CVE Catalog

A use-after-free vulnerability has been identified in the Bluetooth subsystem of the Linux kernel. This issue arises in the handling of HCI (Host Controller Interface) events, specifically the HCI_EV_DISCONN_PHY_LINK_COMPLETE event. The vulnerability occurs because the event processing function, hci_send_acl, does not properly verify the connection type before deleting the connection, leading to a memory access violation. The flaw was detected in a kernel version that is part of the 5.17 release candidate series.

A vulnerability in the Linux kernel's netfilter connection tracking (conntrack) system has been addressed. The issue arose because the garbage collection (GC) for conntrack entries was changed to run every two minutes. On systems with a large conntrack hash table, most evictions occurred during GC rather than through normal packet processing. This shift caused netlink event overflows when events were collected. The vulnerability has been resolved by modifying the GC process to collect the average expiry of scanned entries and reschedule the GC to the average remaining time, within a 1 to 60 second interval. To prevent event overflows, the GC now reschedules after processing each hash table bucket and imposes a limit on both the runtime and the number of evictions per cycle. If additional entries need to be evicted, the GC can reschedule and restart after a short delay.

A vulnerability in the Linux kernel's Ceph file system component has been addressed, concerning improper management of inode references in the 'ceph_get_snapdir()' function. The issue arose because 'ceph_get_inode()' would either search for an existing inode or insert a new one, returning a reference to it. In cases where a new inode was created, the reference needed to be released, particularly during error handling. This vulnerability could lead to an inode reference leak, potentially causing memory management issues.

A vulnerability in the Linux kernel's Mediatek clock driver has been addressed, which involved memory leaks during the probe process. The fix directs error handling to properly free memory when necessary.

A memory leak vulnerability has been identified in the Ceph component of the Linux kernel. This issue arises in the 'ceph_readdir' function when 'note_last_dentry' returns an error. The vulnerability causes the 'last_readdir' variable to retain a reference that is not properly freed, leading to a memory leak.

A vulnerability in the Linux kernel's VCHIq component can lead to a NULL pointer dereference. The issue arises in the 'vchiq_get_state()' function, which can return a NULL pointer. This vulnerability has been addressed by modifying the 'vchiq_dump_platform_instances' function to properly handle these NULL pointer cases and prevent the dereference.

A memory leak vulnerability has been identified in the Linux kernel's staging area, specifically within the WFX driver. The issue arises in the 'wfx_init_common()' function, where an error handler fails to properly release hardware resources. This oversight can lead to a memory leak. The vulnerability has been addressed by adding a new error label to standardize the error handling process, which will be beneficial for future modifications.

A vulnerability in the Linux kernel's VCHIQ core has been addressed, which involved a NULL pointer dereference. The issue arose because the function 'find_service_by_handle' returned NULL when given an invalid handle. This vulnerability could be exploited by not properly handling the NULL result, leading to a dereference of a NULL pointer.

A reference count leak vulnerability has been identified in the Linux kernel's NFSv4.2 implementation, specifically within the '_nfs42_proc_copy_notify()' function. The issue arises in two error handling paths where the function fails to properly balance the reference count of the 'ctx' object. This oversight, caused by an incomplete error handling process, can lead to reference count leaks.

A vulnerability leading to a potential memory leak has been identified in the Linux kernel, specifically within the habanalabs component. This issue arises from a copy-paste error that can cause the host-resident shadow to be NULL, likely leading to a memory leak when the dependency between the Direct Rendering (DR) and Host Resident (HR) is not maintained.

A vulnerability in the Linux kernel's virtio_console component has been addressed. The issue involved the use of anonymous module initialization and exit functions, which could create confusion in the System.map file and initcall_debug log. This ambiguity could lead to misinterpretations or mismanagement of module initialization processes. The vulnerability has been resolved by assigning unique, driver-specific names to the module_init and module_exit functions, eliminating the anonymous identifiers that could cause such confusion.

A vulnerability in the Linux kernel's VMBus driver has been addressed, related to improper initialization of device objects before registration. The issue involved failing to set the device's DMA mask and parameters, which led to a warning during the device probing process. This vulnerability could potentially cause issues with device management and performance.

A vulnerability in the Linux kernel's VMBus driver module can lead to a potential crash when the module is unloaded. This issue arises because the VMBus driver, which can be built as a module, improperly manages the registration and unregistration of panic notifier callbacks. The vulnerability is present in the VMBus driver of the Linux kernel.

A vulnerability in the Linux kernel's NFS writeback handling can cause writeback threads to become stuck in memory allocation loops during low memory situations. This issue has been addressed by allowing the NFS writeback code to fail gracefully instead of getting trapped in infinite loops.

A vulnerability in the Linux kernel's SFC network driver has been identified, leading to a NULL pointer dereference kernel panic. This issue occurs when the receive and transmit ring buffer sizes are changed, and the driver reallocates and reinitializes the queues and their buffers. However, it fails to properly reinitialize the XDP (eXpress Data Path) queues. As a result, when the driver acts on XDP_TX or XDP_REDIRECT, it references an uninitialized buffer, causing a kernel panic. The vulnerability has been addressed by separating the XDP queue handling into a new function, efx_set_xdp_channels(), to ensure proper initialization.

A resource leak vulnerability has been identified in the Linux kernel's SCSI Zorro7xx driver. The issue arises in the 'zorro7xx_remove_one()' function, where an error handling path releases a resource that is not properly freed in the removal process. This oversight can lead to a resource leak, as certain memory mappings created by 'ioremap()' are not being undone. The vulnerability has been addressed by adding the missing 'iounmap()' call in the removal function.

A slab-out-of-bounds vulnerability has been identified in the Linux kernel's TLS implementation. This issue arises in the 'decrypt_internal' function, where the memory size of the initialization vector (IV) for AES128-CCM is incorrectly set to 12 bytes. However, the 'ccm(aes)' encryption scheme requires 16 bytes, leading to a buffer over-read. The vulnerability can be triggered when the 'tls_set_sw_offload' function is called, particularly in the context of TLS 1.3.

A use-after-free vulnerability has been identified in the Linux kernel's handling of socket buffer (SKB) coalescing when using the page pool for fragment recycling. This issue arises in the hns3 driver during normal receive (RX) operations. The vulnerability occurs when SKBs sharing a reference to the same page fragment are coalesced, leading to an incorrect release of page references. As a result, a page can be freed while still in use by another RX descriptor, causing IOMMU faults or memory corruption.

A vulnerability in the Linux kernel's handling of route deletion can lead to a warning being triggered when routes pointing to a nexthop ID are deleted without specifying the nexthop ID, but while matching on an interface. This issue arises because the route deletion process inadvertently interacts with nexthop objects, which are managed separately, causing a kernel warning. The vulnerability is present in the route deletion command when using the old-style nexthop specification, as these routes are handled differently.

A memory leak vulnerability has been identified in the Linux kernel's DRM IMX component. The issue arises in the 'imx_pd_connector_get_modes' function, where the display mode variable is not properly released if the 'of_get_drm_display_mode' function fails. This oversight leads to a resource leak, as noted by a Coverity analysis.

A vulnerability in the Linux kernel's arm64 architecture has been addressed, concerning the initialization of CPU topology for core scheduling. The issue arose because the function responsible for updating CPU topology was called after notifying the scheduler about the available CPUs. This improper sequence led to a mismatch between the core scheduling data structures and the actual CPU topology. As a result, a warning was generated, followed by a crash, when the stress-ng tool was used to test core scheduling support.

A race condition vulnerability has been identified in the Linux kernel's IB/rdmavt component. The issue arises because a call to the rvt_error_qp function is made without holding the required locks, r_lock and s_lock. This oversight, introduced by a previous commit, not only causes a lock dependency assertion failure but also creates a potential race condition.

A refcount leak vulnerability has been addressed in the Linux kernel's dpaa2-ptp component. The issue arose because a node pointer returned by of_find_compatible_node() had an incremented refcount, which was not properly decremented, leading to the leak. The vulnerability has been fixed by adding a call to of_node_put() to correct the refcount management.

A race condition vulnerability has been identified in the Linux kernel's Rxrpc implementation, specifically in the handling of peer keepalive timers. The issue arises in the 'rxrpc_exit_net()' function, where the peer keepalive timer can remain active even after the network is marked as no longer live. This mismanagement can lead to a use-after-free error, as the timer is still armed when 'rxrpc_exit_net()' completes its execution. The vulnerability was reported by syzbot and is present in Linux kernel version 5.17.0.

A memory leak vulnerability has been identified in the Open vSwitch (OVS) module of the Linux kernel. This issue arises when the module parses user-defined actions, potentially leading to dynamic memory allocation that is not properly freed. Currently, the actions 'ct()' and 'set()' can cause memory to be retained, with the 'ct()' action leaking memory allocated for connection tracking under certain flow conditions. The 'set()' action can leak tunnel information, including device references. The vulnerability is exacerbated by high flow rotation rates, which can lead to significant memory consumption, estimated at 2MB per second in one reported case.

A use-after-free vulnerability has been identified in the Linux kernel's DRBD component. The issue arises in the 'get_initial_state' function, where a socket buffer (skb) is freed but then improperly accessed, leading to potential memory corruption. This vulnerability can be exploited because the same skb can be freed in related notification functions, creating additional use-after-free scenarios.

A vulnerability in the Linux kernel's qede driver can lead to a null pointer dereference, causing a kernel panic. The issue arises because the function qede_build_skb() assumes that the socket buffer (skb) is always successfully allocated. However, under memory pressure, the allocation can fail, leaving the skb as NULL. The function then proceeds to reserve space in the skb, leading to a panic when it attempts to use a NULL reference. This vulnerability has been addressed by adding a check to ensure that the skb is allocated before use, with the NULL return properly handled in the function's callers.

A NULL pointer dereference vulnerability has been introduced in the Linux kernel's IOMMU OMAP handling. This issue arises from a regression caused by a recent commit that improperly changed the return type of a function, leading the OMAP IOMMU probe to return a success value instead of an error pointer. As a result, certain OMAP variants experience a NULL pointer dereference during the IOMMU device probing process.

A use-after-free vulnerability has been identified in the Linux kernel's mpt3sas SCSI driver. The issue arises in the function '_scsih_expander_node_remove()', which is called by 'mpt3sas_transport_port_remove()'. This sequence frees the port field of the 'sas_expander' structure, leading to a use-after-free error detected by the Kernel Address Sanitizer (KASAN). The vulnerability can be triggered when the driver module is removed, causing a read of a freed memory address.

A vulnerability has been identified in the Linux kernel's high memory management, specifically within the kmap local scheduling functions. When the DEBUG_KMAP_LOCAL configuration is enabled, these functions improperly verify that certain memory mapping slots are unmapped. The verification process uses a comparison that can lead to incorrect assumptions, particularly on xtensa architecture, where it generates runtime warnings about the scheduling state. This issue arises because the initial slot values, set to zero, do not reliably indicate an unmapped state, potentially leading to erroneous handling of task scheduling.

A vulnerability in the Linux kernel's memory policy management can cause a memory leak. This issue arises in the 'mm/mempolicy' component, where an allocated 'mpol_new' reference is not properly managed if it is not used in the restart loop. The problem occurs when the memory policy is updated on a shared 'shmem' file while the associated lock is released, allowing 'mpol_new' to be incorrectly freed before it can be used. As a result, the reference count is not properly initialized, leading to a potential leak of the unused 'mpol_new' allocation.

A deadlock vulnerability has been identified in the Linux kernel's Btrfs file system, specifically within the zoned storage management. The issue arises in the 'btrfs_can_activate_zone' function, which can be called while holding the 'device_list_mutex'. This creates a scenario where the function attempts to acquire the same mutex again, leading to a deadlock. The problem occurs during the chunk allocation process, where the mutex is already held, causing a recursive locking situation. The vulnerability affects Linux kernel versions prior to 5.17.0.

A use-after-free vulnerability has been identified in the Linux kernel's handling of LZ4 decompression. This issue arises in the LZ4_decompress_safe_partial function, where partial decoding can lead to an out-of-bounds read. The vulnerability occurs when the decompression routine encounters corrupted compressed data, creating extreme corner cases that the current decoding logic cannot properly handle. This problem was introduced when the decompression routine was ported from LZ4 version 1.8.3, and while the LZ4 upstream has addressed the issue, integrating the latest version into the Linux kernel will require significant effort.

A vulnerability in the Linux kernel's memory management can lead to unnecessary warnings in KVM's memory management unit notifier. This issue arises when the mremap() system call is used with an old_size of zero, causing the move_page_tables() function to invoke invalidate_range_start() and invalidate_range_end() with an empty range. Such empty ranges have previously been flagged as off-by-one errors, triggering a warning. Although there have been few unique reports of this issue, it is considered beneficial to identify and correct these erroneous usages in userspace.

A use-after-free vulnerability has been identified in the Linux kernel's RDMA/hfi1 component. This issue arises under certain conditions, such as during an MPI_Abort, when the hfi1 cleanup process may prematurely release the last reference to a task's memory management structure. As a result, a new task could allocate the memory structure while it is still in use, leading to various problems. One consequence is the corruption of the memory management semaphore counter, causing a deadlock during write operations. Additionally, this vulnerability can corrupt a memory management structure that another task is actively using.

A vulnerability in the Linux kernel's Btrfs file system allows for a quota group (qgroup) reserve overflow. This issue arises because the 'bytes_changed' variable, used to track the amount of data reserved for the EXTENT_QGROUP_RESERVED state, is defined as an unsigned int. When attempting to allocate a range larger than 4 GiB, this variable can overflow, leading to an incorrect reservation of bytes and a breach of the qgroup limit. The vulnerability is exploited through the 'fallocate' command, which can bypass the intended 256 MiB per extent limit, causing the qgroup limit to be exceeded.

A vulnerability in the Linux kernel's handling of the GICv3 interrupt controller's redistributor polling has been corrected. The issue arose because the polling incorrectly referenced the distributor bit index instead of the correct bit number for the redistributors. This mistake went unnoticed for eight years.

A vulnerability in the Linux kernel's SATA driver for the DWC 460EX controller has been fixed. The issue was an out-of-bounds write that caused a crash by dereferencing a NULL pointer. This vulnerability arose because the driver improperly handled 'tag' values from libata, leading to memory access errors. The crash occurred when the driver nullified a DMA channel pointer, which was then passed to a DMA engine configuration function, causing a kernel panic. The vulnerability was reported on the OpenWrt Forum and is related to the driver's management of command tags and queue sizes.

A race condition vulnerability has been identified in the Linux kernel's GPIO (General Purpose Input/Output) subsystem. This issue arises because the IRQ (interrupt request) members of GPIO chips are exposed before they are fully initialized, leading to potential NULL pointer dereferences in the kernel. The vulnerability was observed when the 'gc->irq.domain' variable was accessed via the I2C interface, before it could be properly initialized by the 'gpiochip_add_irqchip()' function. This premature access created a race condition, allowing for a NULL pointer dereference in the kernel.

A vulnerability in the Linux kernel's ILI9341 panel driver relates to improper handling of optional regulator lookups. If the lookup fails, the driver does not correctly reset the pointer, potentially leading to a null pointer dereference. This issue can cause functions that rely on the regulator, such as 'mipi_dbi_poweron_reset_conditional()', to crash by dereferencing a null pointer.

A vulnerability in the Linux kernel's framebuffer device (fbdev) subsystem can lead to a NULL pointer dereference. This issue occurs when framebuffers without an associated device in the Linux device hierarchy are unregistered. Instead of performing a standard unregistration, the kernel attempts to hot-unplug a non-existent device, resulting in a NULL dereference. The vulnerability was introduced in version 5.17.0 by a commit that changed the unregistration process for firmware framebuffers. The issue has been observed on ppc64le architecture.

A vulnerability in the Linux kernel's AMD display driver can lead to a general protection fault, particularly when running WebGL Aquarium with DRM debug logs enabled. The issue arises in the 'dcn30_internal_validate_bw' function, where doubles are improperly initialized, creating a non-canonical address that causes a fault. This vulnerability affects several Linux kernel versions, including 5.15.30.

A vulnerability in the Linux kernel's Btrfs file system has been addressed, related to improper management of delayed allocation during direct I/O write operations. This issue can lead to warnings about unprocessed extents when certain generic tests are run. The vulnerability arises because the length of allocated extents can be altered in copy-on-write scenarios, causing the system to release fewer extents than intended. The problem was fixed by ensuring that the original length is used when releasing extents, preventing the mismatch.

A vulnerability in the Linux kernel's handling of virtual addresses in the PowerPC 64-bit Book3E architecture has been identified. The issue arises because the vmalloc space starts at a specific high address, which, due to the way the __pa() function operates, is incorrectly interpreted as a valid physical address. This misrepresentation leads the virt_addr_valid() function to erroneously validate addresses in the vmalloc space as legitimate, potentially causing kernel panics by exposing kernel memory through certain operations, such as using ethtool on network interfaces.

A vulnerability in the Linux kernel's veth networking component can lead to a kernel bug. When a decapsulated packet is sent through a veth device using the act_mirred action, the length of the packet's header can be zero. This situation arises because the veth_xmit function forwards the packet without ensuring that it contains the required Ethernet header length. The issue occurs in the packet processing pipeline, where the missing header can cause a failure in the expected data handling.

A vulnerability in the Linux kernel's SUNRPC component can lead to a NULL pointer dereference crash when an 'svc_rqst' request is deferred while the SUNRPC tracing subsystem is active. This issue arises because the 'svc_revisit()' function clears the 'xprt' field, removing the remote address needed for the tracepoint, which can cause a crash by dereferencing a NULL value. The vulnerability has been addressed by modifying the trace event to safely handle the remote address, allowing the fix to be backported to stable kernel versions.

A vulnerability in the Linux kernel's cachefiles component has been addressed, concerning improper inode management during error handling. When an error occurs, the in-use flag for the inode is not correctly cleared, leading to issues when another cookie with the same index key is later processed. This can cause Cachefiles to erroneously report that the 'Inode is already in use'. Although this warning won't be triggered if the leakage happens during temporary file creation, the in-use flag should still be properly managed.

A use-after-free vulnerability has been identified in the Linux kernel's Ice network driver, specifically in the management of the Accelerated Receive Flow Steering (ARFS) feature. This issue arises because the driver improperly frees CPU receive mappings after releasing interrupt request (IRQ) resources, leading to potential memory access violations. The vulnerability was revealed through Kernel Address Sanitizer (KASAN) testing, which detected the use-after-free condition when a task attempted to read memory that had already been freed. The problem occurs in version 5.17.0-rc8_nextqueue-devqueue-02643-g23f3121aca93.

A slab-out-of-bounds vulnerability has been identified in the Linux kernel's cachefiles component. This issue arises in version 5.18.0-rc1-nfs-fscache-netfs and is related to how volume coherency data is handled when setting extended attributes. The vulnerability was detected by the Kernel Address Sanitizer (KASAN), which reported a memory access error caused by a task writing beyond the allocated buffer size. This improper handling of data can potentially be exploited to manipulate memory, leading to undefined behavior or memory corruption.

A null pointer dereference vulnerability has been identified in the Linux kernel's altr_tse_pcs driver, specifically when using a fixed-link configuration. The issue arises because the driver does not receive a phy_device, leading to a crash when the tse_pcs_fix_mac_speed function is called. The vulnerability has been addressed by adding a check for the phy_dev before invoking the tse_pcs_fix_mac_speed function. Additionally, the tse_pcs_fix_mac_speed function has been cleaned up to remove unnecessary checks for splitter_base and sgmii_adapter_base, as the driver would fail if these variables are not properly set in the device tree.