CVE Catalog

A use-after-free vulnerability has been identified in the Linux kernel's workqueue implementation. This issue arises when the rescuer is detached from the pool, leading to a premature release of a reference, which can be exploited. The vulnerability was introduced by a commit that reaped normal workers but failed to properly manage the rescuer, removing the necessary synchronization that prevented the use-after-free condition.

A vulnerability in the Linux kernel's cacheinfo handling for arm64 architecture allows for an out-of-bounds write to the cacheinfo array. The issue arises because the loop responsible for detecting and populating cache information includes a bounds check on the array size but fails to consider cache levels with separate data and instruction caches. This oversight can lead to improper indexing, potentially causing memory corruption.

A vulnerability in the Linux kernel's AMD GPU driver has been addressed. The issue arose in the 'psp_init_cap_microcode()' function, where the code failed to properly handle firmware loading errors. This oversight could lead to invalid memory access.

A vulnerability in the Linux kernel's GPIO (General Purpose Input/Output) subsystem has been addressed. The issue arose in the 'gpiochip_get_ngpios()' function, which used 'chip_*()' macros to print messages. These macros require 'gpiodev' to be initialized, a condition not met when 'bgpio_init()' is called. This mismatch led to a crash due to a NULL pointer dereference. The solution involved replacing the 'chip_*()' macros with the corresponding 'dev_*()' ones to prevent the crash.

A slab-out-of-bounds read vulnerability has been identified in the OrangeFS implementation within the Linux kernel. This issue arises in the 'orangefs_debug_write' function, where improper handling of data can lead to memory access violations.

A vulnerability in the Linux kernel's batman-adv module can lead to a kernel panic during the removal of a network interface. This issue arises because reference counting does not ensure that a hard interface remains linked to a soft interface until all related work is completed. As a result, the hard interface can be freed prematurely, causing a crash. The problem can be exacerbated by delaying the metric work, which allows for more reliable reproduction of the issue.

A buffer overflow vulnerability has been identified in the Linux kernel's AMD GPU driver. The issue arises in the function 'smu_sys_set_pp_table()' when a malicious user provides a small power profile table (pptable) through the sysfs interface, followed by a larger one. This sequence can lead to a buffer overflow attack.

A vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) component for x86 architecture has been addressed. The issue arose from improperly handling Hyper-V's SEND_IPI and SEND_IPI_EX hypercalls when the local APIC (Advanced Programmable Interrupt Controller) was emulated in userspace. This oversight could lead to a NULL-pointer dereference, causing a crash. The vulnerability has been resolved by ensuring that these hypercalls are only accepted when the local APIC is managed by the kernel, thus preventing the NULL-pointer dereference error.

A vulnerability in the Linux kernel's tracing subsystem has been addressed, which involved improper handling of the persistent ring buffer during memory mapping operations. When attempting to map a trace instance buffer linked to reserved memory, the kernel would crash due to an unhandled page fault. This issue arose because the mapping code used a function that does not support virtual memory that has been mapped with 'vmap()', leading to a page fault error. The vulnerability could be triggered by performing a memory map operation on a persistent buffer, which would result in a device not found error, similar to the response when the mmap field is not defined in the file_operations structure.

A vulnerability in the Linux kernel's ring buffer management has been addressed. The issue arose because the validation process for the metadata of a mapped ring buffer did not check for duplicate entries in the subbuffer index array. This array is crucial for creating the ring buffer link list, as it orders the subbuffers and indicates the reader page. The lack of duplicate validation could lead to corruption in the ring buffer link list, potentially causing a kernel crash. Although the corruption from this vulnerability was initially limited to misrepresenting data without crashing the kernel, it highlighted a significant oversight in the validation process.

A vulnerability in the Linux kernel's USB hub driver allows for a general protection fault, likely due to a null pointer dereference. This issue arises when a USB device presents multiple configurations or interfaces, violating the USB specification. The hub driver incorrectly binds to the second interface, leading to a crash when the driver attempts to access a non-existent resource. The vulnerability has been addressed by modifying the driver to reject hub devices that do not comply with the USB spec regarding configurations and interfaces.

A vulnerability in the Linux kernel's ctucanfd component can lead to a NULL pointer dereference. This issue arises when the allocation of a socket buffer (skb) fails, leaving the pointer to the struct can_frame as NULL. While this NULL pointer scenario is addressed in most parts of the ctucan_err_interrupt() function, one location was overlooked, creating a potential vulnerability.

A vulnerability in the Linux kernel's Rockchip CAN driver can lead to a NULL pointer dereference. The issue arises in the 'rkcanfd_handle_rx_fifo_overflow_int()' function, where the code does not properly check if a socket buffer (skb) can be allocated. This oversight can cause the function to attempt to use a NULL pointer, potentially leading to a crash or other unintended behavior.

A NULL pointer dereference vulnerability has been identified in the Linux kernel's etas_es58x driver. The issue arises because the driver incorrectly assumed that the USB serial number would never be NULL. While this assumption holds true for commercially available devices, an attacker could potentially spoof the device identity to provide a NULL serial number, leading to a NULL pointer dereference. The vulnerability has been addressed by adding a check for the serial number before accessing it.

A vulnerability in the Linux kernel's handling of partition tables, specifically for Mac partitions, has been addressed. The issue arose from improper management of partition data, which could lead to accessing out-of-bounds memory. This vulnerability was particularly relevant when the partition table indicated an unrealistic sector size, causing entries to overlap sector boundaries. The fix involved ensuring that the partition table data was correctly validated and that any errors in the partition offset were properly managed.

A vulnerability in the Linux kernel's scheduling system has been addressed. The issue arose in the handling of autogroup migrations, where the function 'scx_move_task()' incorrectly filtered migration events. This mismanagement led to warnings about cgroup attachment, as the system failed to properly recognize certain migration scenarios. The vulnerability has been fixed by modifying the 'sched_move_task()' function to clearly distinguish between cgroup and autogroup migrations, ensuring that 'scx_move_task()' only processes cgroup-related migrations.

A memory leak vulnerability has been identified in the Linux kernel's IOMMU (Input-Output Memory Management Unit) handling. The issue arises in the 'iopf_queue_remove_device()' function, which is responsible for removing a device from the IOMMU queue when the Process Interrupts (PRI) are disabled. While the function correctly responds to outstanding IOPFs (IOMMU Page Faults) by invalidating the response and detaching the device from the queue, it fails to release the associated group structure that tracks pending IOPFs awaiting a response. This oversight can lead to a memory leak if 'iopf_queue_remove_device()' is called while there are outstanding IOPFs. The vulnerability has been addressed by modifying the function to call 'iopf_free_group()' after responding to the hardware, ensuring that the group structure is properly released.

A vulnerability in the Linux kernel's Precision Time Protocol (PTP) implementation related to virtual machine clock management has been addressed. The issue arose because the vmclock_miscdev_fops lacked an owner field, allowing the module to be unloaded while /dev/vmclock0 was in use. This could lead to a system error (oops) by disrupting a live operation.

A vulnerability in the Linux kernel's handling of IPv6 lightweight tunnels can lead to destination reference loops. This issue arises when a lightweight tunnel's destination cache retains a reference to the tunnel itself, preventing the tunnel's state from being properly released. The problem was identified by the 'ioam6.sh' test, which discovered a per-CPU memory leak that could potentially be exploited. While it's unclear if the 'rpl' and 'seg6' tunnels can trigger this vulnerability, the possibility exists.

A vulnerability in the Linux kernel's clocksource handling has been identified, specifically within PREEMPT_RT kernels. The issue arises because the function 'clocksource_verify_choose_cpus()' is called with preemption disabled, leading to the invocation of 'get_random_u32()' in an atomic context. This situation causes a conflict with the local locks used by the random number generator, which are sleeping locks that cannot be held in atomic context. The vulnerability was revealed through a bug report detailing a 'sleeping function called from invalid context' error, triggered by the 'clocksource_watchdog_kthread' process.

A vulnerability in the Linux kernel's IPv4 handling has been addressed. The issue arose because the __ip_rt_update_pmtu()__ function did not use Read-Copy-Update (RCU) protection, potentially allowing the network structure it accessed to be removed prematurely. This could lead to inconsistencies or errors in network packet management.

A vulnerability in the Linux kernel's IPv6 handling has been addressed. The issue arose because the function ip6_default_advmss() lacked proper Read-Copy-Update (RCU) protection, potentially allowing the network structure it accessed to be removed prematurely. This could lead to inconsistent or erroneous behavior in network packet handling.

A vulnerability has been identified in the Linux kernel's handling of the ndisc_alloc_skb() function, which can be called without proper Real-Time Networking Layer (RTNL) or Read-Copy Update (RCU) protections. This oversight may lead to a use-after-free (UAF) condition. The vulnerability has been addressed by adding the necessary RCU protection.

A vulnerability in the Linux kernel's neighbour notification process has been addressed. The issue arose because the __neigh_notify()__ function could be called without proper protection from the RTNL or RCU, potentially leading to a use-after-free condition. The vulnerability has been resolved by implementing RCU protection in the notification process.

A vulnerability in the Linux kernel's ARP (Address Resolution Protocol) handling has been addressed. The issue arose because the 'arp_xmit()' function could be called without proper protection from the RTNL (Routing Netlink) or RCU (Read-Copy-Update) mechanisms. This lack of protection created a potential use-after-free vulnerability. The kernel developers have resolved this issue by implementing the necessary RCU protection in the 'arp_xmit()' function.

A use-after-free vulnerability has been identified in the Linux kernel's Open vSwitch component. The issue arises in the function 'ovs_vport_cmd_fill_info()', which can be called without proper Real-Time Networking Layer (RTNL) or Read-Copy Update (RCU) synchronization. This vulnerability has been addressed by implementing RCU protection and using 'dev_net_rcu()' to prevent potential use-after-free scenarios.

A vulnerability in the Linux kernel's handling of Network Discovery (ndisc) has been addressed. The issue arose because the function ndisc_send_skb() could be called without the appropriate Real-Time Networking Layer (RTNL) or Read-Copy Update (RCU) protections, potentially leading to a use-after-free (UAF) condition. The vulnerability has been resolved by acquiring the RCU read lock earlier, allowing the use of dev_net_rcu() to avoid the UAF risk.

A vulnerability in the Linux kernel's IPv6 multicast handling has been addressed. The issue arose because the 'igmp6_send()' function could be called without the necessary RCU (Read-Copy-Update) or RTNL (Routing Netlink) protections, potentially leading to a use-after-free condition. The vulnerability has been mitigated by extending the RCU protection, allowing for safe retrieval of the net pointer while avoiding the risk of a use-after-free. Additionally, the method of socket allocation was changed to use 'alloc_skb()', as the previous method could not be used safely without risking sleep in the allocation process.

A vulnerability in the Linux kernel's IPv6 multicast handling has been addressed. The issue arose because the function 'mld_newpack()' could be called without the necessary RCU (Read-Copy-Update) or RTNL (Routing Netlink) protections. This vulnerability is present in the IPv6 IGMP (Internet Group Management Protocol) socket handling, which used allocations that could sleep, creating a potential for race conditions. The vulnerability has been resolved by adding RCU protection to 'mld_newpack()' and adjusting the socket allocation method to ensure proper synchronization.

A use-after-free vulnerability has been identified in the Linux kernel's virtual socket (vsock) implementation. This issue arises because socket bindings are not properly managed during transport reassignment, allowing for a use-after-free condition. The vulnerability occurs in the vsock_create function, where the reference count of a socket is improperly handled, leading to a memory safety issue. When the socket is released, it can be accessed after being freed, potentially causing undefined behavior or exploitation.

A vulnerability in the Linux kernel's Btrfs file system has been addressed, related to the management of ordered extents during direct I/O operations. When a transaction abort occurs while writing data, existing ordered extents are marked with an error flag. If the system then attempts to split an ordered extent that still has remaining bytes, it triggers an assertion failure because of the error flag. This issue could lead to a denial-of-service condition by causing the kernel to crash or become unresponsive.

A use-after-free vulnerability has been identified in the Linux kernel's Btrfs file system, specifically in the transaction management process. The issue arises when the system attempts to join a transaction that has been aborted. After unlocking the transaction lock, the system reads the 'aborted' field, creating a window where a concurrent task can free the transaction, leading to a use-after-free condition. This vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's Btrfs file system has been addressed. The issue arose from using the function btrfs_set_item_key_safe() to modify keys in the RAID stripe-tree, which could corrupt the tree. This corruption was detected by Btrfs's internal checks, revealing a kernel bug related to invalid opcode errors. The vulnerability could lead to a critical failure in the file system's RAID management, potentially causing data loss or corruption.

A use-after-free vulnerability has been identified in the Linux kernel's net/mlx5 component. This issue arises during the matcher disconnect process when a firmware failure occurs. The current error handling approach attempts to reconnect the matcher and returns an error, which can lead to a freed matcher remaining on the matchers list. This situation creates a use-after-free condition, causing a crash. The vulnerability also has the potential to disrupt the steering state by incorrectly linking matchers, leading to resource leakage.

A vulnerability in the Linux kernel's brcmfmac Wi-Fi driver can cause system crashes on certain MacBook Pro models. This issue arises when the driver attempts to read a non-existent property, leaving a temporary variable uninitialized. As a result, a random pointer is passed to a memory management function, leading to a page fault and a permissions violation error. The crash occurs in kernel mode, disrupting normal system operations.

A vulnerability in the Linux kernel's handling of the ROSE (Routing Over Serial Lines) protocol has been identified. The issue arises in the rose_bind() function, where the socket is not properly locked. This oversight can lead to a soft lockup, particularly when bind() is called from multiple threads. The vulnerability has been addressed by ensuring that rose_bind() locks the socket to prevent such lockups.

An integer overflow vulnerability has been identified in the Linux kernel's ksmbd component, specifically on 32-bit systems. The issue arises in the ipc_msg_alloc() function, where addition operations can potentially overflow, leading to memory corruption. This vulnerability has been addressed by implementing bounds checking using KSMBD_IPC_MAX_PAYLOAD to prevent such overflow conditions.

A vulnerability in the Linux kernel's ASTDP transmitter has been addressed, which involved a timeout issue when enabling the video signal. The transmitter could take up to one second to activate the signal, while the existing timeout was only 200 milliseconds. This discrepancy led to a kernel error message. The timeout has now been increased to one second. Although the error message indicated a problem, the video signal was still successfully enabled. This issue has been present for some time, but recent versions of the AST driver began to warn about the missing timeout.

A vulnerability in the Linux kernel's synaptics input driver can lead to a crash when enabling a pass-through port. This issue occurs because an interrupt may arrive before the psmouse driver has fully bound to the port. The synaptics sub-driver attempts to access the psmouse instance related to the port to determine whether to forward a single byte or an entire protocol packet. If the psmouse instance is not yet attached, this can result in a crash. The vulnerability affects several versions of the Linux kernel.

A refcount leakage vulnerability has been identified in the Linux kernel's block cgroup implementation. The issue arises in the blkcg_fill_root_iostats() function, which iterates over the devices of a specified block class. This iteration is performed using class_dev_iter_(init|next)() but fails to properly terminate the iteration with class_dev_iter_exit(). As a result, the subsystem reference count for the block class is not correctly managed, leading to a leakage.

A NULL pointer dereference vulnerability has been identified in the Linux kernel's brcmfmac Wi-Fi driver. This issue arises when a device is removed or the kernel module is unloaded, potentially leading to a crash. The vulnerability occurs in the brcmf_txfinalize() function, where the driver attempts to update transmission statistics. If a specific condition is met, the function can receive a NULL pointer, causing a dereference error. While this vulnerability has primarily been observed when updating transmission statistics, it could potentially impact other areas where the pointer is used.

A vulnerability in the Linux kernel's usbnet component, specifically within the ipheth driver, has been addressed. The issue involved a potential overflow in the Data Packet Exchange (DPE) length check. The original implementation could allow an overflow if the sum of the Datagram Index and Datagram Length exceeded the maximum value for a 16-bit unsigned integer. This flaw had the potential to lead to an Out-of-Bounds Read. The vulnerability has been resolved by adjusting the inequality to prevent the overflow, while an existing condition ensures that the Datagram Index remains within the bounds of the actual length of the USB request block.

A vulnerability allowing an out-of-bounds read has been identified in the Linux kernel's usbnet component, specifically within the ipheth driver. The issue arises because the NDP16 header's starting position could be manipulated to extend beyond the intended bounds of the URB, based on the wNdpIndex value in NTH16. This flaw was not fully addressed by a recent commit, which only partially corrected the out-of-bounds read by enforcing a specific NDP16 format and checking URB length. The vulnerability persists because the limit on the number of DPEs has not been separately enforced.

A vulnerability in the Linux kernel's usbnet ipheth component has been addressed, which involved an out-of-bounds read related to Data Path Elements (DPEs). The fix limits the number of processed DPEs to match the capacity of the fixed-size NDP16 header.

A use-after-free vulnerability has been identified in the Linux kernel's UFS (Universal Flash Storage) driver. This issue arises during the initialization error handling process, where the driver's crypto profile cleanup handler is invoked after the associated platform device has been released. The vulnerability occurs because the crypto private data is stored in a structure that is deallocated before the cleanup handler is executed, leading to a use-after-free condition. The problem is exacerbated during the error handling of the UFS platform initialization, where the host structure is released before the platform device can complete its cleanup process.

A buffer overflow vulnerability has been identified in the Linux kernel's libata-sff component. When the SCSI_IOCTL_SEND_COMMAND ioctl is used with specific parameters, it can cause the ata_pio_sector() function to write outside the allocated buffer, overwriting arbitrary memory. This issue arises because an ATA device is expected to abort an ATA_NOP command, but a bug in either libata-sff or QEMU may prevent the status from being correctly set or may clear it before it can be read, allowing the buffer overflow to occur.

A memory leak vulnerability has been identified in the Linux kernel's Ceph file system component. The issue arises in the 'ceph_mds_auth_match()' function, where temporary allocations for target path substrings were not properly freed in all execution branches. This oversight led to a memory leak that could cause the system to crash, particularly under heavy file access. The vulnerability was observed in production environments, where it caused continuous memory consumption, eventually triggering a kernel out-of-memory condition that locked up the system.

An integer overflow vulnerability has been identified in the Linux kernel's nilfs2 file system, specifically within the nilfs_fiemap() function. The issue arises because nilfs_bmap_lookup_contig() in nilfs_fiemap() is designed to potentially process a maximum number of blocks equal to INT_MAX. This could lead to an overflow when the block count is left-shifted. Although such an occurrence is highly unlikely, the vulnerability has been addressed by safely casting the right-hand expression to a wider type. This issue was discovered by the Linux Verification Center using the static analysis tool SVACE.

A vulnerability in the Linux kernel's NFC (Near Field Communication) subsystem has been addressed. The issue arose in the NCI (NFC Controller Interface) component, specifically within the nci_hci_create_pipe() function. The vulnerability was caused by inadequate bounds checking of the 'pipe' variable, which is an 8-bit unsigned integer received from the network. If the value exceeded 127, it could lead to memory corruption in the calling function, nci_hci_connect_gate().

A vulnerability in the Linux kernel's fastrpc driver can cause memory issues by improperly calculating buffer page sizes for non-registered buffers. The driver copies these buffers and sends them to a remote subsystem, but the current implementation fails to account for offsets, potentially leading to out-of-bounds page sizes. This vulnerability has been addressed by adjusting the page size calculation to use offset-adjusted addresses instead of absolute ones.