CVE Vulnerability Catalog

In the Linux kernel, the dm thin metadata module has a vulnerability causing metadata inconsistency when a metadata snapshot reservation or release operation fails during commit. Direct modifications to the held_root field in the superblock are flushed to disk on transaction abort, corrupting metadata.

In the Linux kernel's dm-era module, there is an out-of-bounds memory access when the start sector is non-zero. The writeset block calculation does not apply the target offset, potentially leading to out-of-bounds read (detected by KASAN).

In the Linux kernel's dm-log module, there is a bitset_size overflow on 32-bit machines. Rounding region_count to a multiple of BITS_PER_LONG can cause wrap to zero, leading to incorrect memory allocation.

In the Linux kernel's dm module, there is a leak of the caller's thread keyring via the table device file. This causes the LUKS volume key to remain in memory after luksSuspend, potentially allowing its recovery.

In the Linux kernel, the dm_early_create function has a bug where it attempts to free an already used table when dm_resume fails. The table was already instantiated with dm_swap_table, and the code tries to destroy it again, which may lead to incorrect behavior. The fix skips the dm_table_destroy call in this case.

In the Linux kernel, the dm-integrity module has a bug that can lead to a deadlock. When dm_integrity_check_limits fails, the code exits with DM_MAPIO_KILL, but the range is already locked and not unlocked. The fix moves the limit check earlier to avoid resource leaks.

In the Linux kernel, the dm-integrity module has a bug where the hash_offset variable is incremented twice. The variable is already incremented in the loop, and the code increments it again, leading to incorrect behavior. The fix removes the extra increment.

In the Linux kernel, the dma_fence_dedup_array() function returns 1 when called with a count of 0, which contradicts the documentation and may lead to dereferencing an uninitialized pointer in amdgpu_userq_wait_*(). The fix makes the function return 0 for an empty array.

In the Linux kernel, the accel/amdxdna module has a use-after-free bug in amdxdna_gem_dmabuf_mmap(). When vm_insert_pages() fails, the error path calls close, which releases the GEM object, and then the code releases it again, leading to access to freed memory. The fix returns directly from close_vma.

In the Linux kernel accel/amdxdna driver, amdxdna_drm_sync_bo_ioctl() for SYNC_DIRECT_FROM_DEVICE passes the BO's client pointer to amdxdna_hwctx_sync_debug_bo() instead of the ioctl file's client. This causes the wrong client to be used as the handle namespace and hardware context owner, potentially leading to synchronization errors. The fix passes filp->driver_priv instead.

In the Linux kernel accel/ivpu driver, fw_log_from_bo() does not check that the log size is at least the header size. When the log is smaller, fw_log_print_buffer() computes data_size with an underflow, leading to reads far past the small real data region of the BO. A size of 0 also causes infinite looping. The fix rejects logs whose size is smaller than the header.

In the Linux kernel, a use-after-free vulnerability was found in the resctrl subsystem during unmount. A concurrent reader of a monitoring event file may access already freed memory because the RDT_DELETED flag is not set for the default resource group. The fix sets this flag unconditionally and prevents remounting when there are pending readers.

In the mlx5e driver for Mellanox network cards, a use-after-free vulnerability was found in MACsec handling. Deleting an RX SC freed the metadata_dst object without respecting the reference count, which could lead to use of freed memory by a concurrent packet receive process. Additionally, publishing an element in the xarray before metadata_dst initialization could expose incomplete data.

A use-after-free vulnerability was found in the Linux kernel's user_event_mm_dup() function related to the user_events mechanism. The issue occurs during fork() when the enabler list is traversed without locking while another thread removes an enabler, leading to use of freed memory. An unprivileged attacker can trigger this bug, resulting in a system crash or potential privilege escalation.

In the Linux kernel, the CPU hotplug mechanism has a bug in cpuhp_invoke_callback() that hides the original error during rollback of earlier callbacks. The ret variable is reused to store the rollback result, which can mask the original error.

In the Linux kernel, the CPU hotplug mechanism has a buffer overflow vulnerability in states_show(). The function writes hotplug state names to a sysfs buffer using sprintf(), which can write past the end of the PAGE_SIZE buffer when many states are registered.

In the Linux kernel, the SIT driver's ipip6_changelink() did not check CAP_NET_ADMIN in the tunnel's network namespace. A caller privileged in the device's netns but not in the tunnel's netns could modify the tunnel. Added rtnl_dev_link_net_capable() check at the beginning.

In the Linux kernel, the act_ct module's tcf_ct_handle_fragments() does not save and restore skb->cb during defragmentation. This causes loss of qdisc metadata like pkt_segs and can trigger WARN_ON_ONCE(). Added save and restore of tc_skb_cb.

In the Linux kernel, the IP6VTI driver's vti6_changelink() did not check CAP_NET_ADMIN in the tunnel's network namespace. A caller privileged in the device's netns but not in the tunnel's netns could modify the tunnel. Added rtnl_dev_link_net_capable() check at the beginning.

In the Linux kernel, the IPVTI driver's vti_changelink() did not check CAP_NET_ADMIN in the tunnel's network namespace. A caller privileged in the device's netns but not in the tunnel's netns could modify the tunnel. Added rtnl_dev_link_net_capable() check at the beginning.