CVE Catalog

A refcount leak vulnerability has been identified in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem. The issue arises in the function 'tipc_sk_create()', where a reference count may not be properly managed. This can lead to resource leaks by failing to release allocated resources when 'tipc_sk_insert()' encounters an error.

A memory leak vulnerability has been identified in the Linux kernel's SFP probe function. The issue arises because the function allocates memory using SFP allocation methods but fails to release it when an error occurs. This oversight leads to a memory leak. The vulnerability has been addressed by changing the memory management approach to ensure proper cleanup in case of an error.

A potential NULL pointer dereference vulnerability has been identified in the Linux kernel's pinctrl subsystem for Aspeed devices. The issue arises in the aspeed_pinmux_set_mux() function, where the pdesc variable could be NULL. This could lead to a NULL pointer access by dereferencing pdesc->name. The vulnerability has been addressed by moving the NULL check before the dereference.

A vulnerability in the Linux kernel's ASoC Intel Sound Open Firmware (SOF) component has been addressed. The issue arose during the registration of SoundWire cards, where errors, often due to deferred probes, were not properly managed. This oversight caused the device properties associated with headset codecs to remain, leading to kernel oopses during driver bind and unbind tests. Although the device properties are cleared when the card is removed, this cleanup can be centralized into a helper function to be called in case of registration errors.

A vulnerability in the Linux kernel's Realtek headset codec drivers can lead to NULL pointer dereferences during driver bind/unbind tests. The issue arises in the rt700, rt711, and rt711-sdca codecs, which fail to check if the card is instantiated before performing jack detection. This oversight can cause NULL dereferences, particularly in driver binding and unbinding scenarios.

A vulnerability in the Linux kernel's ASoC RT711-SDCA component can lead to a NULL pointer dereference, causing a kernel panic. This issue arises because the initial settings are applied before the codec probe function assigns the component. If an I/O error occurs during this process, it triggers a NULL pointer dereference. The vulnerability has been addressed by modifying the component's device reference to ensure proper assignment before the initial settings are applied.

A vulnerability in the Linux kernel's handling of power management (PM) usage counts during serial console transitions has been addressed. The issue arises in the univ8250_console_setup() function, which calls serial8250_console_setup() before the device (.dev) is assigned to the uart_port. This sequence prevents the necessary pm_runtime_get_sync() call from being made. When the driver later takes over, univ8250_console_exit() is invoked, but since the usage count is already at zero, it triggers a PM usage count underflow warning. The vulnerability affects the console management of serial ports, particularly with the univ8250 and 8250 drivers.

A vulnerability in the Linux kernel's power supply interpolation functions has been addressed. The issue arises in the 'power_supply_temp2resist_simple' and 'power_supply_ocv2cap_simple' functions, which incorrectly handle boundary conditions. This vulnerability was introduced when the power supply core began using library interpolation. The 'ocv2cap' function improperly sets the 'high' variable, leading to an out-of-bounds read. Additionally, the 'temp2resist' function contains flawed logic that prevents accurate resistance calculations based on temperature data.

A vulnerability in the Linux kernel related to RSB (Return Stack Buffer) underflow and poisoning attacks has been addressed. This issue was particularly relevant for x86 architecture, where the kernel now fills the RSB on vmexit for IBRS (Indirect Branch Restricted Speculation) to prevent such underflow attacks. The vulnerability arose from the need to document and mitigate tribal knowledge about RSB attacks and their implications.

A vulnerability in the Linux kernel's KVM VMX implementation has been addressed, which relates to the Return Stack Buffer (RSB) management during virtual machine transitions. The issue arose because balanced return calls could theoretically be interrupted by a Non-Maskable Interrupt (NMI), potentially causing an RSB underflow before the virtual machine entry (vmenter) process. To mitigate this risk, the vulnerability prevents any return actions, whether balanced or not, between the SPEC_CTRL write and the vmenter, ensuring a more secure transition process.

A refcount leak vulnerability has been identified in the Linux kernel's power/reset component for arm-versatile systems. The issue arises in the 'versatile_reboot_probeof_find_matching_node_and_match()' function, which returns a node pointer with an incremented reference count. The vulnerability can be exploited by failing to release the reference when the node is no longer needed, leading to a memory management issue.

A vulnerability in the Linux kernel's pinctrl subsystem for Ralink devices can lead to a null pointer dereference. This issue arises because the memory allocation function devm_kcalloc can fail, potentially leaving data->domains as a null pointer. If this null pointer is later dereferenced, it can cause a crash. The vulnerability has been addressed by adding a check for null allocations, ensuring that -ENOMEM is returned without manually releasing data if the allocation fails.

A race condition vulnerability has been identified in the Linux kernel's perf subsystem, specifically between the functions perf_event_set_output() and perf_mmap_close(). This vulnerability allows for improper synchronization when managing event output and memory mapping, potentially leading to a denial-of-service condition. The issue arises when one CPU thread closes a memory mapping for a perf event while another thread is in the process of setting the output for a different event. This can cause the second event to become attached to an unmapped resource, leading to an infinite loop in subsequent memory mapping operations.

A vulnerability in the Linux kernel's RDMA/irdma component can lead to a kernel panic. The issue arises when the qos_mutex is held to manage RoCEv2 Queue Pair events, causing a conflict by invoking a sleeping function in an inappropriate context. This problem can be resolved by eliminating the RoCEv2 handling in the 'irdma_cm_teardown_connections' function, which currently relies on the mutex. The RoCEv2 management is unnecessary and potentially harmful, as it can disrupt connection stability during link outages or IP address changes.

A vulnerability in the Linux kernel's igc driver has been addressed by reinstating and properly implementing the IGC_REMOVED logic, which was crucial for handling PCIe bus errors. The absence of this logic led to NULL pointer dereferences when a PCIe link flap occurred, causing various system errors. The vulnerability was present in the initial version of the igc driver code, where the IGC_REMOVED checks were omitted, allowing MMIO reads and writes to be performed blindly after a PCIe error.

A data-race vulnerability has been identified in the Linux kernel's IP forwarding mechanism, specifically regarding the 'sysctl_ip_fwd_use_pmtu' setting. This vulnerability arises because the value can be changed concurrently while it is being read, potentially leading to inconsistent behavior. The issue has been addressed by adding a 'READ_ONCE()' directive to the readers of this sysctl parameter.

A data-race vulnerability has been identified in the Linux kernel's IP forwarding priority management. The issue arises because the sysctl_ip_fwd_update_priority parameter can be changed concurrently while being read, leading to potential inconsistencies. To address this, the kernel has been updated to include a READ_ONCE() directive in the readers of this parameter.

A data-race vulnerability has been identified in the Linux kernel's handling of the sysctl_fwmark_reflect variable. This vulnerability arises because the variable can be modified concurrently while it is being read, creating a potential for inconsistent or unexpected behavior. The issue has been addressed by adding a READ_ONCE() directive to the variable's reader, ensuring that reads are properly synchronized and reducing the risk of concurrent modification issues.

A data-race vulnerability has been identified in the Linux kernel's TCP and DCCP protocols, specifically related to the sysctl_tcp_fwmark_accept variable. While this variable is being read, it can be concurrently modified, leading to potential inconsistencies. The vulnerability has been addressed by adding a READ_ONCE() directive to the variable's reader, ensuring safer access and preventing concurrent modification issues.

A data-race vulnerability has been identified in the Linux kernel's handling of the sysctl_ip_autobind_reuse parameter. This vulnerability arises because the parameter can be changed concurrently while it is being read, leading to potential inconsistencies. The issue has been addressed by adding a READ_ONCE() directive to the parameter's reader, ensuring that changes are properly synchronized.

A data-race vulnerability has been identified in the Linux kernel's TCP implementation, specifically around the sysctl_tcp_l3mdev_accept parameter. This vulnerability arises because the parameter can be modified concurrently while it is being read, leading to potential inconsistencies. To address this issue, the kernel has been updated to include a READ_ONCE() directive for readers of this parameter, ensuring safer access and preventing concurrent modification issues.

A data race vulnerability has been identified in the Linux kernel's TCP implementation, specifically regarding the 'sysctl_tcp_mtu_probing' setting. This vulnerability allows the MTU probing value to be changed concurrently while it is being read, potentially leading to inconsistent behavior. The issue has been addressed by adding a 'READ_ONCE()' directive to the readers of this sysctl parameter.

A data-race vulnerability has been identified in the Linux kernel's TCP implementation, specifically concerning the sysctl_tcp_base_mss parameter. This vulnerability arises because the parameter can be modified concurrently while it is being read, potentially leading to inconsistent or unexpected behavior. To address this issue, the kernel has been updated to include a READ_ONCE() directive for readers of the sysctl_tcp_base_mss, ensuring that reads are not affected by concurrent writes.

A data race vulnerability has been identified in the Linux kernel's TCP implementation, specifically regarding the sysctl_tcp_min_snd_mss parameter. This vulnerability arises because the parameter can be modified concurrently while it is being read, potentially leading to inconsistent or unexpected behavior. The issue has been addressed by adding a READ_ONCE() directive to the readers of this parameter, ensuring that reads are performed safely and consistently.

A data-race vulnerability has been identified in the Linux kernel's TCP implementation, specifically around the sysctl_tcp_probe_threshold parameter. This vulnerability arises because the parameter can be changed concurrently while it is being read, leading to potential inconsistencies. The issue has been addressed by adding a READ_ONCE() directive to the reader of the parameter.

A data-race vulnerability has been identified in the Linux kernel's TCP implementation, specifically regarding the sysctl_tcp_mtu_probe_floor parameter. This vulnerability arises because the parameter can be modified concurrently while it is being read, potentially leading to inconsistent or unexpected behavior. The issue has been addressed by adding a READ_ONCE() directive to the parameter's reader, ensuring that changes are properly synchronized and reducing the risk of concurrent modification issues.

A data-race vulnerability has been identified in the Linux kernel's TCP implementation, specifically around the 'sysctl_tcp_probe_interval' parameter. This vulnerability arises because the parameter can be changed concurrently while it is being read, leading to potential inconsistencies. The issue has been addressed by adding a 'READ_ONCE()' directive to the reader of the parameter, ensuring a more reliable and consistent read operation.

A shift-out-of-bounds vulnerability has been identified in the Linux kernel's STMicroelectronics Ethernet driver, specifically in the DMA queue mapping for the MTL_RXQ_DMA_MAP1. This issue arises when the queue number exceeds 4, leading to an overflow in the left shift operation due to the 32-bit integer variable. The vulnerability can be observed when the kernel is compiled with CONFIG_UBSAN enabled, which triggers a warning about the out-of-bounds shift. The vulnerability has been addressed by correcting the mask calculation for the DMA queue mapping, thereby resolving the overflow issue and the associated warning.

A refcount leak vulnerability has been identified in the Linux kernel's Microchip DSA driver, specifically within the ksz_switch_register() function. The issue arises because the function fails to properly release a reference count for a node obtained from of_get_child_by_name(), leading to a memory management flaw.

A data-race vulnerability has been identified in the Linux kernel's IGMP (Internet Group Management Protocol) handling. The issue arises in the sysctl_igmp_llm_reports variable, which can be modified concurrently while being read. This vulnerability affects multiple versions of the Linux kernel that handle IGMP reports. To address this issue, the READ_ONCE() function needs to be added to the variable's readers, ensuring proper synchronization.

A data-race vulnerability has been identified in the Linux kernel's IGMP (Internet Group Management Protocol) implementation. The issue arises around the sysctl_igmp_qrv variable, which can be modified concurrently while being read. This vulnerability affects several versions of the Linux kernel.

A data-race vulnerability has been identified in the Linux kernel's TCP implementation, specifically concerning the sysctl_tcp_migrate_req parameter. This vulnerability arises because sysctl_tcp_migrate_req can be modified concurrently while it is being read. To address this issue, the kernel has been updated to include a READ_ONCE() directive for readers of this parameter.

A data-race vulnerability has been identified in the Linux kernel's TCP implementation, specifically around the sysctl_tcp_notsent_lowat parameter. This vulnerability arises because the parameter can be changed concurrently while being read, leading to potential inconsistencies. The issue has been addressed by adding a READ_ONCE() directive to the reader of the parameter.

A data race vulnerability has been identified in the Linux kernel's TCP implementation, specifically regarding the sysctl_tcp_fastopen parameter. This vulnerability allows the parameter to be read and modified concurrently, potentially leading to inconsistent behavior. The issue has been addressed by adding a READ_ONCE() directive to the readers of this parameter.

A data race vulnerability has been identified in the Linux kernel's TCP implementation, specifically regarding the sysctl_tcp_fastopen_blackhole_timeout parameter. This vulnerability allows the timeout value to be changed concurrently while it is being read, potentially leading to inconsistent behavior. The issue has been addressed by adding a READ_ONCE() directive to the parameter's readers, ensuring safe access and preventing concurrent modification.

A denial-of-service vulnerability has been identified in the Linux kernel's ixgbe driver. The issue arises when virtual functions (VFs) are disabled while the physical function (PF) driver is handling requests from the VF driver. This improper synchronization can lead to a kernel panic, causing a system crash. The vulnerability is related to the management of SR-IOV (Single Root I/O Virtualization) resources.

A memory leak vulnerability has been identified in the Linux kernel's IAVF driver, specifically in the handling of dummy receive descriptors. When the hardware generates a dummy descriptor, the IAVF driver previously failed to free the associated memory from the prior receive buffer. Although this scenario is rare, it can occur. The vulnerability has been addressed by modifying the IAVF driver to properly manage memory for dummy receive descriptors.

A NULL pointer dereference vulnerability has been identified in the Linux kernel's Distributed Switch Architecture (DSA) component. The issue arises in the 'dsa_port_reset_vlan_filtering' function, where the 'ds' iterator variable overwrites the 'dp' argument. This flaw leads to an invalid dereference in switches with global VLAN filtering enabled, after they have exited a VLAN-aware bridge. The vulnerability has been addressed by introducing a separate iterator variable to prevent the overwrite.

A buffer overflow vulnerability has been identified in the Linux kernel's be2net driver. The issue arises in the 'be_get_module_eeprom' function, which incorrectly assumes that it receives a buffer at least PAGE_DATA_LEN in size, or twice that if the module is SFF8472-compliant. This assumption is not always valid, leading to the potential overflow. The vulnerability can be exploited by manipulating the buffer size expectations during EEPROM module data reads, particularly transceiver data, creating a risk of memory corruption.

A data-race vulnerability has been identified in the Linux kernel's IPv4 handling of multipath routing, specifically around the sysctl_fib_multipath_use_neigh parameter. This vulnerability arises because the parameter can be changed concurrently while it is being read, leading to potential inconsistencies. The issue has been addressed by adding a READ_ONCE() directive to the parameter's reader.

A data race vulnerability has been identified in the Linux kernel's IPv4 handling of the sysctl_fib_multipath_hash_policy. This vulnerability arises because the hash policy can be changed concurrently while it is being read, leading to potential inconsistencies. To address this issue, the kernel has been updated to include a READ_ONCE() directive in the readers of this policy.

A data-race vulnerability has been identified in the Linux kernel, specifically in the handling of sysctl_ip_prot_sock. This vulnerability arises from concurrent access to sysctl_ip_prot_sock, which creates a risk of data-races. To mitigate this issue, it is necessary to implement basic protection for all readers and writers to prevent load/store tearing.

A data-race vulnerability has been identified in the Linux kernel's UDP implementation, specifically around the sysctl_udp_l3mdev_accept parameter. This vulnerability arises because the parameter can be changed concurrently while it is being read, creating a race condition. The issue has been addressed by adding a READ_ONCE() directive to the parameter's reader.

A data race vulnerability has been identified in the Linux kernel's IPv4 handling of the sysctl_fib_multipath_hash_fields. This vulnerability arises because the hash fields can be modified concurrently while being read, leading to potential inconsistencies. The issue has been addressed by adding a READ_ONCE() directive to the readers of this sysctl parameter.

A data-race vulnerability has been identified in the Linux kernel's TCP implementation, specifically regarding the sysctl_tcp_thin_linear_timeouts parameter. While this parameter is being read, it can be concurrently modified, leading to potential inconsistencies. The vulnerability has been addressed by adding a READ_ONCE() directive to the reader.

A vulnerability in the Linux kernel's TCP implementation allows for concurrent modification of the 'sysctl_tcp_recovery' parameter while it is being read. This data race can lead to inconsistent or unexpected behavior. The issue has been addressed by adding a 'READ_ONCE()' directive to the readers of this parameter, ensuring safe access.

A data-race vulnerability has been identified in the Linux kernel's TCP implementation, specifically around the sysctl_tcp_early_retrans parameter. While this parameter is being read, it can be concurrently modified, leading to potential inconsistencies. The vulnerability has been addressed by adding a READ_ONCE() directive to the reader, ensuring a more reliable access pattern.

A data-race vulnerability has been identified in the Linux kernel's TCP implementation, specifically concerning the sysctl_tcp_slow_start_after_idle parameter. This vulnerability arises because the parameter can be modified concurrently while it is being read, leading to potential inconsistencies. The issue has been addressed by adding a READ_ONCE() directive to the readers of this parameter.

A data-race vulnerability has been identified in the Linux kernel's TCP implementation, specifically regarding the sysctl_tcp_max_reordering parameter. While this parameter is being read, it can be concurrently modified, leading to potential inconsistencies. To address this issue, the kernel has been updated to include a READ_ONCE() directive for its readers, ensuring a more stable and reliable operation.

An integer overflow vulnerability has been identified in the Linux kernel's GPIO Xilinx implementation. The current version cannot configure more than 32 pins due to an incorrect data type. This issue has been addressed by type casting to unsigned long to prevent the overflow.