CVE Catalog

A data-race vulnerability has been identified in the Linux kernel's TCP implementation, specifically around the 'sysctl_tcp_probe_interval' parameter. This vulnerability arises because the parameter can be changed concurrently while it is being read, leading to potential inconsistencies. The issue has been addressed by adding a 'READ_ONCE()' directive to the reader of the parameter, ensuring a more reliable and consistent read operation.

A shift-out-of-bounds vulnerability has been identified in the Linux kernel's STMicroelectronics Ethernet driver, specifically in the DMA queue mapping for the MTL_RXQ_DMA_MAP1. This issue arises when the queue number exceeds 4, leading to an overflow in the left shift operation due to the 32-bit integer variable. The vulnerability can be observed when the kernel is compiled with CONFIG_UBSAN enabled, which triggers a warning about the out-of-bounds shift. The vulnerability has been addressed by correcting the mask calculation for the DMA queue mapping, thereby resolving the overflow issue and the associated warning.

A refcount leak vulnerability has been identified in the Linux kernel's Microchip DSA driver, specifically within the ksz_switch_register() function. The issue arises because the function fails to properly release a reference count for a node obtained from of_get_child_by_name(), leading to a memory management flaw.

A data-race vulnerability has been identified in the Linux kernel's IGMP (Internet Group Management Protocol) handling. The issue arises in the sysctl_igmp_llm_reports variable, which can be modified concurrently while being read. This vulnerability affects multiple versions of the Linux kernel that handle IGMP reports. To address this issue, the READ_ONCE() function needs to be added to the variable's readers, ensuring proper synchronization.

A data-race vulnerability has been identified in the Linux kernel's IGMP (Internet Group Management Protocol) implementation. The issue arises around the sysctl_igmp_qrv variable, which can be modified concurrently while being read. This vulnerability affects several versions of the Linux kernel.

A data-race vulnerability has been identified in the Linux kernel's TCP implementation, specifically concerning the sysctl_tcp_migrate_req parameter. This vulnerability arises because sysctl_tcp_migrate_req can be modified concurrently while it is being read. To address this issue, the kernel has been updated to include a READ_ONCE() directive for readers of this parameter.

A data-race vulnerability has been identified in the Linux kernel's TCP implementation, specifically around the sysctl_tcp_notsent_lowat parameter. This vulnerability arises because the parameter can be changed concurrently while being read, leading to potential inconsistencies. The issue has been addressed by adding a READ_ONCE() directive to the reader of the parameter.

A data race vulnerability has been identified in the Linux kernel's TCP implementation, specifically regarding the sysctl_tcp_fastopen parameter. This vulnerability allows the parameter to be read and modified concurrently, potentially leading to inconsistent behavior. The issue has been addressed by adding a READ_ONCE() directive to the readers of this parameter.

A data race vulnerability has been identified in the Linux kernel's TCP implementation, specifically regarding the sysctl_tcp_fastopen_blackhole_timeout parameter. This vulnerability allows the timeout value to be changed concurrently while it is being read, potentially leading to inconsistent behavior. The issue has been addressed by adding a READ_ONCE() directive to the parameter's readers, ensuring safe access and preventing concurrent modification.

A denial-of-service vulnerability has been identified in the Linux kernel's ixgbe driver. The issue arises when virtual functions (VFs) are disabled while the physical function (PF) driver is handling requests from the VF driver. This improper synchronization can lead to a kernel panic, causing a system crash. The vulnerability is related to the management of SR-IOV (Single Root I/O Virtualization) resources.

A memory leak vulnerability has been identified in the Linux kernel's IAVF driver, specifically in the handling of dummy receive descriptors. When the hardware generates a dummy descriptor, the IAVF driver previously failed to free the associated memory from the prior receive buffer. Although this scenario is rare, it can occur. The vulnerability has been addressed by modifying the IAVF driver to properly manage memory for dummy receive descriptors.

A NULL pointer dereference vulnerability has been identified in the Linux kernel's Distributed Switch Architecture (DSA) component. The issue arises in the 'dsa_port_reset_vlan_filtering' function, where the 'ds' iterator variable overwrites the 'dp' argument. This flaw leads to an invalid dereference in switches with global VLAN filtering enabled, after they have exited a VLAN-aware bridge. The vulnerability has been addressed by introducing a separate iterator variable to prevent the overwrite.

A buffer overflow vulnerability has been identified in the Linux kernel's be2net driver. The issue arises in the 'be_get_module_eeprom' function, which incorrectly assumes that it receives a buffer at least PAGE_DATA_LEN in size, or twice that if the module is SFF8472-compliant. This assumption is not always valid, leading to the potential overflow. The vulnerability can be exploited by manipulating the buffer size expectations during EEPROM module data reads, particularly transceiver data, creating a risk of memory corruption.

A data-race vulnerability has been identified in the Linux kernel's IPv4 handling of multipath routing, specifically around the sysctl_fib_multipath_use_neigh parameter. This vulnerability arises because the parameter can be changed concurrently while it is being read, leading to potential inconsistencies. The issue has been addressed by adding a READ_ONCE() directive to the parameter's reader.

A data race vulnerability has been identified in the Linux kernel's IPv4 handling of the sysctl_fib_multipath_hash_policy. This vulnerability arises because the hash policy can be changed concurrently while it is being read, leading to potential inconsistencies. To address this issue, the kernel has been updated to include a READ_ONCE() directive in the readers of this policy.

A data-race vulnerability has been identified in the Linux kernel, specifically in the handling of sysctl_ip_prot_sock. This vulnerability arises from concurrent access to sysctl_ip_prot_sock, which creates a risk of data-races. To mitigate this issue, it is necessary to implement basic protection for all readers and writers to prevent load/store tearing.

A data-race vulnerability has been identified in the Linux kernel's UDP implementation, specifically around the sysctl_udp_l3mdev_accept parameter. This vulnerability arises because the parameter can be changed concurrently while it is being read, creating a race condition. The issue has been addressed by adding a READ_ONCE() directive to the parameter's reader.

A data race vulnerability has been identified in the Linux kernel's IPv4 handling of the sysctl_fib_multipath_hash_fields. This vulnerability arises because the hash fields can be modified concurrently while being read, leading to potential inconsistencies. The issue has been addressed by adding a READ_ONCE() directive to the readers of this sysctl parameter.

A data-race vulnerability has been identified in the Linux kernel's TCP implementation, specifically regarding the sysctl_tcp_thin_linear_timeouts parameter. While this parameter is being read, it can be concurrently modified, leading to potential inconsistencies. The vulnerability has been addressed by adding a READ_ONCE() directive to the reader.

A vulnerability in the Linux kernel's TCP implementation allows for concurrent modification of the 'sysctl_tcp_recovery' parameter while it is being read. This data race can lead to inconsistent or unexpected behavior. The issue has been addressed by adding a 'READ_ONCE()' directive to the readers of this parameter, ensuring safe access.

A data-race vulnerability has been identified in the Linux kernel's TCP implementation, specifically around the sysctl_tcp_early_retrans parameter. While this parameter is being read, it can be concurrently modified, leading to potential inconsistencies. The vulnerability has been addressed by adding a READ_ONCE() directive to the reader, ensuring a more reliable access pattern.

A data-race vulnerability has been identified in the Linux kernel's TCP implementation, specifically concerning the sysctl_tcp_slow_start_after_idle parameter. This vulnerability arises because the parameter can be modified concurrently while it is being read, leading to potential inconsistencies. The issue has been addressed by adding a READ_ONCE() directive to the readers of this parameter.

A data-race vulnerability has been identified in the Linux kernel's TCP implementation, specifically regarding the sysctl_tcp_max_reordering parameter. While this parameter is being read, it can be concurrently modified, leading to potential inconsistencies. To address this issue, the kernel has been updated to include a READ_ONCE() directive for its readers, ensuring a more stable and reliable operation.

An integer overflow vulnerability has been identified in the Linux kernel's GPIO Xilinx implementation. The current version cannot configure more than 32 pins due to an incorrect data type. This issue has been addressed by type casting to unsigned long to prevent the overflow.

A vulnerability in the Linux kernel's BCM2835 SPI driver can lead to a NULL pointer dereference. This issue occurs in versions of the kernel that include the problematic commit, when an IRQ-based transfer times out. The 'bcm2835_spi_handle_err()' function is then called, but if the controller's DMA transmit or receive pointers are not set, it results in a NULL pointer dereference. The vulnerability has been addressed by adding checks to ensure these pointers are valid before they are accessed.

A NULL pointer dereference vulnerability has been identified in the Linux kernel's KVM (Kernel-based Virtual Machine) module. This issue arises during the cleanup of KVM devices, specifically with Book3s's interrupt controller KVM devices, which use the 'release' callback instead of the 'destroy' callback. The error handling in 'kvm_ioctl_create_device()' incorrectly assumes that 'destroy' is always defined, leading to a NULL dereference. This vulnerability was discovered by Syzkaller.

A vulnerability in the Linux kernel's memory policy management has been identified, specifically within the 'mm/mempolicy.c' file. The issue arises when the memory policy mode is set to MPOL_LOCAL, as the corresponding nodemask is not initialized. This uninitialized value is then accessed in the 'mpol_rebind_policy' function, leading to potential undefined behavior. The vulnerability can be reproduced by attaching a task to a cpuset that allows memory migration, which triggers the faulty memory policy handling.

A memory leak vulnerability has been identified in the Linux kernel's crypto component, specifically within the QuickAssist Technology (QAT) RSA implementation. When an RSA key is used in form 2, as defined by PKCS #1 V2.1, certain parts of the private key remain in memory even after the transformation (TFM) is released. This issue arises because the explicit calls to free the buffers in the 'qat_rsa_exit_tfm()' function do not adequately clear all referenced buffers in the TFM context. The vulnerability has been addressed by replacing these explicit free calls with a single call to 'qat_rsa_clear_ctx()', which properly frees all associated buffers.

A vulnerability in the Linux kernel's handling of Intel Last Branch Record (LBR) data has been addressed. The issue arose from an unchecked Model Specific Register (MSR) access error when writing to a specific LBR-related MSR. This error was triggered by a fuzzer, indicating a potential flaw in how the kernel manages LBR data from Intel processors, particularly on systems with certain LBR formats and TSX (Transactional Synchronization Extensions) settings.

A vulnerability in the Linux kernel's crypto subsystem, specifically related to the QuickAssist Technology (QAT) driver, has been addressed. The issue involved a lack of parameter validation for DHReject requests when the source buffer exceeded the key size. This oversight could lead to an integer underflow during the process of copying the source scatterlist into a linear buffer.

A vulnerability in the Linux kernel's Crypto QAT (QuickAssist Technology) component could lead to an integer underflow. This issue arises when RSAReject requests contain a source buffer larger than the key size, allowing for improper copying of the source scatterlist into a linear buffer. The vulnerability has been addressed by adding parameter checks to reject such requests.

A vulnerability in the Linux kernel's KVM component for x86 architecture has been addressed. The issue involved the incorrect handling of guest Page Table Entry (PTE) Access/Dirty bits. Previously, the PTE was mapped into the kernel address space to update these bits, which was conceptually flawed. This approach worked for the original scenario of backing guest memory with /dev/mem' but resulted in accessing arbitrary physical frame numbers in most other VM_PFNMAP cases. The vulnerability has been resolved by using the newly introduced __try_cmpxchg_user() function to update the guest PTE A/D bits more accurately.

A vulnerability in the Linux kernel's netfilter component, specifically within the connection tracking (conntrack) system, has been addressed. The issue arose from a race condition that allowed the conntrack entry to be improperly managed during insertion. When a conntrack entry clashed, the insertion process could inadvertently free the socket buffer's connection tracking pointer and overwrite it with an already confirmed entry. This vulnerability was not detected earlier because the conntrack entry and the associated extension space were freed only after a Read-Copy-Update (RCU) grace period, creating a timing issue that required events to be enabled for exploitation.

A slab-out-of-bounds read vulnerability has been identified in the Linux kernel's exFAT file system implementation. This issue arises in versions of the kernel that include the exFAT file system support. The vulnerability is triggered when the 'exfat_truncate' function is called with a size of zero, leading to a read operation that exceeds the allocated memory buffer. The problem was reported by Syzbot and is related to improper validation of cluster numbers in the exFAT bitmap management functions.

A vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) component for x86 architecture has been identified. This issue arises from an incorrect assumption that userspace cannot induce a triple fault in a nested virtual machine (L2) without going through KVM_RUN, which would normally allow KVM to manage such events properly. The vulnerability can be triggered if userspace sends a machine check while L2 is active and CR4.MCE is disabled. Additionally, a forthcoming change to preserve KVM_REQ_TRIPLE_FAULT during migration could make it easier for userspace to exploit this issue.

A vulnerability in the Linux kernel's netfilter component, specifically in the nf_tables subsystem, has been identified. This issue arises from a double unregistration of hooks in the network namespace path. The vulnerability occurs because the __nft_release_hooks() function is called during the pre_netns exit phase, which first unregisters the hooks. Subsequently, the NETDEV_UNREGISTER event is triggered, causing the hooks to be unregistered again. This flaw can lead to inconsistencies and potential misuse of the netfilter hook management.

A vulnerability in the Linux kernel's KVM module for x86 architecture has been identified, related to the management of the guest Floating Point Unit (FPU) state. The issue arises because KVM sets the user ABI size of the guest FPU to a value that can exceed the historical default, leading to out-of-bounds writes and data corruption. This problem occurs when the guest FPU state is saved for userspace on hosts that do not support XSAVE, such as Core2 CPUs. The out-of-bounds writes are detected by the Kernel Address Sanitizer (KASAN), indicating a memory access violation.

A vulnerability in the Linux kernel's KVM SVM module related to SEV ioctl interfaces can lead to a kernel data leak. This issue arises because the length parameter for some SEV ioctl interfaces may be less than or equal to the maximum size allowed, yet still larger than the data returned by the PSP firmware. As a result, the memory allocated by kmalloc reflects the size of the input rather than the actual data received. Since the PSP firmware does not completely overwrite the allocated buffer, these SEV ioctl interfaces can inadvertently return uninitialized memory from the kernel's slab allocator.

A vulnerability has been identified in the Linux kernel's Bluetooth subsystem, specifically within the hci_qca driver. This issue arises from improper timer management, where a timer can be freed while still active, leading to corruption of the timer list. The problem occurs because the del_timer() function is used instead of del_timer_sync(), creating a risk of freeing a timer that has not been properly deactivated. The vulnerability has been addressed by ensuring that del_timer_sync() is used before freeing the timer, and by rearranging the destruction of the associated work queue to prevent rearming of the timer via the workqueue.

A vulnerability in the Linux kernel's zsmalloc memory management can lead to race conditions between the asynchronous zspage free process and page migration. The issue arises because the zspage free worker attempts to lock a zspage's entire page list without accounting for concurrent page migrations. This can cause the locking function to reference pages that have already migrated away, leading to unsafe dereferencing of page pointers. The vulnerability allows for data races that could be exploited to cause memory corruption.

A vulnerability in the Linux kernel's NTFS3 file system handling has been addressed. The issue arose in the validation of the BOOT sectors' 'sectors_per_cluster' field. When this field exceeded a certain value, it could lead to negative shift values or values larger than the field size, causing a shift-out-of-bounds error. The vulnerability has been resolved by ensuring that the shift value does not exceed a specified limit before it is used, with invalid values now returning an error. This fix prevents potential undefined behavior by addressing the root cause of the shift-out-of-bounds error.

A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) handling has been addressed. The issue arose from the Just-In-Time (JIT) compilation process, where the blinding mechanism did not properly account for certain instructions related to BPF subprograms. This oversight led to a page fault error in kernel mode, as the JIT blinding randomized a special instruction that should have been preserved. The problem occurred because the JIT process missed adjusting these instructions, causing a failure in the second phase of JIT compilation where all subprogram addresses are finalized. The vulnerability could potentially be exploited by manipulating BPF subprogram pointers, leading to a kernel page fault and disruption of normal operations.

A vulnerability in the Linux kernel's ISP1760 USB driver has been identified, involving an out-of-bounds array access. This issue arises because the driver expects certain arrays to be a minimum length, but the arrays in question are dynamically sized during compilation. The vulnerability was detected using the Kernel Address Sanitizer, which reported a global out-of-bounds read by the 'swapper' task.

A memory leak vulnerability has been identified in the Linux kernel's NTFS3 filesystem. The issue arises because the filesystem does not implement the 'invalidate_folio' method. As a result, when data is written to the filesystem and the filesystem is subsequently unmounted, the cached data is not properly freed, leading to a permanent memory leak.

A memory leak vulnerability has been identified in the Linux kernel within the x86/MCE/AMD component. This issue arises in the 'mce_threshold_create_device()' function when 'threshold_create_bank()' fails. The failure prevents the proper deallocation of a previously allocated array, leading to a memory leak. The problem occurs because the cleanup function 'mce_threshold_remove_device()' can only access the pointer through a per-CPU variable after a bank has been successfully created. To address this, a new helper function has been added to properly unwind the bank creation process and free the allocated resources.

A potential array overflow vulnerability has been identified in the Linux kernel's BPF (Berkeley Packet Filter) trampoline handling. The issue arises because the count of attached BPF_TRAMP_MODIFY_RETURN programs is not properly accounted for, allowing the number of these programs to exceed the maximum limit. When this occurs, it can lead to an overflow in the program storage array, as the designated structure can only accommodate a certain number of programs.

A deadlock vulnerability has been identified in the Linux kernel's Btrfs file system, specifically during concurrent direct I/O writes when free data space is low. The issue arises when multiple tasks attempt to write to the same file range without expanding the inode's size, leading to a deadlock situation. This vulnerability can be sporadically triggered by the test case generic/300 from fstests, resulting in tasks being blocked for an extended period.

A memory leak vulnerability has been identified in the Linux kernel's handling of the kexec system call on x86_64 architectures. When the kdump kernel is reloaded or unloaded, a buffer allocated for ELF headers is not properly freed, leading to a memory leak. This issue was detected by the kmemleak memory leak detector, which reported an unreferenced object corresponding to the leaked buffer. The vulnerability arises because the ELF header buffer is incorrectly managed during the kexec file load process, causing memory to remain allocated and unreferenced.

A vulnerability in the Linux kernel's USB audio subsystem for MIDI handling has been addressed. When closing a USB MIDI output substream, there could be pending work that remains, potentially accessing the raw MIDI runtime object that is in the process of being released. This issue created a race condition. The vulnerability has been fixed by ensuring that any pending work is canceled before closing the substream.

A potential NULL pointer dereference vulnerability has been identified in the Linux kernel's ipw2x00 wireless driver. The issue arises in the libipw_xmit() function, where the 'crypt' pointer and its 'ops' member could be NULL. This flaw necessitates a null check before dereferencing to prevent a crash.