skb fragments, leading to out-of-bounds write past frags[] and memory corruption. A malicious peer can send a packet with many small frames to trigger the overflow.

In the Linux kernel for the OpenRISC architecture, there is a jump_label SMP syncing issue. Incorrect icache invalidation on remote cores can cause static keys to remain stale after updates.

In the Linux kernel, the TPM driver (tpm2-sessions) function tpm_buf_append_salt() calls asynchronous KPP operations without setting a completion callback and immediately frees the request, leading to use-after-free. The issue occurs automatically during entropy polling.

In the Linux kernel, the Tegra DMA driver (dmaengine) incorrectly calculates burst size, which can cause DMA transfers to hang when the transfer length is not a multiple of the max burst size. The fix reduces burst size to the largest power-of-2 that evenly divides the transfer length.

In the Linux kernel dw-edma driver, the DONE_INT_MASK and ABORT_INT_MASK registers are shared by all DMA channels, and modifying them requires a non-atomic read-modify-write sequence. This can lead to race conditions when two channels call dw_edma_v0_core_start() concurrently. A spinlock has been added to serialize access to these registers.

In the Linux kernel rz-dmac driver, the interrupt is requested before full initialization, which can lead to invalid memory access because the interrupt handler may access uninitialized data. The fix moves interrupt requests after setup is complete and uses dmam_alloc_coherent().

In the Linux kernel dell-laptop driver, dell_init() does not clean up all resources if LED or backlight registration fails. The fix adds missing cleanup calls before returning an error.

In the Linux kernel ISST driver, after resume, SST-PP control is only restored to power domain 0, even though values are stored for all domains. The fix uses pd_info->sst_base instead of power_domain_info->sst_base.