CVE Vulnerability Catalog

In the Linux kernel, the IPIP driver's ipip_changelink() did not check CAP_NET_ADMIN in the tunnel's network namespace. A caller privileged in the device's netns but not in the tunnel's netns could modify the tunnel. Added rtnl_dev_link_net_capable() check at the beginning.

In the Linux kernel, the ip6_gre driver has a vulnerability where CAP_NET_ADMIN is not required in the tunnel's network namespace during changelink operations. A caller privileged in the device's namespace but not in the tunnel's namespace can modify a tunnel residing in another namespace.

In the Linux kernel, the ip6_tunnel driver has a vulnerability where CAP_NET_ADMIN is not required in the tunnel's network namespace during changelink operations. A caller privileged in the device's namespace but not in the tunnel's namespace can modify a tunnel residing in another namespace.

A vulnerability was found in the Linux kernel's legacy netlink interface for IEEE 802.15.4. The LLSEC dump operations in the IEEE802154_NL family lacked the required administrative permission flag, allowing any local user to read raw 16-byte AES-128 keys from the kernel key table. The issue affects only the legacy API, while the modern nl802154 family is properly secured.

In the Linux kernel, the octeontx2-af (cn10k) driver has a vulnerability due to lack of validation of the base_pcifunc field in rvu_mbox_handler_lmtst_tbl_setup(). This allows a VF function to read the physical LMTLINE address of another function if base_pcifunc points outside its own PF space. The fix rejects the request with -EPERM when base_pcifunc is not a valid function under its own PF.

In the Linux kernel on LoongArch architecture, a vulnerability was found related to missing dirty page tracking in pte_wrprotect() and pmd_wrprotect(). When hardware page table walker (PTW) is enabled, it may set _PAGE_DIRTY without setting _PAGE_MODIFIED, leading to loss of dirty information during copy-on-write (fork). As a result, a page may be considered clean and freed without writeback, causing data corruption.

In the Linux kernel IPMI subsystem, a vulnerability exists where the user refcount is underflowed during event delivery. On delivery failure, the rollback path decrements the refcount excessively, potentially leading to use-after-free or a refcount_t warning.

In the Linux kernel network scheduler sch_multiq, a vulnerability exists due to direct dequeue call instead of using peek and qdisc_dequeue_peeked. When the child is non-work-conserving, direct dequeue can lead to qlen/backlog desync and potential kernel panic.

In the Linux kernel network scheduler sch_taprio, a vulnerability exists due to direct dequeue call instead of using peek and qdisc_dequeue_peeked. When the child is non-work-conserving, direct dequeue can lead to qlen/backlog desync and potential kernel panic.

In the Linux kernel capable_wrt_mount() function, a vulnerability exists due to not rejecting detached mounts. If a mount is detached between checks, the function may dereference NULL, leading to kernel panic.

In the Linux kernel, the iosm driver for WWAN modems has a vulnerability due to missing validation of modem-supplied offsets and lengths in the MUX downlink decoder. A malicious modem can cause out-of-bounds reads and infinite loops in the decoder, leading to system crashes or memory disclosure.

In the Linux kernel's memory compaction module (mm/compaction), the compaction_free() function does not properly handle the failure case of free_pages_prepare(). Failed pages should not be added back to cc->freepages for future use, as they can be either PageHWPoison or free_page_is_bad() and might cause data corruption.

In the Linux kernel, in the mac802154 subsystem, interface removal does not use RCU, which can lead to use-after-free during asynchronous transmit completion. The fix changes list_del() to list_del_rcu() to ensure safe removal in RCU context.

In the Linux kernel, in the IPVS subsystem, the set_sctp_state() function incorrectly calculates the offset for IPv6 SCTP packets with extension headers, leading to incorrect state machine behavior. The fix uses the parsed transport offset passed from ip_vs_set_state() to correctly read the SCTP header.

In the Linux kernel, in the macsec_encrypt() function, an unset MAC header is read, leading to an out-of-bounds read (12-byte over-read) and data leak to the wire. The fix uses skb_eth_hdr() instead of eth_hdr() to correctly obtain the L2 header.

In the Linux kernel, in the dibs loopback driver, the move_data() function does not validate that offset and size do not exceed the DMB length, which can lead to out-of-bounds write. The fix adds an explicit bounds check before memcpy, returning -EINVAL for invalid requests.

In the Linux kernel's tracing/osnoise module, there is a missing synchronize_rcu() call during unregistering. This can lead to use-after-free when RCU readers are still traversing the instance list.

In the Linux kernel's pmdomain module for i.MX93, there is an issue with shared control bits for clock and reset between DSI and CSI domains. This can lead to incorrect behavior if one domain disables shared resources while the other is still active.

In the rt2x00 driver in the Linux kernel, rt2x00lib_probe_dev() uses the full teardown path for all probe failures, even when work structures are not yet initialized. This can lead to invalid work drains and DEBUG_OBJECTS reports.

In the brcmfmac driver in the Linux kernel, there is a heap overflow when processing short authentication frames. The frame length can be less than the management header, causing arithmetic wrap and copying a huge amount of data beyond the buffer.