CVE Catalog

A vulnerability in the Linux kernel's Direct Rendering Manager (DRM) module has been addressed. The issue was a divide-by-zero vulnerability in the drm_mode_vrefresh() function, which calculates the vertical refresh rate of a display mode. The function attempted to prevent division by zero by checking if the horizontal or vertical total values were zero. However, this check was insufficient, leading to a potential divide-by-zero error when the total values were manipulated.

A vulnerability in the Linux kernel's handling of the ring buffer can lead to a slab-out-of-bounds memory access, causing memory corruption. This issue arises from an overflow in the calculation of the number of pages, which fails to account for certain conditions, allowing for improper memory access. The vulnerability has been reported in version 6.13.0-rc2.

A vulnerability in the Linux kernel's Hyper-V utility driver can lead to a NULL pointer dereference, causing a kernel panic. This issue occurs if the KVP (Key-Value Pair) or VSS (Volume Shadow Copy Service) daemon starts before the VMBus channel's ringbuffer is fully initialized. The problem arises because the KVP/VSS channel callback can be invoked prematurely, leading to the panic. The vulnerability affects Linux kernel versions through 6.11.0-rc3.

A vulnerability in the Linux kernel's KVM component for x86 architecture has been addressed. The issue arose in the 'complete_hypercall_exit()' function, where the wrong method was used to determine if a hypercall was made in 64-bit mode. This misstep could lead to improper handling of hypercalls for guests in a protected state, such as those using SEV-ES or SEV-SNP, where the necessary vCPU state information is unavailable. The vulnerability was exposed by modifying a self-test to generate a specific hypercall, which triggered a warning about the improper hypercall exit handling.

A potential deadlock vulnerability has been identified in the Linux kernel's handling of zoned block device writes. The issue arises during the error recovery process for zone write plugging, which is designed to manage writes to specific zones by ensuring the correct tracking of write pointers. When a write operation fails, the system schedules a zone report to correct the tracking. However, if a device queue freeze is initiated while write operations are still plugged and one fails, the reporting process can block, leading to a deadlock. This occurs because the plugged write operations hold a reference that prevents the queue freeze from completing, causing a standstill in processing the plugged writes.

A vulnerability in the Linux kernel's XFS filesystem has been identified, related to improper quota management during error handling. When a link operation fails due to metadata I/O errors, the system attempts to unmount the filesystem but gets stuck because it fails to unlock the inodes that were being processed. This issue can lead to a system hang, requiring manual intervention to resolve.

A use-after-put vulnerability has been identified in the Linux kernel's handling of device tree nodes within the Renesas rswitch driver. The issue arises because the device tree node referenced in the rswitch_device structure is utilized in multiple locations throughout the driver. Incorrectly, the node is released with of_node_put() after its initial use, which can lead to a use-after-free condition. This vulnerability has been addressed by relocating the of_node_put() call to the appropriate exit paths, ensuring that the device tree node is properly managed without introducing a use-after-free risk.

A potential ABBA deadlock vulnerability has been identified in the Linux kernel's netfilter idletimer component. This issue arises when the last rule referencing a specific idletimer is deleted simultaneously with a read operation from its sysfs file. The conflict creates a circular locking dependency, as one task attempts to acquire a lock that another task is already holding, leading to a deadlock situation.

A vulnerability in the Linux kernel's Bluetooth implementation has been addressed, specifically within the ISO (synchronous) protocol handling. The issue involved a circular locking dependency that could lead to a deadlock. This vulnerability was present in version 6.12.0-rc6 and possibly other versions. The problem arose because the socket lock was acquired before the ISO listening function was called, creating a scenario where two locks were held simultaneously, potentially causing a deadlock. The vulnerability has been resolved by releasing the socket lock prior to entering the ISO listening function, thereby preventing any conflict with the device lock.

A vulnerability causing a general protection fault has been identified and fixed in the Linux kernel's IVPU (Intelligent Video Processing Unit) acceleration module. The issue arose in the 'ivpu_bo_list()' function, where the context ('ctx') was accessed without proper null-checking, leading to potential memory access violations.

A vulnerability in the Linux kernel's IVPU acceleration component has been addressed. The issue was related to the improper management of the runtime power state in the IPC (Inter-Process Communication) send-receive function. The vulnerability arose because the IPC function could be executed before the power management was correctly initialized, leading to potential warnings or errors. The fix involved moving the power management initialization to ensure the IPC function operates with the correct runtime state, even if the last resume operation was unsuccessful.

A vulnerability in the Linux kernel's Bluetooth implementation has been addressed, specifically related to circular locking dependencies in ISO connection synchronization. The issue arose because the socket lock was not released before calling a function that required locking the hardware device lock, leading to potential deadlocks. This vulnerability was present in Linux kernel versions through 6.12.0-rc6.

A vulnerability in the Linux kernel's nilfs2 file system has been identified, related to improper handling of inode management during directory removal operations. The issue arises when the inode bitmap becomes corrupted, leading to an incorrect reassignment of inode numbers. This corruption causes an inode duplication, triggering a warning during the removal of directories. The vulnerability allows for the exploitation of inode link count management, potentially leading to unintended file system behavior.

A vulnerability in the Linux kernel's handling of Inter-Processor Interrupts (IPIs) during memory protection operations has been identified. This issue arises in the RISC-V architecture when the 'flush_tlb_kernel_range()' function uses IPIs to clear the Translation Lookaside Buffers (TLBs) of all cores. Such a broadcast can trigger a warning if interrupts are disabled, indicating a potential mishandling of CPU communication. The vulnerability is linked to the 'KFENCE' memory safety feature, which aims to protect against memory corruption errors.

A denial-of-service vulnerability has been identified in the Linux kernel's Ceph component. The issue arises in the function 'ceph_mdsc_build_path()', which can enter an infinite loop if the generated path exceeds the maximum allowed length. This endless retry process effectively freezes the entire task, rendering most of the machine unusable.

A vulnerability in the Linux kernel's handling of the AXP717 regulator's ramp delay has been addressed. The issue arose because the AXP717 datasheet specifies a ramp delay of 15.625 microseconds per step, equivalent to 10mV in this context. The vulnerability was related to improper management of the ramp delay, particularly for DCDC4, where the steps should be 100mV. This mismanagement could lead to crashes when using CPU Dynamic Voltage and Frequency Scaling (DVFS). The vulnerability has been resolved by adding specific macros to correctly define and manage the ramp delay, thereby preventing the crashes associated with CPU DVFS.

A vulnerability in the Linux kernel's IP Virtual Server (IPVS) module has been identified, stemming from uninitialized stack access in the function 'ip_vs_protocol_init()'. This issue arises under certain kernel configurations when the kernel is built with Clang/LLVM. The compiler fails to generate a proper return or jump instruction for 'ip_vs_protocol_init()', causing a build-time warning from objtool' that the function falls through to the next one without a proper termination. At runtime, this flaw can lead to a system crash when loading the IPVS module, or a boot-time panic if the module is built into the kernel.

A vulnerability in the Linux kernel's igb driver can lead to invalid memory access. This issue arises in the igb_init_module() function, where the pci_register_driver() call can fail. If this happens, the dca_notifier needs to be unregistered; otherwise, the dca_notifier may be called despite igb failing to install, resulting in the invalid memory access.

A vulnerability in the Linux kernel's handling of huge pages can lead to memory corruption or information leaks. The issue arises in the hugetlb_no_page() function, which calls folio_zero_user() with a fault address that may not be properly aligned with the huge page size. This misalignment can cause clear_gigantic_page() to receive an address that violates its alignment requirements. The vulnerability has been addressed by ensuring that the fault address is aligned with the huge page size and by renaming the address parameter for clarity.

A vulnerability in the Linux kernel's handling of huge pages can lead to memory corruption or information leaks. The issue arises in the 'copy_user_gigantic_page()' function, which requires addresses to be aligned with huge page sizes. However, the 'hugetlb_wp()' function currently passes fault addresses that may not be properly aligned. This misalignment can cause 'copy_user_large_folio()' to call 'copy_user_gigantic_page()' with an incorrect address, potentially leading to the mentioned consequences.

A use-after-free vulnerability has been identified in the Linux kernel's SPI MPC52XX module. This issue arises when the module is removed, as it frees a work structure through 'spi_unregister_controller' while the work is still pending, leading to a potential use-after-free condition. The vulnerability has been addressed by ensuring that the work is canceled before the module cleanup process begins.

A vulnerability in the Linux kernel's scheduling component has been addressed. The issue arose when the NEXT_BUDDY feature was enabled, causing an immediate warning in the pick_next_entity function. This warning was triggered because the clear_buddies function was not properly timed, allowing some next buddies to become delayed. The vulnerability has been fixed by repositioning the clear_buddies function to ensure that no next buddy remains delayed and that no new next buddy starts off as delayed.

A vulnerability exists in the Linux kernel's SMC (Shared Memory Communication) implementation, specifically in how proposal messages from remote clients are processed. The vulnerability arises because the 'iparea_offset' and 'ipv6_prefixes_cnt' fields in the proposal messages are not fully trusted. If the 'iparea_offset' exceeds a certain limit, it could lead to accessing incorrect memory addresses, potentially causing a crash. This issue has been addressed by adding checks for 'iparea_offset' and 'ipv6_prefixes_cnt' before they are used.

A vulnerability in the Linux kernel's NVMe over RDMA implementation can cause the kernel to hang when destroying an administrative queue. This issue arises because the administrative queue is quiesced before pending requests are drained, leading to a deadlock. The problem occurs during the cleanup process when the controller setup fails, leaving the queue in a state that prevents proper termination.

A vulnerability has been identified in the Linux kernel's net/smc component, where the server improperly trusts certain fields in proposal messages received from remote clients. Specifically, the v2_ext_offset, eid_cnt, and ism_gid_cnt fields can be manipulated, potentially leading to access violations and crashes. The issue arises because the v2_ext_offset field, if exceeding a maximum value, can cause the kernel to read from incorrect memory addresses. This vulnerability has been addressed by implementing checks on these fields before they are processed.

A NULL pointer dereference vulnerability has been identified in the Linux kernel's bcache implementation. This issue arises in the 'cache_set_flush()' function, where a check for NULL pointers was improperly handled. The vulnerability occurs because the 'c->root' pointer can be NULL if the registration process fails before the pointer is allocated. Although the '__bch_btree_node_alloc()' function is designed to prevent NULL returns, the initialization of 'c->root' leaves it vulnerable under certain conditions. The problem was introduced by a commit that removed necessary NULL checks in node allocations.

A vulnerability in the Linux kernel's stack depot management could lead to a deadlock when handling Non-Maskable Interrupts (NMI). The issue arises in the 'stack_depot_save_flags()' function, which was intended to be used in NMI context without the 'STACK_DEPOT_FLAG_CAN_ALLOC' flag. However, the function still attempted to acquire the 'pool_lock' to save a stack trace, potentially causing a deadlock if an NMI occurred while the lock was held. The vulnerability has been addressed by modifying the function to only attempt to acquire the lock in NMI context and to relinquish the effort if unsuccessful. Additionally, the documentation has been updated for clarity.

A vulnerability in the Linux kernel's Btrfs file system has been identified, related to the device replacement feature. When the RAID stripe-tree is used, a potential deadlock can occur. This happens because the device replacement process tries to acquire a lock that is already held by the same task, leading to a recursive locking scenario. The issue has been observed in Linux kernel version 6.11.0-rc3.

A vulnerability in the Linux kernel's rtw89 WiFi driver could lead to a NULL pointer dereference. The issue arises because the return value of the ieee80211_probereq_get() function might be NULL. If this NULL value is not properly checked before use, it can result in a NULL pointer access, potentially causing a system crash or other unintended behavior.

A null pointer dereference vulnerability has been identified in the Linux kernel's Distributed Lock Manager (DLM) component. This issue arises because the lock key's resource is not assigned when the request_lock() function is called, leading to a potential dereference of a null value. Although this situation is unlikely to occur under normal DLM operations without debug logging, the vulnerability could be exploited if a newly created lock key does not have an assigned resource. Additionally, the resource name could contain non-printable byte arrays, making it unsafe to assume it is ASCII-coded.

A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) implementation can lead to a potential infinite loop when using a combination of tail calls and the 'freplace' feature. This issue arises because the 'freplace' program can reset the tail call count, causing the tail call mechanism to loop indefinitely between certain entry points. The infinite loop can eventually result in a kernel panic.

A vulnerability has been identified in the Linux kernel's net/smc component, where the smcd_v2_ext_offset field in proposal messages received from remote clients is not fully trustworthy. If this offset exceeds a certain maximum value, it could lead to accessing incorrect memory addresses, potentially causing a crash. The vulnerability has been addressed by implementing a check on the smcd_v2_ext_offset value before it is used.

A potential deadlock vulnerability has been identified in the Linux kernel's DMA debug API, specifically within the handling of the radix tree. The issue arises when the radix lock is held while also managing DMA hash entries, creating a scenario where two CPUs can block each other. This deadlock can occur during certain synchronization operations or while interacting with performance events on ARM Cortex hardware tracing drivers.

A vulnerability in the Linux kernel's pinmux handling can lead to a NULL pointer dereference. This issue arises when two clients of the same GPIO call pinctrl_select_state() for the same functionality. Process A may update the pin's mux_usecount but not the mux_owner, allowing process B to see the updated usecount and attempt to access the mux_owner, resulting in a crash. The vulnerability can be exploited by serializing access to mux-related settings with a mutex lock.

A vulnerability in the Linux kernel's AMDGPU graphics driver has been addressed. The issue arose from improper handling of the scheduling job structure, which could lead to system crashes. When a command stream (CS) failed validation, the job's scheduling information was incorrectly managed, causing a crash by referencing an invalid ring value. This vulnerability has been fixed by ensuring that a null pointer is passed to the function that frees the command buffer, preventing the system from crashing. The next update will remove the ring parameter entirely.

A vulnerability in the Linux kernel's handling of the MIPI I3C bus in DMA mode can lead to a NULL pointer dereference. This issue arises when the bus cleanup process triggers a RING_OP_STAT interrupt while the ring is being stopped. If the interrupt handler executes after the io_data pointer has been nullified, it can cause a crash in the hci_dma_irq_handler(). The vulnerability has been addressed by masking the ring interrupts before initiating the ring stop request.

A deadlock vulnerability has been identified in the Linux kernel's I3C bus implementation. This issue arises because the I3C master registration process acquires the bus lock twice, leading to a potential recursive locking scenario. The vulnerability has been addressed by modifying the way device information is retrieved, using the device descriptor's info field instead of a function that calls for the information while also acquiring the lock, which could result in a deadlock.

A vulnerability in the Linux kernel's F2FS file system has been addressed. The issue involved the improper management of read extent nodes during the shrinking process of the extent tree. The original implementation used a read-write lock to protect the core data, but in cases with a large number of extent nodes, this could lead to prolonged lock holds, causing potential kernel hang issues. The vulnerability has been resolved by modifying the shrink process to handle read extent nodes in batches, reducing the lock's critical region hold time.

A vulnerability in the Linux kernel's scheduling component has been addressed. The issue arose in the 'sched_setaffinity' function, where a warning was introduced to signal a race condition between per-task affinity assignments and cpuset updates. This race could cause a task's affinity to fall outside the bounds of its cpuset, which is normally acceptable since the system can revert to using the cpuset mask. However, the warning was triggered if the cpuset mask completely lacked overlap with the requested task affinity, a condition that can be easily manipulated. The warning was reproduced by placing a process ID within a cpuset cgroup and having one thread continuously alter the cpuset's CPU allocation while another thread adjusted the process's affinity, creating a conflict that triggered the warning.

A use-after-free vulnerability has been identified in the Linux kernel's block layer, specifically related to the management of hierarchical contexts (hctx) within the CPU hotplug (cpuhp) callback list. If an hctx is not properly removed from the cpuhp callback list, it cannot be reused safely, potentially leading to a use-after-free condition.

A critical SQL injection vulnerability has been identified in Guangzhou Huayi Intelligent Technology Jeewms versions through 20241229. The issue resides in the 'datagridGraph' function of the 'graphReportController.do' file, where the 'store_code' argument can be manipulated to execute SQL injection attacks. This vulnerability can be exploited remotely, and a public proof-of-concept exploit is available.

A critical SQL injection vulnerability has been identified in Guangzhou Huayi Intelligent Technology Jeewms versions through 20241229. The issue arises in the 'saveOrUpdate' function of 'CgFormBuildController.java', where input manipulation leads to SQL injection. This vulnerability can be exploited remotely, and a public proof-of-concept exploit is available.

A critical path traversal vulnerability has been identified in Guangzhou Huayi Intelligent Technology Jeewms versions through 20241229. The issue arises in the file /wmOmNoticeHController.do, where improper handling of external input allows attackers to traverse directories and access files outside of the intended directory. This vulnerability can be exploited remotely without authentication, potentially leading to unauthorized access to sensitive files.

A weak input validation vulnerability has been identified in HCL MyXalytics. The application fails to properly validate input by allowing special characters and lacking length restrictions. This weakness could be exploited to introduce security issues such as SQL injection, cross-site scripting (XSS), and buffer overflow.

A PHP Object Injection vulnerability has been identified in the GiveWP Donation Plugin and Fundraising Platform for WordPress, affecting all versions through 3.19.2. The vulnerability arises from the deserialization of untrusted input from the donation form, such as 'firstName', allowing unauthenticated attackers to inject PHP objects. The presence of a Property-Oriented Programming (POP) chain could enable attackers to delete arbitrary files on the server, potentially leading to remote code execution. While version 3.19.3 was released, it only partially addressed the issue, with a complete patch available in version 3.19.4.

A stored cross-site scripting vulnerability has been identified in the Perfect Portal Widgets plugin for WordPress, affecting all versions through 3.0.3. The issue arises from inadequate input sanitization and output escaping of user-supplied attributes in the 'perfect_portal_intake_form' shortcode. This vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which are executed when users access the affected pages.

A stored cross-site scripting vulnerability has been identified in the Dominion – Domain Checker for WPBakery plugin for WordPress, affecting all versions through 2.3.0. The vulnerability arises from inadequate input sanitization and output escaping on user-supplied attributes in the 'dominion_shortcodes_domain_search_6' shortcode. This flaw allows authenticated attackers with contributor-level access or higher to inject arbitrary scripts into pages, which are executed when users access the affected pages.

A stored cross-site scripting vulnerability has been identified in the TCBD Auto Refresher plugin for WordPress, affecting all versions up to and including 2.0. The issue arises from inadequate input sanitization and output escaping of user-supplied attributes in the plugin's 'tcbd_auto_refresh' shortcode. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages, which are executed when users access the affected pages.

A stored cross-site scripting vulnerability has been identified in the Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration – WpRently | WordPress plugin, affecting all versions through 2.2.1. The vulnerability arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts are executed when a user accesses the compromised page.

A reflected cross-site scripting vulnerability has been identified in the WordPress Push Notification for Post and BuddyPress plugin, affecting all versions through 2.06. The issue arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts could be executed if a user is tricked into clicking a link that contains the malicious payload.