CVE Catalog

A vulnerability in the Linux kernel's MDIO (Management Data Input/Output) subsystem has been addressed. The issue arose because the function 'mdio_bus_init' was incorrectly marked for export and initialization. This combination is problematic, as the initialization section of the code is cleared after use, leaving modules unable to access these symbols. Attempting to use a symbol from a freed section can cause a kernel panic. The problem was detected in 'linux-next' builds after the 'modpost' tool was fixed to issue warnings about this type of error, which had gone unaddressed for a decade.

A use-after-free vulnerability has been identified in the ext4 filesystem component of the Linux kernel. This issue arises during the directory renaming process, specifically in the 'ext4_rename_dir_prepare' function. The vulnerability occurs when the filesystem is mounted without a journal, leading to improper handling of directory entries. As a result, an illegal parent entry can be accessed, causing a memory corruption issue.

A vulnerability in the Linux kernel's EXT4 filesystem has been addressed, concerning the improper handling of the EXT4_FC_REPLAY bit in the superblock's state. This bit, which indicates an ongoing replay of the fast commit journal, was mistakenly included in a way that could be exploited by a maliciously corrupted superblock. Such exploitation could bypass certain sanity checks and trigger a critical error in the filesystem's extent caching mechanism. The vulnerability arose because the superblock information was not correctly initialized, leading to potential inconsistencies during journal replay operations.

A vulnerability in the Linux kernel's ext4 file system has been identified, related to the management of inline data. Under certain conditions, the kernel can encounter a bug that leads to a crash. This issue arises when inline data is converted to extent format, but the conversion process is not properly synchronized with the file system's write operations. As a result, a kernel bug is triggered, indicating an invalid operation, and the system may become unstable.

A refcount leak vulnerability has been identified in the Lantiq GSWIP DSA driver of the Linux kernel. The issue arises because the function 'for_each_available_child_of_node()' decrements the reference count of the previous node with each iteration. When the loop is exited early, the reference count of the last node is not properly released, leading to a memory leak. The vulnerability has been addressed by adding the missing 'of_node_put()' call to ensure the reference count is correctly managed.

A vulnerability in the Linux kernel's handling of the XFRM (IPsec) module has been identified. The issue arises because the function 'xfrm4_protocol_init' was incorrectly marked for export and initialization, allowing access to a freed symbol after the initialization process. This mismanagement can lead to a kernel panic. The problem was detected in 'linux-next' builds after the 'modpost' tool was fixed to recognize such issues, which had gone undetected for a decade.

A data-race vulnerability has been identified in the Linux kernel's handling of Unix domain sockets. The issue arises in the 'unix_dgram_peer_wake_me()' function, which is called by 'unix_dgram_poll()' without holding the necessary lock on the 'other' socket. This can lead to a race condition when checking if the receive queue is full. To avoid this, 'unix_recvq_full_lockless()' should be used instead of 'unix_recvq_full()', as the latter can trigger a data-race warning from the Kernel Concurrency Sanitizer (KCSAN).

A vulnerability in the Linux kernel's ext4 file system allows for the creation of cycles in the directory h-tree, which can lead to kernel memory corruption. This issue arises when a maliciously crafted filesystem introduces cycles in the h-tree of a directory, causing the kernel to improperly handle tree nodes during operations like node splitting. As a result, the kernel may access unallocated memory, potentially leading to further exploitation.

A refcount leak vulnerability has been identified in the Linux kernel's bgmac Ethernet driver. The issue arises in the 'bcma_mdio_mii_registerof_get_child_by_name()' function, which returns a node pointer with an incremented reference count. The vulnerability occurs because the reference count is not properly decremented when the node is no longer needed, leading to a memory management issue.

A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) implementation for ARM64 architecture has been identified. The issue arises from an improper handling of the JIT (Just-In-Time) compilation length of BPF programs. Specifically, the vulnerability allows for an illegal attempt to copy kernel memory to user space, potentially leading to memory corruption or exposure of sensitive information. This issue was triggered by a BPF program that had a JIT length set to 43 bytes, while another related field had been cleared, creating a scenario where a copy operation could overrun the intended memory boundaries.

A vulnerability in the Linux kernel's GRE (Generic Routing Encapsulation) protocol handling has been addressed. The issue arose because the ipgre_xmit function did not properly validate the checksum start after an optional skb_pull, allowing local checksum offload to potentially cause an overflow. The vulnerability was related to how CHECKSUM_PARTIAL packets were processed, particularly in an uncommon GRE path that used header operations and could be affected by BPF redirection.

A vulnerability has been identified in the Linux kernel's IPv6 module related to the improper export of a function initialized with the __init annotation. This issue arises because the .init.text section, where such functions are placed, is cleared after initialization, leaving modules unable to access these symbols. Attempting to use a freed symbol can lead to a kernel panic. The problem was detected in linux-next builds after the modpost tool, which identifies such issues, was repaired. The vulnerability exists because the function seg6_hmac_init() was exported while still being marked for initialization, creating a conflict. The issue can be resolved by either removing the __init annotation or the EXPORT_SYMBOL directive. In this case, the latter was chosen since both the caller and callee belong to the same module, making it an internal function call.

A vulnerability exists in the Linux kernel's handling of connection tracking (CT) rules within the Mellanox MLX5 Ethernet driver. The issue arises because the cleanup process for CT rules is not properly synchronized, leading to a warning trace about a double-free error. Specifically, the CT cleanup is performed before all traffic control (TC) rules have been deleted, causing shared CT resources to be prematurely removed. This vulnerability can be reproduced by loading a module that interacts with the MLX5 driver, which will trigger the improper cleanup sequence.

A vulnerability in the Linux kernel's OCFS2 file system has been addressed. The issue arose in the DLM (Distributed Lock Manager) file system when the function 'user_dlm_destroy_lock' failed. It did not properly clean up the flags it had set, leading to a situation where a lock, still in use, could be incorrectly reported as available. This mismanagement allowed the DLM lock to remain linked in the lock resource, causing a use-after-free error when accessed, which triggered a kernel panic. The vulnerability's root cause was the failure to revert certain flags and properly handle error conditions, particularly when locks were still active.

A vulnerability in the Linux kernel's DRM/ETNAVIV component has been addressed. The issue arose in the IOMMU unmapping process, where the system failed to properly check if a mapping had already been reaped. This oversight could lead to an attempt to unmap the same resource twice, potentially corrupting the associated data structures.

A vulnerability in the Linux kernel's AMD GPU driver can lead to a NULL pointer dereference. This issue arises when a command submission (cs) is made with zero chunks, causing a kernel oops by attempting to execute the incorrect userspace driver. The problem was observed in Linux kernel version 5.10.81 on NixOS, while running a Mesa application with the V3D driver override.

A memory leak vulnerability has been identified in the Linux kernel's huge memory management system, specifically within the xarray implementation. When the function xas_split_alloc() fails to allocate the required nodes for splitting an xarray entry, it erroneously sets the xa_state to -ENOMEM. This state is then interpreted by xas_nomem() as a request to allocate more memory, rather than to free unnecessary memory, which was the intended action. This creates confusion, as xas_nomem() is not meant to be used for memory deallocation in this scenario. To resolve this, the function xas_destroy() should be called instead.

A vulnerability in the Linux kernel's handling of Mellanox mlx5 Ethernet devices can lead to issues with device offloading. The problem arises in the E-Switch component, where the function 'mlx5_get_next_phys_dev()' was called without the necessary interface lock. This vulnerability was introduced by a recent commit that added an assertion to ensure the lock is held, highlighting a race condition that could be exploited during device communication events.

A vulnerability in the Linux kernel's lpfc SCSI driver has been addressed, which involved a NULL pointer dereference. The issue arose because calls to the function starget_to_rport() could return NULL, leading to a potential crash. The vulnerability has been resolved by adding a check for NULL before dereferencing the rport.

A memory leak vulnerability has been identified in the Linux kernel's NFC ST21NFCA component, specifically in the EVT_TRANSACTION handling. The issue arises because error paths do not properly free previously allocated memory, leading to memory leaks. The vulnerability has been addressed by adding a memory deallocation function to the error handling paths.

A vulnerability in the Linux kernel's TCP implementation can lead to potential zero-division errors during MTU (Maximum Transmission Unit) probing. This issue arises because, while the TCP MTU probing function checks that the congestion window is sufficiently large to initiate a probe, there is no safeguard to prevent the congestion window from being reduced before the probe can complete. The vulnerability affects several versions of the Linux kernel, including 5.18.0.

A NULL pointer dereference vulnerability has been identified in the Linux kernel's vDPA user driver. This issue arises when the control device's 'drvdata' is absent, leading to a NULL pointer dereference while accessing the 'msg_timeout' attribute through sysfs. The vulnerability has been resolved by eliminating the unnecessary attribute from the control device.

A use-after-free vulnerability has been identified in the Linux kernel's mt76 wireless driver. This issue arises when the driver improperly manages memory related to wireless client identifiers, leading to potential memory corruption. The vulnerability was detected by the Kernel Address Sanitizer (KASAN), which reported a read operation from a freed memory address. The problem occurs in the mt76_txq_schedule function, where the transmission queue's client identifier pointer is not adequately protected, allowing for unsafe memory access.

A deadlock vulnerability has been identified in the Linux kernel's bcache component, specifically related to journal bucket management. This deadlock can occur when all journal buckets are filled by active journal sets under heavy write I/O load. During cache set registration after a reboot, the system loads active journal sets and reinserts them into the btree, a process known as journal replay. If this process triggers a btree node split, new journal requests may be generated. However, if there is no space in the journal buckets, the replay must wait for a bucket to be freed, leading to a deadlock situation. The vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's rtl818x wireless driver can lead to a kernel panic when using rtl8180 or rtl8185 network cards. The issue arises from the driver attempting to use a transmission queue that has not been initialized, which can cause a 'divide error' crash. This vulnerability was introduced when wpa_supplicant was updated from version 2.9 to 2.10, as the new version started using a priority that the affected driver does not support. The problem has been resolved by patching the driver to ignore the skb priority for these specific cards, which only have one transmission queue.

A vulnerability in the Linux kernel's TCP implementation has been addressed by adding accessors to read and set the TCP send congestion window (snd_cwnd). This change was prompted by previous issues where the assumption that snd_cwnd was always greater than zero was violated. Recently, the syzbot tool reported a warning related to zero congestion window values, which could lead to significant debugging challenges. The new accessors aim to prevent snd_cwnd from being set to invalid values, thereby improving the robustness of TCP congestion control.

A refcount leak vulnerability has been identified in the Linux kernel's MIPS CPC component. The issue arises from a missing reference count release, which should have been applied after finding a compatible device node. This oversight can lead to improper memory management.

A null pointer dereference vulnerability has been identified in the Linux kernel's IOMMU/ARM-SMMU component. The issue arises in the 'arm_smmu_device_probe()' function when 'platform_get_resource()' returns NULL. This can lead to a null pointer dereference when the 'res' variable is used. The vulnerability has been addressed by modifying the code to use 'res' only after 'devm_ioremap_resource()' has checked it, and by employing 'devm_platform_get_and_ioremap_resource()' to streamline the code.

A vulnerability in the Linux kernel's PREEMPT_RT version has been identified, related to the handling of boot parameters for tracing initialization calls. When specific tracing parameters are set, the kernel's output function is invoked while holding a spin lock in a context that does not allow sleeping. This issue arises because, in the PREEMPT_RT kernel, regular spin locks are replaced with sleepable real-time spin locks, leading to a violation of context requirements. The vulnerability was triggered by enabling the 'trace_event=initcall:initcall_start tp_printk=1' parameters, causing a sleeping function to be called from an invalid context, as reported in the kernel's locking spinlock real-time file.

A vulnerability in the Linux kernel's rpcrdma component can lead to a NULL pointer dereference. This issue occurs when an RDMA server returns a fault format reply, causing an NFSv3 client to incorrectly treat it as a callback call when the callback service is absent. The vulnerability arises in several different versions and ranges of the Linux kernel.

A vulnerability in the Linux kernel's Zynqmp DMA engine has been identified, related to a potential overflow in the handling of descriptor sizes within the DMA channel management functions. The issue arises because the descriptor size and the number of descriptors are treated as 32-bit values, which could lead to an overflow in certain multiplication scenarios, despite the overflow not being currently observed. The vulnerability has been addressed by changing the descriptor size data type to size_t, thereby preventing the potential overflow. Additionally, the fix reuses the ZYNQMP_DMA_DESC_SIZE macro in the argument for the dma_alloc_coherent function, improving consistency and clarity.

A null pointer dereference vulnerability has been identified in the Linux kernel's IOMMU ARM SMMU V3 implementation. This issue arises because the code does not properly check the return value of the platform_get_resource() function. If platform_get_resource() returns NULL, it can lead to a null pointer dereference, causing a potential crash or undefined behavior.

A vulnerability in the Linux kernel's F2FS (Flash-Friendly File System) implementation involves the improper use of warning statements in the validation of block addresses. The function 'f2fs_is_valid_blkaddr' triggers a warning if the block address is outside the expected range, particularly for certain data types. This issue can be exploited to bypass normal validation checks, potentially leading to further issues in file system integrity or performance.

A vulnerability in the Linux kernel's F2FS (Flash-Friendly File System) implementation can lead to an infinite loop when flushing node pages. This issue arises because the F2FS test suite can consistently trigger an I/O error, causing the node page flushing process to loop indefinitely. The problem has been addressed by modifying the F2FS code to prevent this infinite loop scenario.

A vulnerability in the Linux kernel's NFSv4 implementation can lead to deadlocks when handling layout get operations. This issue arises because layout locks are held across multiple RPC calls, such as 'setattr()', which can trigger a recall and potentially cause a deadlock. The vulnerability has been addressed by ensuring that layout locks are released before making further RPC calls.

A deadlock vulnerability has been identified in the Linux kernel's staging driver for the RTL8192E wireless chipset. The issue arises in the 'rtllib_beacons_stop()' function, where a thread (Thread 1) sends a beacon while holding a lock. This thread then calls 'del_timer_sync()' to wait for a timer to stop, but the timer handler needs the same lock, creating a circular wait condition that causes the function to block indefinitely. The vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's tty component could lead to a resource leak during the 'icom_probe' process. This issue arises when 'pci_read_config_dword' fails, as the allocated resources are not properly released. The vulnerability has been addressed by modifying the probe function to call 'pci_release_regions' and 'pci_disable_device' in such failure scenarios, ensuring that resources are recycled appropriately.

A deadlock vulnerability has been identified in the Linux kernel's USB host driver, specifically within the oxu_bus_suspend() function. The issue arises when the function holds a lock and simultaneously waits for a timer to stop, creating a circular dependency that causes the function to block indefinitely. This deadlock occurs because the timer handler requires the same lock that oxu_bus_suspend() is holding, leading to a situation where both threads are waiting on each other and cannot proceed.

A memory leak vulnerability has been identified in the Linux kernel's staging RTL8712 driver. The issue arises in the 'r871xu_drv_init()' function, where the 'r8712_init_drv_sw()' failure prevents proper release of memory allocated by 'r8712_alloc_io_queue()'. This memory leak occurs because 'r8712_usb_dvobj_deinit()' does not execute under these failure conditions. The vulnerability can be exploited by causing 'r8712_init_drv_sw()' to fail, leading to an unaddressed memory allocation. The problem is exacerbated because 'r8712_usb_dvobj_deinit()' is not called in a way that accounts for the driver's initialization state, leaving allocated resources unreleased.

A deadlock vulnerability has been identified in the Linux kernel's handling of Wi-Fi events, specifically within the RTL8192BS driver. The issue arises in the rtw_joinbss_event_prehandle() function, where two threads can become stuck waiting for each other to release locks, causing a permanent blockage. This deadlock occurs because one thread holds a lock while waiting for a timer to stop, and the timer's handler also requires the same lock, leading to a circular wait condition.

A refcount leak vulnerability has been identified in the Linux kernel's xillybus character driver. The issue arises in the xillyusb_probe function, where usb_get_dev is called, but usb_put_dev is not properly invoked before releasing the device, leading to a reference count leak.

A deadlock vulnerability has been identified in the Linux kernel's RTL8723BS Wi-Fi driver, specifically within the rtw_surveydone_event_callback() function. The issue arises when one thread holds a lock and waits for a timer to stop, while another thread requires the same lock to proceed, creating a permanent block. The vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's extcon device management can lead to a kernel Oops error. This issue arises because the state_show function can be called intermittently before the driver data is fully set, causing a null reference that triggers the Oops error. The vulnerability has been addressed by modifying the driver registration process to occur after the driver data is established.

A null pointer dereference vulnerability has been identified in the Linux kernel's Synclink GT driver. This issue arises in the 'slgt_clean' function when the driver fails to allocate an HDLC device. If the driver module is removed at this point, it triggers a general protection fault due to a null pointer dereference. The vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's DWC3 USB host controller implementation has been addressed. The issue arose from the unnecessary assignment of ACPI companions to xHCI ports and USB devices, which inadvertently replaced the secondary pointer of the firmware node for the parent DWC3 device. This unintentional sharing of the primary firmware node created potential side effects, such as resource leaks. The vulnerability has been resolved by stopping the ACPI companion assignment, as it is no longer needed.

A deadlock vulnerability has been identified in the Linux kernel's handling of IEEE 802.11 beacons, specifically within the RTL8192U staging driver. The issue arises in the 'ieee80211_beacons_stop()' function, where a circular wait condition occurs between two threads. Thread 1 holds a lock while waiting for a timer to stop, and Thread 2 requires the same lock to release the timer, leading to a permanent block. The vulnerability has been addressed by modifying the function to allow the timer to be released without holding the lock, thereby preventing the deadlock.

A deadlock vulnerability has been identified in the Linux kernel's handling of serial communication, specifically within the sa1100_set_termios() function. The issue arises when one thread holds a lock while waiting for a timer to stop, and another thread attempts to acquire the same lock, leading to a permanent blockage. This vulnerability affects the tty subsystem of the Linux kernel.

A deadlock vulnerability has been identified in the Linux kernel within the RTL8192EU driver. The issue arises in the 'rtw_joinbss_event_prehandle()' function, where a timer is set while holding a lock. This creates a situation where the timer handler also requires the same lock, leading to a permanent blockage. The vulnerability has been addressed by modifying the function to allow the timer handler to access the necessary lock, thus preventing the deadlock.

A vulnerability in the Linux kernel's USB host component, specifically in the isp116x driver, has been addressed. The issue arose because the return value of the platform_get_resource() function was not properly checked. If platform_get_resource() returned NULL, it could lead to a null pointer dereference. The vulnerability has been resolved by adding the necessary checks to prevent this dereference.

A vulnerability in the Linux kernel's RTL8712 USB driver has been addressed, concerning uninitialized memory in the 'usb_read8()', 'usb_read16()', and 'usb_read32()' functions. When the 'r8712_usbctrl_vendorreq()' function returns a negative value, the 'data' variable in the read functions is left uninitialized. This issue was detected by the Kernel Memory Sanitizer (KMSAN), which reported the use of an uninitialized value in a string processing function, leading to potential information leakage through the kernel's printk logging system.