CVE Catalog

A vulnerability in the Linux kernel's netfs component has been addressed. The issue arose in the 'netfs_perform_write()' function, where 'folio->private' was not properly managed. This mismanagement could lead to multiple attachments of private data, causing reference leaks of folio structures and netfs groups. The vulnerability allowed for improper handling of private data attachments, potentially leading to memory leaks and mismanagement of netfs group references. The issue has been fixed by streamlining the process of marking a folio as up-to-date, ensuring proper management of the private data before setting a new group. Additionally, the content flushing behavior was corrected to avoid unnecessary data loss.

A vulnerability in the Linux kernel's netfs component has been addressed. The issue was that the function netfs_read_folio() did not properly wait for ongoing writeback processes to finish, which could lead to an unreliable assessment of the dirty flag and the data attached to folio->private. This oversight allowed folio->private to be cleared by the garbage collector before the writeback flag was reset, potentially causing data integrity issues.

A vulnerability in the AFS filesystem of the Linux kernel has been addressed, concerning improper locking mechanisms for symbolic links. The issues included a lack of locking around the 'afs_read_single()' function, which could lead to race conditions and data leaks during multiple '->get_link()' calls. Additionally, the filesystem did not properly use RCU barriers when accessing buffer pointers during RCU pathwalk, and it could experience race conditions with threads updating symlink contents from the server.

A vulnerability has been addressed in the Linux kernel's Cortina Ethernet driver for Gemini gigabit Ethernet. The issue arose because the socket buffer (SKB) used to assemble packets from fragments in the receive function was a static local variable. This design flaw could lead to race conditions when both Ethernet ports were used simultaneously. The vulnerability has been fixed by making the RX SKB a per-port variable, allowing it to be carried over between function invocations in the port structure. The patch also includes measures to reset the SKB pointer appropriately under certain conditions, such as errors or when the port is stopped.

A vulnerability exists in the Linux kernel's handling of Ethernet packet assembly in the Cortina Gemini driver. The issue arises in the gmac_rx() NAPI poll function, which processes packets from a ring buffer. If the buffer is completely emptied during a polling cycle, the function exits before the packet is fully assembled in the socket buffer (SKB). However, the fragment counter is prematurely reset to zero on the next invocation. This vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's net shaper component allows for improper handling of duplicate leaf entries in group requests. This issue arises because the net_shaper_nl_group_doit() function fails to remove duplicates when userspace sends the same leaf handle more than once. As a result, the same parent pointer can be recorded multiple times, leading to a double free during cleanup. This vulnerability is present in the Linux kernel stable tree.

A vulnerability in the Linux kernel's bio integrity handling can lead to memory access issues. The problem arises because the function bio_integrity_copy_user() incorrectly overwrites the bip_vcnt value, which is crucial for managing bio vectors during read and write operations. This mismanagement can cause the system to read past the intended memory boundaries, potentially leading to undefined behavior. The vulnerability affects the Linux kernel stable tree.

A null pointer dereference vulnerability has been identified in the Linux kernel's bio-integrity handling. This issue arises in the 'bio_integrity_map_user()' function, which fails to properly manage partial page pinning. The 'pin_user_pages_fast()' function can return a count of successfully pinned pages, but the bio-integrity function does not account for this, leading to a general protection fault. The fault occurs because 'bvec_from_pages()' tries to access an unpinned page, resulting in a crash. The vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's QAIC (Qualcomm AI Compiler) component allows for improper memory mapping, potentially leading to use-after-free issues. This occurs in the 'qaic_gem_object_mmap' function, where the 'remap_pfn_range' call can map memory beyond the allocated virtual memory area (VMA) if the buffer object (BO) is too large. The issue arises because 'munmap()' only removes the VMA region, leaving additional mappings intact. The vulnerability affects several versions of the Linux kernel.

A use-after-free vulnerability has been identified in the Linux kernel's DRM MSM DPU handling. This issue arises from mixing device-managed and driver-managed functions, which can lead to improper memory management during the teardown of the MSM driver. If userspace retains a reference to the DRM device, the writeback connector data may be prematurely destroyed, while userspace could still attempt to interact with the connector, creating a potential exploitation vector.

A vulnerability in the Linux kernel's Adreno graphics driver (for A2XX to A4XX generations) can lead to a userspace-triggered crash. The issue arises because the driver does not fetch Unified Bandwidth Compression (UBWC) parameters for these older generations, yet it still allows querying of UBWC-related parameters from userspace. This can trigger a NULL pointer dereference. The vulnerability has been addressed by adding a check for UBWC configuration in the 'adreno_get_param()' function and returning safe default values when none are available.

A vulnerability in the Linux kernel's SMC-D client can lead to a null pointer dereference. This issue arises because slot 0 of the 'ism_dev' and 'ism_chid' arrays is reserved for SMC-Dv1 devices. When no V1 device is selected, slot 0 remains uninitialized, with 'ism_dev[0]' set to NULL and 'ism_chid[0]' at 0. The function 'smc_v2_determine_accepted_chid' matches the peer's CHID against this array, starting from index 0. If a malicious peer responds to an SMC-Dv2-only proposal with a CHID of 0, it will match the empty slot, causing 'ism_selected' to be set to 0. This leads to a dereference of 'ism_dev[0]->lgr_lock' in 'smc_conn_create', causing a fault due to the null pointer. The vulnerability has been fixed by ensuring that 'ism_dev[i]' is not NULL before accepting a CHID match.

An off-by-one vulnerability has been identified in the Linux kernel's handling of TLS scatterlist rings within the networking subsystem. This issue arises when the scatterlist ring wraps, causing the current implementation to miscalculate the entry count for chaining data. The vulnerability is present in the stable branch of the Linux kernel.

A vulnerability in the Linux kernel's TLS implementation can lead to an illegal input scenario in the scatterlist API. This issue arises when the 'end' parameter is 0 while 'start' is not, causing a wrap link to point directly to another chain link. The scatterlist API's iterator does not properly resolve consecutive chain links, creating a chain-after-chain situation that is problematic for crypto operations. The vulnerability affects the Linux kernel stable tree.

A vulnerability exists in the OpenVPN TCP implementation of the Linux kernel, specifically in the ovpn_tcp_close() function. This issue arises because the function improperly manages the peer pointer of the ovpn_socket, leading to a race condition. The vulnerability is present in the Linux kernel stable tree, affecting the OpenVPN TCP transport layer. The problem occurs when ovpn_tcp_close() drops the RCU read lock before safely dereferencing the peer pointer, allowing for potential memory corruption. The issue can be reproduced by triggering a peer removal while simultaneously closing the associated TCP file descriptor.

A vulnerability exists in the OpenVPN implementation within the Linux kernel, specifically related to how peer references are managed during error handling. When a new peer is created and an error occurs, the peer's reference count is not properly updated, leading to potential use-after-free issues. This problem arises because the error handling path releases the peer directly, bypassing the necessary reference count management. As a result, if an error occurs while a peer is being actively used, it can lead to accessing freed memory, causing instability or crashes.

A race condition vulnerability has been identified in the OpenVPN implementation within the Linux kernel. This issue arises when deleting an OpenVPN interface, creating a narrow window where adding a new peer via netlink can cause the network device to hang, preventing its proper unregistration. The problem occurs during the interface deletion process, when existing peers are cleared and the device is queued for deregistration. If a 'CMD_PEER_NEW' message arrives during this time, it can reintroduce a reference to the net device, leading to a situation where the device cannot be released, as it is assumed all peers have been freed. The vulnerability affects the Linux kernel's stable branch, specifically within the OpenVPN netlink interface management.

A vulnerability in the Linux kernel's VFIO/PPCI subsystem allows DMABUF exports to access unreserved BAR resources. This issue arises because, although these resources are requested at startup, there is no verification that they have been properly reserved before export. The vulnerability can be exploited by accessing unreserved resources through the DMABUF export, potentially leading to unauthorized access or manipulation of memory-mapped I/O regions.

A buffer overflow vulnerability has been identified in the Linux kernel's ASoC codecs for FS210X audio amplifiers. The issue arises in the 'fs210x_effect_scene_info' function, where the 'strscpy' function is used to copy a string from the source to the destination. The vulnerability occurs because the length of the source string is not properly constrained, allowing for a buffer overflow if the source string is too long for the destination buffer. This vulnerability affects the Linux kernel stable tree.

A vulnerability exists in the Linux kernel's cachefiles component related to improper error handling during directory creation. When the vfs_mkdir() function fails, the error code is not correctly retrieved from the error pointer. This oversight causes the error handling routine to receive a success indication (ret=0), leading to the return of a null pointer instead of a valid error reference. The issue has been addressed by modifying the error handling to properly extract and return the error code when directory creation fails.

A vulnerability in the Linux kernel's DRM MSM snapshotting code has been addressed. The issue arose because the snapshotting process aligned data segments to 16 bytes, which worked for DPU regions but not for DSI data, which is offset by 4 bytes. This misalignment led to incorrect data handling. The vulnerability also caused a significant memory overallocation in the region management. The issue has been fixed by removing the unnecessary alignment and properly adjusting the data dumping process.

A vulnerability in the Linux kernel's lm90 hardware monitoring driver can lead to a use-after-free issue. This occurs because the driver unregisters and frees the hwmon device before canceling scheduled work tasks. If these tasks are executed in the interim, they can access freed memory, causing potential instability or crashes. The vulnerability affects the stable versions of the Linux kernel.

A vulnerability in the Linux kernel's iwlwifi driver for the MLD sub-driver can lead to a TSO (TCP Segmentation Offload) segmentation issue when AMSDU (Aggregate MAC Service Data Unit) is disabled. This problem arises because the MLD driver sets the maximum AMSDU length to a sentinel value of 1 when AMSDU is disabled for a specific TID (Traffic Identifier). The TSO segmentation function does not check for this sentinel value, allowing the calculation of subframes to reach zero. This zero value propagates through the segmentation process, resulting in the creation of over 32,000 tiny segments from a single GSO (Generic Segmentation Offload) socket buffer. This flood of micro-frames can cause memory corruption and a use-after-free error in TCP's retransmit queue, leading to a null dereference in the TCP RACK (Rapid Acknowledgment) loss detection mechanism.

A vulnerability exists in the Linux kernel's cgroup subsystem, specifically within the rstat component. The issue arises because the 'css_rstat_updated()' function, which is exposed as a BPF (Berkeley Packet Filter) kfunc, accepts a caller-provided CPU argument without validating its legitimacy. This oversight allows a BPF iter/cgroup program, granted with CAP_BPF and CAP_PERFMON, to pass an invalid CPU value. On an unpatched kernel with the UBSCAN_BOUNDS test, an invalid CPU value triggers an out-of-bounds array access, as indicated by the Undefined Behavior Sanitizer (UBSAN) error. The vulnerability has been addressed by adding CPU validation to the BPF-facing 'css_rstat_updated()' kfunc and moving the common implementation to '__css_rstat_updated()' for in-kernel callers.

A vulnerability exists in the Linux kernel's igc driver, specifically in the handling of SMD (Service Management Data) frames. The issue arises because the function responsible for initializing SMD frames does not properly set the transmission buffer type, leaving it open to potential mismanagement. This can lead to incorrect processing of transmission completions, as the buffer type is reused and a stale type can interfere with the proper cleanup process. The vulnerability affects the stable versions of the Linux kernel.

A time-of-check to time-of-use (TOCTOU) vulnerability has been identified in the Linux kernel's Microsoft Azure Network Adapter (MANA) driver. This issue arises in the 'mana_hwc_rx_event_handler()' function, where the 'hwc_msg_id' is read from a Direct Memory Access (DMA)-coherent buffer. Although the value is initially bounds-checked, it is subsequently re-read from the same buffer in the 'mana_hwc_handle_resp()' function for bit testing and pointer arithmetic. This double-fetch creates a window of opportunity for hardware to alter the 'hwc_msg_id' between the validation check and its actual use, potentially leading to improper bounds validation. The vulnerability is particularly concerning in Confidential Virtual Machines (CVMs) using SEV-SNP or TDX, where DMA memory is shared, unencrypted, and directly visible to the host, allowing for such modifications.

A use-after-free vulnerability has been identified in the Linux kernel's RDMA/rtrs component. This issue arises during the path file creation process, specifically within the 'rtrs_srv_create_path_files()' function'. When an error occurs after the sysfs root folders have been created and the 'srv_path->kobj' object has been initialized, the current cleanup process inadvertently drops the last reference to 'srv_path->kobj'. This premature release allows 'srv_path' to be freed while it is still being accessed, leading to a use-after-free condition. The vulnerability affects several versions of the Linux kernel.

A use-after-free vulnerability has been identified in the Linux kernel's bridge networking component, specifically related to multicast snooping. When per-VLAN multicast snooping is enabled, the bridge can inadvertently leave a per-port multicast context active on a port that has been removed, leading to a use-after-free condition. This issue arises because the current implementation does not properly disable the per-port context when both per-VLAN and global multicast snooping are active on the same port. The vulnerability affects the Linux kernel stable tree.

A race condition vulnerability has been identified in the Linux kernel's EROFS (Enhanced Read-Only File System) component, specifically related to unaligned compressed extents. This issue arises after the introduction of unaligned extents, which can lead to a scenario where two threads interact with the same managed folio in a conflicting manner. The vulnerability occurs when one thread adds a folio to the file cache while another thread is still processing it, potentially causing duplicate additions and cache inconsistencies. This issue affects several versions of the Linux kernel that are part of the stable group.

A vulnerability in the Linux kernel's WiFi mac80211 subsystem allows for an out-of-bounds write by improperly handling link IDs in the EPCS (Enhanced Power Control Support) management. This issue affects the stable versions of the Linux kernel. The vulnerability arises because the link ID can be set to 15, which exceeds the valid range, leading to a memory access violation. When a WiFi 7 access point sends a specific action frame with an invalid link ID, it can trigger this vulnerability, causing a kernel crash by dereferencing a garbage pointer.

A vulnerability in the Linux kernel's ALSA subsystem for sequencer UMP (Universal MIDI Packet) handling can lead to a use-after-free condition. The issue arises because the function 'seq_ump_process_event()' accesses the output file of a client without proper synchronization. This can cause the last closure of the output to release the associated raw MIDI file while an event callback is still processing, potentially allowing the runtime of the raw MIDI substream to be freed prematurely. The vulnerability has been addressed by introducing a per-client read-write lock to manage access to the output file, ensuring that the output teardown process is properly synchronized with ongoing event processing.

A vulnerability in the Linux kernel's tracing subsystem can lead to a NULL pointer dereference. This issue arises in the hist_field_name() function, which is responsible for returning the name of a histogram field. The vulnerability occurs when the function processes fully-qualified VAR_REF/EXPR cases. In these instances, if a variable name is too long, it can cause a buffer overflow, leading to a NULL return that bypasses a safeguard. This unexpected NULL value is then dereferenced by callers, causing a crash. The vulnerability affects several versions of the Linux kernel.

A vulnerability has been identified in the Linux kernel's net shaper component, related to the handling of validity markings in the XArray data structure. This issue arises from a race condition where a reader can observe a VALID mark, get interrupted, and then fetch a different entry that no longer corresponds to the original VALID mark. This can lead to a use-after-free condition, as the net_shaper_rollback() function assumes that entries without a VALID mark can be safely freed. The vulnerability affects the Linux kernel stable tree.

A vulnerability in the Linux kernel's rxrpc implementation has been addressed. The issue involved improper handling of DATA packets decrypted in place, which could lead to corruption in the page cache. This problem arose when packets were transmitted locally using splice(), causing them to be shared in the I/O thread. The vulnerability has been fixed by removing the packet sharing and instead extracting the packet content into a dedicated buffer for decryption. The modified approach ensures that the original packet remains unchanged and that the decrypted data is correctly aligned for processing by cryptographic algorithms. Additionally, the new method enhances performance by streamlining packet distribution and acknowledgment processes. The fix also introduces a mechanism to manage the decryption buffer more effectively, particularly when using the MSG_PEEK flag, which can interfere with packet processing.

A use-after-free vulnerability has been identified in the Linux kernel's handling of BPF socket verdicts in relation to KTLS (Kernel TLS) processing. This issue arises when a socket is added to a sockmap with a BPF_SK_SKB_VERDICT before the KTLS receive context is established. The BPF socket parser's data ready function can then inadvertently access a freed socket buffer, leading to potential memory corruption.

A vulnerability in the Linux kernel's TCP implementation can lead to predictable Initial Sequence Numbers (ISN) by leaking stale per-CPU TCP TIME_WAIT-derived ISN values. This issue arises because the ISN is moved to a per-CPU variable, with the assumption that it will be immediately consumed by the tcp_conn_request() function. However, several drop paths can interrupt this process, leaving the ISN value set. When the next SYN packet is processed on the same CPU, the non-zero ISN is used, creating a potential for ISN prediction. The vulnerability affects the stable versions of the Linux kernel.

A use-after-free vulnerability has been identified in the Linux kernel's GPIO aggregator component. This issue arises because the code frees a lookup entry's device ID before removing the entry from the lookup table. If a concurrent thread invokes the 'gpiod_find()' function before the entry is removed, it could traverse the list and call 'gpiod_match_lookup_table()', which improperly dereferences the device ID using 'strcmp()'. The vulnerability affects the Linux kernel stable tree.

A vulnerability in the Linux kernel's GPIO aggregator component has been addressed. When the aggregator platform device, managed through configfs, is deactivated, the dynamically created software node is not properly removed, leading to a memory leak. The vulnerability has been fixed by ensuring the software node is destroyed as the final step in the deactivation process.

A vulnerability in the Linux kernel's handling of executive queue references within the Direct Rendering Manager (DRM) for Intel's Xe architecture has been addressed. The issue arose in the 'xe_oa_stream_open_ioctl()' function, where a width check on the execution queue parameter could lead to a reference leak. Specifically, when the execution queue width exceeded one, the function would return an 'Operation Not Supported' error without properly cleaning up the allocated resources. This oversight caused a reference to the execution queue to remain active indefinitely, preventing the associated file from being closed and released properly. The vulnerability has been fixed by modifying the function to return the error while also initiating the cleanup process, ensuring that all references are correctly managed.

A vulnerability in the Linux kernel's NVMe PCI driver has been addressed, which involved a memory leak of DMA vector allocations related to peer-to-peer (P2P) memory. The issue arose because P2P memory was not being unmapped, leading to unnecessary tracking and leakage of DMA vectors upon completion. This vulnerability affects the stable version of the Linux kernel.

A vulnerability in the Linux kernel's NVMe over PCI driver can lead to a DMA mapping leak. This issue occurs when the driver fails to allocate a tracking descriptor for both Partial Request Pages (PRP) and Scatter-Gather Lists (SGL), causing the initial DMA mapping to leak during iteration. The problem also arises when the driver encounters an invalid bio_vec while mapping PRPs. The vulnerability affects the stable versions of the Linux kernel.

A vulnerability allowing out-of-bounds array access has been identified in the Linux kernel's Microsoft Azure Network Adapter (MANA) driver. This issue arises in the 'mana_hwc_rx_event_handler()' function, where the 'rx_req_idx' is calculated from 'sge->address' in DMA-coherent memory. In Confidential VMs (SEV-SNP/TDX), this memory is shared unencrypted, allowing hardware to alter Work Queue Element (WQE) contents at any time. The lack of a bounds check on 'rx_req_idx' can lead to unauthorized access into the 'reqs[]' array, potentially causing memory corruption or other unintended behavior.

A use-after-free vulnerability has been identified in the Linux kernel's block layer, specifically within the block multi-queue (blk-mq) subsystem. This issue arises when a cached request is peeked and the task is set to sleep before the request is popped. In this scenario, the plug flushes and calls 'blk_mq_free_plug_rqs', which frees the cached requests, leading to a use-after-free condition. The vulnerability affects the Linux kernel stable tree.

A vulnerability in the Linux kernel's ksmbd component can lead to a use-after-free error during durable reconnects in SMB2 file handling. After a successful reconnect, the same file object is republished into the session's volatile-id table. If an error occurs later in the smb2_open() process, the cleanup routine can inadvertently free the file object without removing the corresponding volatile-id entry from the session table. This issue arises because the file closure process is not aware of the session context, allowing the file object to be freed prematurely. The vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's keyring code has been addressed. The issue arose because the function 'find_key_to_update()' called 'assoc_array_find()' without the proper RCU read lock. This oversight was not problematic for regular key handling, which is shielded by the keyring semaphore, but it created issues for persistent key handling, which follows a different model. The vulnerability could potentially be exploited by manipulating the keyring's locking mechanism.

A vulnerability has been identified in the Linux kernel's usbtouchscreen driver, specifically in the handling of NEXIO data within the interrupt packet. The issue arises because the driver does not properly validate the length of the data being read, allowing for a significant out-of-bounds read of approximately 64 KiB. This read extends beyond the allocated buffer, potentially leaking adjacent kernel memory into userspace as touch coordinate events. The vulnerability can be exploited by a device that falsely reports its data length, bypassing the driver's existing length checks. The issue affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's ACPI button handling has been addressed. The issue arose because a previous commit changed the notification handler type for ACPI buttons but did not update the corresponding removal function. This oversight led to a leak of the notification handler after the driver was removed, potentially causing a kernel crash if an ACPI notification was received for the device after the driver had been detached. Additionally, this leak could interfere with re-probing the device with the same driver. The vulnerability affects Linux kernel versions 6.15 and later.

A null pointer dereference vulnerability has been identified in the Linux kernel's Qdisc Stochastic Fairness Buffer (SFB) scheduler. This issue arises when the SFB scheduler has child queuing disciplines, such as Queue Fairness Queueing (QFQ), that use the 'peek' callback to indicate dequeued packets. The vulnerability can lead to a kernel panic when the parent queuing discipline, like Token Bucket Filter (TBF), attempts to retrieve a packet from the SFB child. The SFB scheduler incorrectly calls the dequeue method of its child QFQ, which can cause a null pointer dereference, as indicated by the Kernel Address Sanitizer (KASAN) error.

A use-after-free vulnerability has been identified in the Linux kernel's NFC LLCP socket handling. The issue arises in the `llcp_sock_release()` function, which improperly unlinks sockets from the local sockets list without considering their connection state. This oversight can lead to a use-after-free condition, as sockets in the connecting state are not correctly managed. The vulnerability affects the Linux kernel stable group.

A use-after-free vulnerability has been identified in the Linux kernel's NFC LLCP connection state machine. This issue arises from a race condition where the connection acceptance packet (CC) is processed simultaneously with the release of a socket. The vulnerability affects several versions of the Linux kernel.