CVE Catalog

A memory corruption vulnerability has been identified in the Linux kernel's JFFS2 file system, specifically within the rtime decompression routine. The issue arises because the routine fails to properly check bounds during the entire decompression process. As a result, if the compressed data is corrupted, it can lead to memory corruption outside the designated decompression buffer. This vulnerability has been addressed by adding the necessary bounds checks to prevent such memory corruption.

A vulnerability in the Linux kernel's handling of CPU hotplug events in the s390 architecture can lead to a use-after-free condition. When a CPU is removed, the hotplug handler deallocates all sampling data buffers for that CPU. However, if a performance event is still active on the removed CPU, the kernel attempts to read the samples from these buffers, which have already been freed and may have been reassigned. This can result in accessing invalid data, potentially leading to memory corruption.

A vulnerability in the Linux kernel's virtio-net implementation can lead to a buffer overflow in the virtnet_rq_alloc function. This issue arises when the fragment size is one page and the combined size of the buffer and virtnet_rq_dma exceeds one page, causing an overflow. The problem was introduced by a previous commit and has been causing reliable crashes or failures when transferring large files via SCP to a virtual machine, especially when a specific sysctl value is set.

A vulnerability in the Linux kernel's handling of read-ahead operations can cause the system to hang when used with NFS. This issue arises because the read-ahead size can be inadvertently reduced, leading to negative values being passed to the page cache read-ahead function. The problem has been traced back to a specific commit that altered the read-ahead logic, and while reverting this change may decrease read-ahead efficiency, it is preferable to the system hanging entirely.

A vulnerability in the Linux kernel's handling of interrupt request (IRQ) entries on the s390 architecture has been addressed. The issue arose because the .irqentry.text section was empty, preventing proper filtering and de-duplication of stack traces in the stack depot. This lack of filtering could lead to stack depot warnings about reaching limit capacity, especially with certain kernel features enabled. The vulnerability was resolved by moving asynchronous IO/EXT interrupt handlers into the .irqentry.text section, allowing for proper stack trace management while preserving important context for synchronous interrupts.

A vulnerability in the Linux kernel's PCI suspend/resume support on the i.MX6QDL platform has been addressed. This issue, documented in the NXP errata ERR005723, caused the suspend/resume functionality to fail, particularly when a PCIe device was connected. The vulnerability arose because critical registers were modified, disrupting PCIe functionality, and certain drivers, such as ath10k and iwlwifi, would crash upon resuming. The patch resolves these issues by aligning the suspend/resume sequences with those used by other i.MX devices, resetting the connected PCIe device when possible to prevent driver crashes.

A potential deadlock vulnerability has been identified in the Linux kernel's SCSI megaraid_sas driver. This issue arises from a circular locking dependency, where two CPUs can become stuck waiting for each other to release locks, potentially leading to a deadlock situation. The vulnerability has been addressed by modifying the locking mechanism to temporarily release one of the mutexes, preventing the circular dependency.

A vulnerability in the Linux kernel's Btrfs file system has been identified, related to the management of simple quotas. When quotas are enabled, an incompatibility bit should be set before the transaction is committed. However, the current implementation only sets the bit after the transaction, leading to a potential assertion failure. This issue can be reproduced by enabling quotas on a Btrfs file system, unmounting it, and then remounting without committing a new transaction, which causes the missing incompatibility bit to trigger an assertion error.

A vulnerability in the Linux kernel's ASoC SOF Intel HDA-DAI component allows for improper management of link DMA channels. When a stream is stopped, the link DMA should not be released, as this can create a window for other streams to interfere and 'steal' the link DMA, leading to mixed-up channels. This mismanagement can cause firmware errors or crashes. While the issue is not commonly reproducible under normal conditions, it can occur if another stream is initiated between the stop and restart of a stream, mixing up the link DMA channels and causing errors.

A vulnerability in the Linux kernel's SCSI MPI3MR driver has been addressed, which involved corruption of configuration pages related to SAS I/O units and SAS expanders. This issue arose when multiple PHYs were rapidly disabled and enabled, leading to a corruption of the persistent and current configuration pages. The vulnerability was caused by the driver, through the SAS transport, exposing a sysfs interface that allowed for quick toggling of PHY states in a controller/expander setup. The solution involves using separate memory for each configuration request to prevent such corruption.

A vulnerability in the Linux kernel's ALSA subsystem has been addressed. The issue arose because the snd_hda_intel device driver did not properly check for errors when mapping DMA addresses, which can lead to potential memory management issues. This vulnerability was highlighted by a warning generated with CONFIG_DMA_API_DEBUG enabled, indicating that the driver failed to verify the mapping of a specific device address before using it. The warning pointed to a violation of recommended practices in DMA address handling, which could result in improper memory access or resource management.

A vulnerability in the Linux kernel's handling of the Rockchip HDMI PHY can lead to a NULL pointer dereference. This issue arises because the function rk_hdptx_phy_runtime_resume() may be called before the platform_set_drvdata() function has a chance to execute during the probe phase. As a result, when dev_get_drvdata() is called, it returns a NULL value, causing a dereference error. The vulnerability has been addressed by ensuring that platform_set_drvdata() is invoked before devm_pm_runtime_enable().

A vulnerability in the Linux kernel's handling of DisplayPort Multi-Stream Transport (MST) can lead to a NULL dereference and use-after-free condition. This issue arises in the DRM (Direct Rendering Manager) when an MST 'up' request is processed. If the MST topology is modified concurrently by another thread, the primary MST pointer can be freed and set to NULL. This creates a race condition where the 'up' request handler attempts to use the now-invalid pointer, leading to a crash or potential exploitation.

A vulnerability in the Linux kernel's handling of decrypted memory in TDX guest virtual machines has been addressed. In CoCo VMs, an untrusted host can cause the 'set_memory_decrypted()' function to fail, leading to a leak of decrypted memory that is shared. This situation arises because the error is not properly managed, allowing decrypted memory to be returned to the page allocator, potentially causing functional or security problems. The vulnerability involves leaking decrypted memory when 'set_memory_decrypted()' fails, without printing an error, since 'set_memory_decrypted()' will already call 'WARN_ONCE()'.

A vulnerability in the Linux kernel's power supply GPIO charger component allows for improper handling of charge current limits. This issue affects devices that can set the lowest charge current limit above zero. When a requested charge current limit falls below this minimum, the system erroneously accesses memory beyond what has been allocated, potentially leading to memory corruption.

A vulnerability in the Linux kernel's implementation of the SMC (Shared Memory Communication) protocol can lead to a deadlock condition. This issue arises because the length of messages received over the network can be manipulated, allowing values to exceed the buffer length expected by the kernel. When this happens, the kernel may enter a dead loop while trying to process the excess data, effectively causing a denial-of-service condition. The vulnerability has been addressed by adding a check on the return value of the message-receiving function, preventing the deadlock scenario.

A race condition vulnerability has been identified in the Linux kernel's Ethernet OA_TC6 component, specifically related to the management of transmission socket buffers (SKBs) between two pointers: 'waiting_tx_skb' and 'ongoing_tx_skb'. This vulnerability arises from the concurrent handling of SKBs in different threads without proper synchronization. When the 'ongoing_tx_skb' is processed, the next SKB is moved from 'waiting_tx_skb' to 'ongoing_tx_skb' without checking if 'waiting_tx_skb' is NULL. This oversight can lead to one SKB being left unprocessed, causing packet loss and a memory leak.

A denial-of-service vulnerability has been identified in the Linux kernel's tun driver. The issue arises in version 6.13.0-rc1 due to a flaw in the 'tun_napi_alloc_frags' function, where the implementation incorrectly processes I/O vector components. This oversight leads to the creation of a malformed socket buffer, causing a kernel crash. The vulnerability was reported by syzbot, a tool that detects bugs in the Linux kernel.

A vulnerability in the Linux kernel's Direct Rendering Manager (DRM) module has been addressed. The issue was a divide-by-zero vulnerability in the drm_mode_vrefresh() function, which calculates the vertical refresh rate of a display mode. The function attempted to prevent division by zero by checking if the horizontal or vertical total values were zero. However, this check was insufficient, leading to a potential divide-by-zero error when the total values were manipulated.

A vulnerability in the Linux kernel's handling of the ring buffer can lead to a slab-out-of-bounds memory access, causing memory corruption. This issue arises from an overflow in the calculation of the number of pages, which fails to account for certain conditions, allowing for improper memory access. The vulnerability has been reported in version 6.13.0-rc2.

A vulnerability in the Linux kernel's Hyper-V utility driver can lead to a NULL pointer dereference, causing a kernel panic. This issue occurs if the KVP (Key-Value Pair) or VSS (Volume Shadow Copy Service) daemon starts before the VMBus channel's ringbuffer is fully initialized. The problem arises because the KVP/VSS channel callback can be invoked prematurely, leading to the panic. The vulnerability affects Linux kernel versions through 6.11.0-rc3.

A vulnerability in the Linux kernel's KVM component for x86 architecture has been addressed. The issue arose in the 'complete_hypercall_exit()' function, where the wrong method was used to determine if a hypercall was made in 64-bit mode. This misstep could lead to improper handling of hypercalls for guests in a protected state, such as those using SEV-ES or SEV-SNP, where the necessary vCPU state information is unavailable. The vulnerability was exposed by modifying a self-test to generate a specific hypercall, which triggered a warning about the improper hypercall exit handling.

A potential deadlock vulnerability has been identified in the Linux kernel's handling of zoned block device writes. The issue arises during the error recovery process for zone write plugging, which is designed to manage writes to specific zones by ensuring the correct tracking of write pointers. When a write operation fails, the system schedules a zone report to correct the tracking. However, if a device queue freeze is initiated while write operations are still plugged and one fails, the reporting process can block, leading to a deadlock. This occurs because the plugged write operations hold a reference that prevents the queue freeze from completing, causing a standstill in processing the plugged writes.

A vulnerability in the Linux kernel's XFS filesystem has been identified, related to improper quota management during error handling. When a link operation fails due to metadata I/O errors, the system attempts to unmount the filesystem but gets stuck because it fails to unlock the inodes that were being processed. This issue can lead to a system hang, requiring manual intervention to resolve.

A use-after-put vulnerability has been identified in the Linux kernel's handling of device tree nodes within the Renesas rswitch driver. The issue arises because the device tree node referenced in the rswitch_device structure is utilized in multiple locations throughout the driver. Incorrectly, the node is released with of_node_put() after its initial use, which can lead to a use-after-free condition. This vulnerability has been addressed by relocating the of_node_put() call to the appropriate exit paths, ensuring that the device tree node is properly managed without introducing a use-after-free risk.

A potential ABBA deadlock vulnerability has been identified in the Linux kernel's netfilter idletimer component. This issue arises when the last rule referencing a specific idletimer is deleted simultaneously with a read operation from its sysfs file. The conflict creates a circular locking dependency, as one task attempts to acquire a lock that another task is already holding, leading to a deadlock situation.

A vulnerability in the Linux kernel's Bluetooth implementation has been addressed, specifically within the ISO (synchronous) protocol handling. The issue involved a circular locking dependency that could lead to a deadlock. This vulnerability was present in version 6.12.0-rc6 and possibly other versions. The problem arose because the socket lock was acquired before the ISO listening function was called, creating a scenario where two locks were held simultaneously, potentially causing a deadlock. The vulnerability has been resolved by releasing the socket lock prior to entering the ISO listening function, thereby preventing any conflict with the device lock.

A vulnerability causing a general protection fault has been identified and fixed in the Linux kernel's IVPU (Intelligent Video Processing Unit) acceleration module. The issue arose in the 'ivpu_bo_list()' function, where the context ('ctx') was accessed without proper null-checking, leading to potential memory access violations.

A vulnerability in the Linux kernel's IVPU acceleration component has been addressed. The issue was related to the improper management of the runtime power state in the IPC (Inter-Process Communication) send-receive function. The vulnerability arose because the IPC function could be executed before the power management was correctly initialized, leading to potential warnings or errors. The fix involved moving the power management initialization to ensure the IPC function operates with the correct runtime state, even if the last resume operation was unsuccessful.

A vulnerability in the Linux kernel's Bluetooth implementation has been addressed, specifically related to circular locking dependencies in ISO connection synchronization. The issue arose because the socket lock was not released before calling a function that required locking the hardware device lock, leading to potential deadlocks. This vulnerability was present in Linux kernel versions through 6.12.0-rc6.

A vulnerability in the Linux kernel's nilfs2 file system has been identified, related to improper handling of inode management during directory removal operations. The issue arises when the inode bitmap becomes corrupted, leading to an incorrect reassignment of inode numbers. This corruption causes an inode duplication, triggering a warning during the removal of directories. The vulnerability allows for the exploitation of inode link count management, potentially leading to unintended file system behavior.

A vulnerability in the Linux kernel's handling of Inter-Processor Interrupts (IPIs) during memory protection operations has been identified. This issue arises in the RISC-V architecture when the 'flush_tlb_kernel_range()' function uses IPIs to clear the Translation Lookaside Buffers (TLBs) of all cores. Such a broadcast can trigger a warning if interrupts are disabled, indicating a potential mishandling of CPU communication. The vulnerability is linked to the 'KFENCE' memory safety feature, which aims to protect against memory corruption errors.

A denial-of-service vulnerability has been identified in the Linux kernel's Ceph component. The issue arises in the function 'ceph_mdsc_build_path()', which can enter an infinite loop if the generated path exceeds the maximum allowed length. This endless retry process effectively freezes the entire task, rendering most of the machine unusable.

A vulnerability in the Linux kernel's handling of the AXP717 regulator's ramp delay has been addressed. The issue arose because the AXP717 datasheet specifies a ramp delay of 15.625 microseconds per step, equivalent to 10mV in this context. The vulnerability was related to improper management of the ramp delay, particularly for DCDC4, where the steps should be 100mV. This mismanagement could lead to crashes when using CPU Dynamic Voltage and Frequency Scaling (DVFS). The vulnerability has been resolved by adding specific macros to correctly define and manage the ramp delay, thereby preventing the crashes associated with CPU DVFS.

A vulnerability in the Linux kernel's IP Virtual Server (IPVS) module has been identified, stemming from uninitialized stack access in the function 'ip_vs_protocol_init()'. This issue arises under certain kernel configurations when the kernel is built with Clang/LLVM. The compiler fails to generate a proper return or jump instruction for 'ip_vs_protocol_init()', causing a build-time warning from objtool' that the function falls through to the next one without a proper termination. At runtime, this flaw can lead to a system crash when loading the IPVS module, or a boot-time panic if the module is built into the kernel.

A vulnerability in the Linux kernel's igb driver can lead to invalid memory access. This issue arises in the igb_init_module() function, where the pci_register_driver() call can fail. If this happens, the dca_notifier needs to be unregistered; otherwise, the dca_notifier may be called despite igb failing to install, resulting in the invalid memory access.

A vulnerability in the Linux kernel's handling of huge pages can lead to memory corruption or information leaks. The issue arises in the hugetlb_no_page() function, which calls folio_zero_user() with a fault address that may not be properly aligned with the huge page size. This misalignment can cause clear_gigantic_page() to receive an address that violates its alignment requirements. The vulnerability has been addressed by ensuring that the fault address is aligned with the huge page size and by renaming the address parameter for clarity.

A vulnerability in the Linux kernel's handling of huge pages can lead to memory corruption or information leaks. The issue arises in the 'copy_user_gigantic_page()' function, which requires addresses to be aligned with huge page sizes. However, the 'hugetlb_wp()' function currently passes fault addresses that may not be properly aligned. This misalignment can cause 'copy_user_large_folio()' to call 'copy_user_gigantic_page()' with an incorrect address, potentially leading to the mentioned consequences.

A use-after-free vulnerability has been identified in the Linux kernel's SPI MPC52XX module. This issue arises when the module is removed, as it frees a work structure through 'spi_unregister_controller' while the work is still pending, leading to a potential use-after-free condition. The vulnerability has been addressed by ensuring that the work is canceled before the module cleanup process begins.

A vulnerability in the Linux kernel's scheduling component has been addressed. The issue arose when the NEXT_BUDDY feature was enabled, causing an immediate warning in the pick_next_entity function. This warning was triggered because the clear_buddies function was not properly timed, allowing some next buddies to become delayed. The vulnerability has been fixed by repositioning the clear_buddies function to ensure that no next buddy remains delayed and that no new next buddy starts off as delayed.

A vulnerability exists in the Linux kernel's SMC (Shared Memory Communication) implementation, specifically in how proposal messages from remote clients are processed. The vulnerability arises because the 'iparea_offset' and 'ipv6_prefixes_cnt' fields in the proposal messages are not fully trusted. If the 'iparea_offset' exceeds a certain limit, it could lead to accessing incorrect memory addresses, potentially causing a crash. This issue has been addressed by adding checks for 'iparea_offset' and 'ipv6_prefixes_cnt' before they are used.

A vulnerability in the Linux kernel's NVMe over RDMA implementation can cause the kernel to hang when destroying an administrative queue. This issue arises because the administrative queue is quiesced before pending requests are drained, leading to a deadlock. The problem occurs during the cleanup process when the controller setup fails, leaving the queue in a state that prevents proper termination.

A vulnerability has been identified in the Linux kernel's net/smc component, where the server improperly trusts certain fields in proposal messages received from remote clients. Specifically, the v2_ext_offset, eid_cnt, and ism_gid_cnt fields can be manipulated, potentially leading to access violations and crashes. The issue arises because the v2_ext_offset field, if exceeding a maximum value, can cause the kernel to read from incorrect memory addresses. This vulnerability has been addressed by implementing checks on these fields before they are processed.

A NULL pointer dereference vulnerability has been identified in the Linux kernel's bcache implementation. This issue arises in the 'cache_set_flush()' function, where a check for NULL pointers was improperly handled. The vulnerability occurs because the 'c->root' pointer can be NULL if the registration process fails before the pointer is allocated. Although the '__bch_btree_node_alloc()' function is designed to prevent NULL returns, the initialization of 'c->root' leaves it vulnerable under certain conditions. The problem was introduced by a commit that removed necessary NULL checks in node allocations.

A vulnerability in the Linux kernel's stack depot management could lead to a deadlock when handling Non-Maskable Interrupts (NMI). The issue arises in the 'stack_depot_save_flags()' function, which was intended to be used in NMI context without the 'STACK_DEPOT_FLAG_CAN_ALLOC' flag. However, the function still attempted to acquire the 'pool_lock' to save a stack trace, potentially causing a deadlock if an NMI occurred while the lock was held. The vulnerability has been addressed by modifying the function to only attempt to acquire the lock in NMI context and to relinquish the effort if unsuccessful. Additionally, the documentation has been updated for clarity.

A vulnerability in the Linux kernel's Btrfs file system has been identified, related to the device replacement feature. When the RAID stripe-tree is used, a potential deadlock can occur. This happens because the device replacement process tries to acquire a lock that is already held by the same task, leading to a recursive locking scenario. The issue has been observed in Linux kernel version 6.11.0-rc3.

A vulnerability in the Linux kernel's rtw89 WiFi driver could lead to a NULL pointer dereference. The issue arises because the return value of the ieee80211_probereq_get() function might be NULL. If this NULL value is not properly checked before use, it can result in a NULL pointer access, potentially causing a system crash or other unintended behavior.

A null pointer dereference vulnerability has been identified in the Linux kernel's Distributed Lock Manager (DLM) component. This issue arises because the lock key's resource is not assigned when the request_lock() function is called, leading to a potential dereference of a null value. Although this situation is unlikely to occur under normal DLM operations without debug logging, the vulnerability could be exploited if a newly created lock key does not have an assigned resource. Additionally, the resource name could contain non-printable byte arrays, making it unsafe to assume it is ASCII-coded.

A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) implementation can lead to a potential infinite loop when using a combination of tail calls and the 'freplace' feature. This issue arises because the 'freplace' program can reset the tail call count, causing the tail call mechanism to loop indefinitely between certain entry points. The infinite loop can eventually result in a kernel panic.

A vulnerability has been identified in the Linux kernel's net/smc component, where the smcd_v2_ext_offset field in proposal messages received from remote clients is not fully trustworthy. If this offset exceeds a certain maximum value, it could lead to accessing incorrect memory addresses, potentially causing a crash. The vulnerability has been addressed by implementing a check on the smcd_v2_ext_offset value before it is used.