CVE Vulnerability Catalog

In the Linux kernel, a reference leak was detected in the pcs_add_gpio_func() function in the pinctrl-single driver. The of_parse_phandle_with_args() function increments the reference count for the gpiospec.np node, but the loop iterating through all handles never releases these references, leading to a memory leak. The issue was detected by a static analysis tool and confirmed during code review.

In the Linux kernel, the MCTP I2C driver did not initialize the event handler read buffer, causing uninitialized stack data to be returned. For i2c-aspeed and i2c-npcm7xx drivers this led to leakage of uninitialized values.

In the Linux kernel's NTFS3 filesystem, an infinite loop vulnerability was found when processing the range [valid : pos). If the valid value cannot be read correctly and remains the same, a process hang may occur, as reported by syzbot. A check was added to detect unchanged valid values and return -EINVAL.

A memory leak was found in the Linux kernel in the dw_i3c_master_i2c_xfers() function of the i3c dw driver. When pm_runtime_resume_and_get() fails, the allocated xfer structure is not freed, causing a memory leak.

In the Linux kernel, a vulnerability in the ext4 filesystem was found related to incorrect zeroing of allocation ranges when splitting a large unwritten extent. Under certain conditions, when the extent splitting operation fails due to lack of space, stale data may remain in the written range, compromising data integrity.

In the Linux kernel, a vulnerability was found in the csiostor driver where a null pointer rn is dereferenced in the error exit path via the CSIO_INC_STATS macro. The fix adds a new error return label after the macro usage.

In the Linux kernel, a vulnerability in the ATA subsystem (libata-scsi) can cause non-NCQ command starvation. When a device is under constant NCQ command load, non-NCQ commands may be repeatedly deferred, potentially preventing their execution entirely.

In the Linux kernel's inside-secure/eip93 crypto driver, a vulnerability exists where all cryptographic algorithms are unregistered regardless of which are actually implemented in hardware. This causes a system panic on platforms that do not have all options implemented in silicon.

In the Linux kernel, a vulnerability was found in the IPVS module where protocol checksum validation fails for IPv6 if there are extension headers before the protocol header. The issue is fixed by using the iph->len field, which contains the appropriate offset.

In the Linux kernel, the mscc ocelot network driver lacks lock protection in ocelot_port_xmit_inj(). The function calls ocelot_can_inject() and ocelot_port_inject_frame() without holding the injection group lock, potentially causing races. The fix adds ocelot_lock_inj_grp()/ocelot_unlock_inj_grp() around the register injection path.

In the Linux kernel, a vulnerability was found in the AppArmor module where the aa_sock_file_perm function does not check for NULL pointers for sock and sock->sk. This can lead to a NULL pointer dereference (oops) during socket setup or teardown, especially for af_unix sockets.

In the Linux kernel, the WARN_ON_ONCE warning when accessing the forward path array has been removed. Support for IPIP tunnels increased the likelihood of hitting this warning if userspace builds a sufficiently long forward path.

A vulnerability in the public_key module (pubkey_cert) of Erlang OTP allows a non-CA certificate (basicConstraints cA:false) to be accepted as an intermediate issuer in a certificate chain. Two flaws in pubkey_cert:validate_extensions/7 cause a missing keyUsage extension to completely bypass the keyCertSign requirement, enabling certificate chain forgery.

IBM Cloud APM w wersji Base Private 8.1.4 oraz Advanced Private 8.1.4, a także IBM Db2 dla systemów Linux, UNIX i Windows, mogą pozwolić uwierzytelnionemu użytkownikowi na spowodowanie odmowy usługi z powodu niewłaściwego neutralizowania specjalnych elementów w logice zapytań danych w środowisku Fenced.

A flaw in Samba's vfs_worm module allows bypassing WORM (write-once, read-many) protections during file rename operations. An authenticated user with write access to a share can overwrite a protected file by renaming a newly created file over an existing WORM-protected file.

In libusb before version 1.0.30, a NULL pointer dereference vulnerability exists. An attacker can supply a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Consequently, any application iterating over endpoints may crash.

In the Linux kernel, a memory leak of the ntfs_mount_options structure was found in the NTFS3 filesystem. The issue occurs in ntfs_fill_super() where the fc->fs_private pointer is set to NULL without freeing the allocated memory first, causing ntfs_fs_free() to skip deallocation.

In the Linux kernel, a deadlock was found in the ni_read_folio_cmpr function of the NTFS3 file system. The issue is caused by a lock inversion between the inode mutex (ni_lock) and page locks, leading to a deadlock between two tasks. The fix restructures locking: ni_lock is no longer taken in ntfs_read_folio(), but only after all page locks for the compressed frame have been acquired.

In the Linux kernel, in the accel/amdxdna driver, a vulnerability was found where a NULL pointer dereference can occur during context cleanup. The aie_destroy_context() function is called on error in aie2_create_context(), but it assumes the mailbox channel pointer is non-NULL. If mailbox channel creation fails, the pointer remains NULL, leading to a NULL pointer dereference.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the Panthor DRM driver during panthor_fw_unplug(). The issue occurs when the MCU is in various states or the firmware is not loaded/initialized. The fix removes the MCU halt and wait procedures that could cause the error.