CVE Catalog

A vulnerability in the Linux kernel's ESP component allows for an out-of-bounds write due to a mathematical underflow in the MTU calculation. This issue arises when an attacker manipulates certain parameters, leading to a negative value being interpreted as a large positive one. The vulnerability can be exploited by a user with no special privileges who establishes an IPv4 ESP tunnel with a large authentication key, sets a small MTU, and adjusts the TCP padding. When a UDP datagram is sent through this tunnel, the manipulated MTU value causes an underflow, resulting in a negative length being passed to a memory function, which then writes an excessive amount of data to an incorrect location in memory.

A use-after-free vulnerability has been identified in the Linux kernel's acceleration component for the Rocket graphics driver. This issue arises in the 'create_bo' ioctl function, where a Graphics Execution Manager (GEM) handle is inserted into the file's IDR (Index Descriptor Register) via 'drm_gem_handle_create()' before completing several critical operations that could fail. If any of these operations, such as scatter-gather table allocation or IOMMU mapping, fail after the handle has been activated, the error handling routine frees the associated object without removing the handle from the IDR. This oversight creates a dangling handle that points to deallocated memory, leading to a use-after-free condition. Subsequent ioctls that use this handle can dereference the freed memory, causing potential exploitation.

A vulnerability exists in the Linux kernel's netfilter component, specifically within the SYNPROXY feature. The issue arises in the 'synproxy_tstamp_adjust' function, which modifies the TCP timestamp option and updates the TCP checksum. The vulnerability occurs because the function may use a stale pointer to the TCP header, leading to incorrect checksum calculations. This can result in either writing to freed memory or sending a packet with a mismatched checksum, causing potential network communication issues.

A vulnerability in the Linux kernel's netfilter component, specifically within the nf_tables subsystem, has been addressed. The issue involved incorrect handling of register overlaps during left and right shift operations, which could lead to data corruption. When the source and destination registers pointed to the same memory location, the carry for the shift operation was improperly calculated, using the modified destination value instead of the original source value. This vulnerability affected the Linux kernel stable tree.

A vulnerability exists in the Linux kernel's handling of Shared Memory Communication (SMC) hash tables. The issue arises because the hash table heads for both IPv4 and IPv6 are re-initialized after certain socket-related initializations. This re-initialization can inadvertently reset the hash table heads, clearing existing entries that are in use and potentially leading to a corrupted list. The vulnerability affects the Linux kernel stable tree.

A vulnerability in the Linux kernel's handling of socket options for AF_IUCV can lead to a NULL pointer dereference, causing a kernel crash. This issue arises in versions of the Linux kernel prior to the patch included in this CVE. The vulnerability is triggered by a race condition between the recvmsg() function and the getsockopt() function when retrieving the SO_MSGSIZE option. The problem occurs because the SO_MSGSIZE handling dereferences a device MTU value that has been invalidated by a prior operation, leading to a NULL pointer dereference and a kernel oops.

A vulnerability exists in the Linux kernel's SCSI subsystem, specifically in how the kernel manages host queues for SCSI devices. When a SCSI host is in recovery, the function responsible for requeuing commands does not schedule them to be processed later. Once the recovery is over, the expectation is that all SCSI devices will be addressed. However, the current implementation overlooks devices in a 'partially removed' state, which can lead to requests being stuck and the device removal process hanging. This issue affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's handling of netlink socket information can lead to an unintentional information leak. This issue arises because the kernel improperly manages the synchronization of netlink socket data, allowing sensitive information to be exposed to user-space applications. The vulnerability is present in the stable branch of the Linux kernel.

A use-after-free vulnerability has been identified in the Linux kernel's Advanced Linux Sound Architecture (ALSA) PCM OSS subsystem. This issue arises in versions of the Linux kernel prior to the latest stable release. The vulnerability occurs in the 'snd_pcm_oss_proc_write()' function, which improperly manages memory when linking setup entries. If the allocation of a task name fails, the function frees the linked entry but leaves the setup list pointing to the freed memory. This creates a scenario where a subsequent OSS device open can access and dereference the invalid memory, leading to potential exploitation.

A potential out-of-bounds access vulnerability has been identified in the Linux kernel's Handling of HSR (High-availability Seamless Redundancy) supervision frames. This issue arises because the entire TLV (Type-Length-Value) header is not properly linearized before being accessed. A truncated frame could lead to an out-of-bounds access, creating a risk of memory corruption or other unintended behavior.

A vulnerability in the Linux kernel's ethtool component allows for a memory leak of the indirection table and hash key. This issue arises in the RSS (Receive Side Scaling) handling, specifically within the 'rss_prepare_get' function. The vulnerability is present in the stable branch of the Linux kernel. When 'rss_prepare_get' allocates the indirection table and hash key buffer, it relies on the 'rss_get_data_alloc' function. After allocation, it calls 'ops->get_rxfh()' to populate the data. However, if 'get_rxfh()' fails, the function returns an error without freeing the previously allocated memory, leading to a resource leak.

A vulnerability in the Linux kernel's ethtool module has been addressed. The issue arose because the function ethnl_ops_complete() was not called after a validation error, even though ethnl_ops_begin() had been previously invoked. This oversight could lead to improper handling of module flash operations.

A vulnerability in the Linux kernel's ethtool module can lead to a reference leak of the netdev object during firmware flashing operations. This issue arises because the function responsible for flashing module firmware does not properly manage the 'in_progress' flag or the netdev reference. As a result, the device cannot be removed while the operation is ongoing, potentially causing synchronization issues.

A vulnerability in the Linux kernel's handling of CDB replies in the ethtool CMIS module can lead to out-of-bounds writes. This issue arises because a malicious or faulty SFP module could send a reply length longer than what the kernel expects, potentially overwriting memory and causing instability. While the threat from malicious hardware is theoretical, some modules could be buggy or misread, making this a valid concern. The vulnerability affects the Linux kernel stable tree.

A vulnerability has been identified in the Linux kernel's handling of CMIS firmware updates via ethtool. The issue arises because the firmware update code directly uses the 'start_cmd_payload_size' from the module's CDB reply as the byte count for memory copying. This can lead to an out-of-bounds write, as the destination buffer has a maximum length of 112 bytes. A malicious module or a corrupted response could exploit this flaw, potentially causing memory corruption or other unintended behavior.

A use-after-free vulnerability has been identified in the Linux kernel's IP tunneling implementation. The issue arises in the 'iptunnel_pmtud_build_icmp' and 'iptunnel_pmtud_build_icmpv6' functions, where network header information is cached before a critical operation that can modify the memory structure of the packet. This flaw could potentially be exploited to access freed memory, leading to undefined behavior.

A use-after-free vulnerability has been identified in the Linux kernel's VXLAN implementation. The issue arises from the improper handling of the IP header after performing Path Maximum Transmission Unit (PMTU) checks. Specifically, the function 'skb_tunnel_check_pmtu()' can modify the socket buffer's header, and reusing the cached IP header value can lead to a use-after-free condition. This vulnerability affects the Linux kernel's stable group.

A vulnerability in the Linux kernel's tunnels module can lead to an out-of-bounds access in the Path Maximum Transmission Unit (PMTU) discovery process for ICMP packets. This issue arises because the transport header of the socket buffer (skb) may not be set, causing the ICMP header to be accessed based on the IPv4 network header without proper validation. The vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's Bluetooth 6lowpan implementation can lead to a NULL pointer dereference. The issue arises in the 'send_mcast_pkt()' function, which calls 'skb_clone()' without checking the return value. If memory allocation fails, 'skb_clone()' can return NULL, leading to a dereference of 'skb->data' in the 'send_pkt()' function. This vulnerability affects the Linux kernel stable tree.

A vulnerability in the Linux kernel bonding driver can cause a kernel crash when a virtual CAN device is enslaved to a bonding master. This issue arises because the bonding driver modifies network device states to conform to an Ethernet-like model, which is incompatible with CAN's distinct Layer 2 architecture. The bonding process fails to manage CAN-specific data structures, resulting in a null-pointer dereference and a crash when accessing CAN receiver lists. This vulnerability is particularly problematic because CAN lacks MAC addresses and standard Ethernet link-layer mechanisms, making the bonding operation architecturally invalid.

A vulnerability in the Linux kernel's bridge netlink handling can lead to sleeping functions being called in an invalid context, which is not allowed. This issue arises because the bridge lock is held while processing netlink attributes for bridge ports. Although this was appropriate when only a few STP-related attributes were managed, it has become problematic as the function now handles many more attributes, most of which do not require the bridge lock. The improper locking can cause disruptions in the kernel's operation, as evidenced by a logged error indicating a sleeping function was called from an invalid context, violating the expected behavior of atomic operations.

A vulnerability has been identified in the Linux kernel's bridge component, specifically within the 'brport_store()' function of the 'br_sysfs_if.c' file. This function has historically required a bridge lock to protect the Spanning Tree Protocol (STP) state. However, it now handles various attributes that do not require this lock, such as bridge flags, FDB port flushing, multicast attributes, group forward masks, and backup ports. The unnecessary locking can lead to issues, as the function 'dev_set_promiscuity()'—called when certain bridge port flags change—can sleep, causing a disruption in atomic context. The vulnerability arises from the improper management of locks when processing attributes that do not require the bridge lock, creating a risk of sleeping functions being called from an invalid context, which can lead to kernel panics.

A vulnerability in the Linux kernel's ethtool component allows for improper handling of nested profile updates, specifically in the coalesce feature. The issue arises because the update function does not properly limit the index of nested entries, enabling user-controlled manipulation. This flaw can lead to memory management issues, as the destination buffer is duplicated based on a fixed number of entries, while the actual nested count can be freely controlled by the user. The vulnerability affects the Linux kernel stable tree.

A vulnerability in the Linux kernel's handling of General Netlink messages in the Ethtool component can lead to a crash. This issue arises when the 'ethnl_tsinfo_prepare_dump' function fails to prepare a message for dumping timestamp information. The failure is not properly handled, allowing an error pointer to be passed to 'genlmsg_cancel', which is intended to cancel a message that has been started. Since the message preparation did not complete successfully, there is nothing to cancel, and this mismanagement can cause a crash.

A vulnerability in the Linux kernel's handling of EEPROM data via Netlink has been addressed. The issue arose in the Netlink fallback method for reading module EEPROM, which failed to properly validate the length of data being read. Specifically, while the method checked that the offset was within bounds, it did not ensure that the combination of offset and length remained within the total length of the EEPROM data. This oversight could lead to unexpected behavior in device drivers and firmware. The problem has been corrected by adding the necessary validation to the Netlink fallback method, aligning it with the existing safeguards in the ioctl equivalent. Additionally, the update ensures that all buffers sent to drivers are properly initialized to prevent any unintentional data exposure.

A vulnerability in the Linux kernel's IPv6 routing protocol for low-power and lossy networks (RPL) has been identified. The issue arises in the function 'ipv6_rpl_srh_decompress()', where the header length is calculated based on the number of addresses. When this number exceeds 127, the calculation overflows, leading to a truncation that can cause the decompressed data to overlap with other memory regions. This overlap allows for corruption of the routing header in forwarded packets, potentially disrupting network communication.

A vulnerability in the Linux kernel's network scheduling component, specifically within the netem (network emulator) module, has been addressed. This issue arose when netem duplicated a packet, re-enqueuing the copy at the root queue discipline (qdisc). If another netem instance was in the tree, the copy could be duplicated again, leading to excessive recursion that could exhaust system stack or memory resources. The initial safeguard against duplication only temporarily reset the per-qdisc duplicate state, which was not safe for concurrent enqueue operations. The vulnerability has been fixed by utilizing the skb (socket buffer) tc_depth field to track packet duplication more reliably. The tc_depth is incremented for duplicates before re-enqueuing, and any packet with a non-zero tc_depth is skipped, ensuring safe handling regardless of tree structure or concurrency.

A vulnerability exists in the Linux kernel's traffic control subsystem, specifically within the mirred action handling. When mirred redirects to the ingress from either ingress or egress, the loop state is lost. This occurs because the packet is deferred into the backlog and the sched_mirred_dev array is cleared. As a result, any existing loop may go undetected. The vulnerability affects the stable versions of the Linux kernel.

A stack overflow vulnerability has been identified in the Linux kernel's networking scheduler, specifically within the 'act_mirred' functionality. This issue arises from a recursion bypass related to blockcast actions, which can be exploited by unprivileged users in a new network namespace. The vulnerability allows for the creation of an infinite recursion loop between two network devices, ultimately leading to a kernel panic.

A deadlock vulnerability has been identified in the Linux kernel's handling of NVMe over Fabrics TCP connections. The issue arises in the net/handshake subsystem, where the TLS handshake cancellation function can be called from a bottom-half (BH) context, leading to a potential deadlock. This occurs because the cancellation function tries to acquire a lock that may already be held by a process-context thread on the same CPU, causing the lock acquisition to block indefinitely. The vulnerability affects the Linux kernel stable tree.

A vulnerability in the Linux kernel's netlink handshake handling can lead to use-after-free issues. This occurs when a request is processed and the associated file reference is released before it can be safely used, allowing for the possibility of reading null or accessing freed memory. The issue arises because the file and socket structures are managed independently, creating a window where the file reference can be prematurely released. The vulnerability affects the Linux kernel stable tree.

A vulnerability exists in the Linux kernel's handling of netlink-based handshake requests. When a network namespace is destroyed, pending handshake requests that have not been accepted are not properly cleared, leaving references to socket files and allocated memory. This issue arises because the function responsible for draining these requests is not executed, leading to potential memory leaks or corruption. The vulnerability is caused by a reversal in the arguments of a list management function, which disrupts the intended flow of request handling. The problem is further complicated by a race condition that can corrupt the list of requests if a cancellation operation is performed concurrently.

A race condition vulnerability has been identified in the Linux kernel's DPLL (Digital Phase-Locked Loop) subsystem, specifically within the zl3073x driver. This vulnerability arises from the improper handling of device change notifications, which could lead to dereferencing a freed or null pointer during device teardown. The issue has been resolved by eliminating the change_work infrastructure and directly using the __dpll_device_change_ntf() function, which is now available for callers that hold the appropriate lock.

A vulnerability exists in the Linux kernel's Bluetooth implementation, specifically within the L2CAP (Logical Link Control and Adaptation Protocol) layer. The issue arises because the L2CAP Enhanced Credit-Based Mode reconfiguration response handler does not properly clear the channel identifier after a successful operation. This oversight allows a remote attacker, who has completed a reconfiguration as the peer, to replay a failure response using the outdated identifier. As a result, the kernel mistakenly matches the response to an existing channel and terminates it, causing a disruption in the established connection. This vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's Bluetooth implementation can lead to a crash when handling Enhanced Credit Based Connection Response packets. This issue arises in the L2CAP (Logical Link Control and Adaptation Protocol) layer, specifically when a destination CID (Channel Identifier) is received for an already-assigned channel. The Bluetooth specification requires both channels to be discarded, but the current implementation can invalidate the iteration cursor used to manage the channels, leading to a potential crash. The problem occurs in several versions of the Linux kernel.

A vulnerability in the Linux kernel's Bluetooth subsystem has been addressed. The issue involved the HCI (Host Controller Interface) synchronization process, specifically during the closing of Bluetooth devices. The vulnerability could lead to queuing timeouts while the device's workqueue was being drained. This issue was resolved by ensuring that the HCI_CMD_DRAIN_WORKQUEUE command was set during the device closure process, particularly since the closure can now occur during the reset phase.

A NULL pointer dereference vulnerability has been identified in the Linux kernel's Microsoft Azure Network Adapter (MANA) driver. This issue arises when queue allocation fails, leading to the error cleanup process freeing and nullifying certain pointers. Subsequent teardown operations can then inadvertently dereference these nullified pointers, causing a panic. The vulnerability is present in the Linux kernel stable tree, specifically in versions prior to the latest commit that addresses this issue.

A vulnerability in the Linux kernel's Microsoft Mana Ethernet driver can lead to null pointer dereferences during queue teardown. This issue occurs when the port is left in a detached state after a successful detach operation, but the subsequent attach attempt fails. In this scenario, the driver's transmit and receive queue pointers are freed, and an unconditional call to detach the port again causes a null pointer dereference. The vulnerability affects the Linux kernel stable tree.

A race condition vulnerability has been identified in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation. This issue arises in the 'sctp_wait_for_connect' function, which drops and re-acquires the socket lock while waiting for an association to reach the ESTABLISHED state. During this period, another thread can peel off the association to a new socket using the 'getsockopt(SCTP_SOCKOPT_PEELOFF)' option, inadvertently changing the association's socket reference. When the original socket lock is re-acquired, 'sctp_wait_for_connect' erroneously reports success without recognizing the migration. This oversight can lead to the association being accessed under the wrong lock in the 'sctp_datamsg_from_user' function, potentially causing data corruption or other unintended behavior.

A vulnerability in the Linux kernel's vsock/virtio implementation relates to improper handling of zero-copy user arguments in buffer management. The issue arises because the function that sends packet information allocates or reuses the zero-copy user argument before entering the sending loop. However, the function responsible for allocating the socket buffer still populates the buffer before it receives the user argument. This misalignment can lead to errors when the zero-copy feature, used with fixed-buffer vectored data, hits the maximum allowed fragments. In such cases, the system may partially attach managed fragments and return an error indicating that the message size is too large. The error handling process then attempts to free the buffer in a way that can inadvertently cause issues with fragment management. The vulnerability has been addressed by modifying the buffer allocation function to immediately bind the user argument before filling the buffer with data, ensuring that the management of buffer fragments is handled correctly and consistently.

A vulnerability in the Linux kernel's IPv6 routing can lead to a potential infinite loop, causing a CPU stall. This issue occurs in the 'rt6_fill_node' function, where improper handling of the 'fib6_siblings' list can create a soft lockup. The problem arises when writers holding the 'tb6_lock' remove entries from the 'fib6_siblings' list without waiting for RCU readers to finish, leaving the list in a state that the softirq-side walker cannot process, effectively stalling the CPU. The vulnerability affects the Linux kernel stable tree.

A vulnerability in the Linux kernel's IPv6 routing can lead to a potential infinite loop in the 'fib6_select_path' function. This issue arises from improper handling of the 'fib6_siblings' list, which can cause the routing logic to get stuck, especially under certain conditions of high next-hop churn. The problem was identified during an audit and is similar to a previously reported issue in the 'rt6_fill_node' function. The vulnerability affects the stable version of the Linux kernel.

A stack leak vulnerability has been identified in the Linux kernel's ST LSM6DSX IMU driver, specifically in the tagged FIFO buffer handling. The issue arises because the FIFO path declares a buffer on the stack with an alignment requirement but without an initializer. This oversight creates a gap in the data structure, leading to an unintentional leak of uninitialized data to userspace. When the driver copies a specified number of bytes (6 bytes) from the buffer, the uninitialized space between the data and the timestamp is exposed, potentially allowing for information leakage.

A vulnerability exists in the Linux kernel's IIO IMU ADIS16550 driver, where the trigger handler function does not properly initialize a stack-based data array. This oversight leads to a leak of uninitialized stack data to userspace. The issue arises because the memcpy function only populates the first 28 bytes of the array, leaving bytes 28-31 uninitialized. When the driver pushes data to buffers with a timestamp, the uninitialized bytes are included, creating a potential information leak.

A stack leak vulnerability has been identified in the Linux kernel's BMP280 pressure sensor driver, specifically in the BMP580 trigger handler. The issue arises because the handler declares a scan buffer on the stack without initializing it, and then copies 24-bit sensor data into 4-byte little-endian fields. This process leaves the high byte of the compensated temperature and pressure values uninitialized. As a result, two bytes of stack data are inadvertently exposed to userspace with each scan. This vulnerability is a regression from a previous version where the buffer was managed in private data, allowing for automatic zeroing. Although the BME280 handler was updated to address a similar issue, the BMP580 driver was overlooked because it lacked a padding hole, presenting instead a short-fill problem.

A denial-of-service vulnerability has been identified in the Linux kernel's USB Type-C UCSI CCG driver. The issue arises in the firmware update process, specifically within the 'do_flash()' function, which handles firmware images for USB Type-C controllers. When a firmware image lacks a ':' record header, the function improperly processes the image, leading to a kernel crash. This flaw can be exploited by a root user who places a crafted firmware file in the '/lib/firmware' directory and writes to the 'do_flash' sysfs attribute, triggering the crash.

A vulnerability in the Linux kernel's USB Type-C TCPM (Type-C Port Management) driver has been addressed. The issue involved improper validation of the VDO (Vendor Defined Object) count received from a device during the Discover Identity ACK process. This lack of validation could allow a device-controlled value to index into static arrays, potentially leading to data leakage.

A vulnerability in the Linux kernel's USB Type-C TCPM (Type-C Port Management) driver can lead to a buffer overflow in the altmode description array. This issue arises in the 'svdm_consume_modes' function, where the number of altmodes is checked against the array size only once before processing. While this oversight is typically harmless during normal SVID (Standard Vendor ID) discovery, it can be exploited by a malicious port partner. Such a partner can manipulate the altmode count and send additional VDOs (Vendor Defined Objects), causing the function to write past the allocated buffer. This vulnerability affects the Linux kernel stable tree.

A vulnerability in the Linux kernel's USB Type-C DisplayPort altmode handling has been addressed. A broken or malicious device can send an incorrect count for a status update VDO, leading the kernel to read uninitialized stack data and potentially expose it elsewhere. The vulnerability arises from insufficient validation of the count before processing the VDO update. This issue affects the stable versions of the Linux kernel.

A vulnerability in the Linux kernel's USB Type-C WCOVE driver allows for a buffer overflow in the Power Delivery (PD) message handling. The issue arises in the 'wcove_read_rx_buffer' function, where the PD RX FIFO is copied into a user-provided 'pd_message' structure. This operation can exceed the intended buffer size, leading to potential memory corruption. The vulnerability affects several versions of the Linux kernel.