CVE Catalog

A vulnerability in the Linux kernel's iSCSI target implementation allows for improper validation of CHAP_R length in BASE64-encoded responses. The issue arises in the chap_server_compute_hash() function, where the input length is not checked before decoding, leading to potential buffer overflows. With MAX_RESPONSE_LENGTH set to 128, up to 127 BASE64 characters can be processed, which can exceed the allocated digest size and cause memory corruption. This vulnerability affects several versions of the Linux kernel.

A race condition vulnerability has been identified in the Linux kernel's Direct Rendering Manager (DRM) Graphics Execution Manager (GEM) handling. The issue arises in the 'drm_gem_change_handle_ioctl' function, where the old handle remains active in the IDR (Identifier Radix Tree) during the interval between unlocking and relocking the table. This creates a window of opportunity for a concurrent 'drm_gem_handle_delete' operation on the old handle to succeed, reducing the handle count to zero and freeing the GEM object, even while the new handle's IDR entry still points to it. The vulnerability has been addressed by nullifying the old handle's IDR entry before releasing the table lock, ensuring that any simultaneous 'GEM_CLOSE' operation on the old handle receives a NULL reference and returns an error. The old entry is restored if an error occurs during the handling process.

A use-after-free vulnerability has been identified in the Linux kernel's Intel graphics driver (drm/i915) within the memory management component for buffer objects (TTM). This issue affects several versions of the Linux kernel and can lead to a general protection fault, particularly under heavy use on affected hardware. The vulnerability arises because the TTM page vector container, which is crucial for managing memory pages of graphics objects, can be replaced while a pointer to the original container is still in use. This flaw allows for the potential dereference of a file pointer field of a TTM page vector container associated with an object being purged on eviction, creating a window for exploitation.

A kfifo underflow vulnerability has been identified in the Linux kernel's Qcom GenI serial driver. This issue arises when the 'uart_flush_buffer()' function is called before the DMA completion interrupt is processed, creating a race condition. The problem occurs as follows: DMA transmission begins with 'tx_remaining' bytes, and the kfifo buffer holds the same number of bytes. Once the DMA completes in hardware, the interrupt is still pending. If 'uart_flush_buffer()' is executed at this point, it resets the kfifo length to zero while 'tx_remaining' remains unchanged. When the DMA interrupt finally arrives, it attempts to advance the transmission on an empty kfifo, leading to a situation where the kfifo length inaccurately reports available data. This miscalculation causes the next DMA transfer to include outdated buffer data, potentially disrupting the intended data transmission process.

A NULL pointer dereference vulnerability has been identified in the Linux kernel's AMD GPU driver (AMDKFD). This issue arises in the 'svm_range_set_attr' function, where the 'process_info' variable can be NULL if the user does not call 'kfd_ioctl_acquire_vm' before 'kfd_ioctl_svm'. This vulnerability has been addressed by adding a check to ensure 'process_info' is valid before proceeding, preventing potential crashes or undefined behavior.

An integer overflow vulnerability has been fixed in the Linux kernel's AMD KFD (Kernel Fusion Driver) debugger. The issue arose in the `get_queue_ids()` function, which calculated the size of an array based on the number of queues. This calculation could overflow on 32-bit systems, leading to potential memory corruption or other unintended behavior. The vulnerability has been addressed by using a safer method that prevents overflow by saturating the value to the maximum size allowed.

A denial-of-service vulnerability has been identified in the Linux kernel's AMDGPU graphics driver. The issue arises in the GEM operation 'AMDGPU_GEM_OP_GET_MAPPING_INFO' within the 'amdgpu_gem_op_ioctl' function. When the function attempts to allocate memory using 'kvcalloc()', a failure can occur, returning an 'ENOMEM' error. This failure path, however, bypasses the necessary cleanup process, leading to a leak of three critical resources: a reference to the GEM object, a lock on the executed GEM, and a lock on the per-process virtual memory root page directory. The leaked lock on the virtual memory directory is particularly problematic, as it blocks any subsequent operations on the same virtual memory, such as further GEM operations or command submissions, creating a local denial-of-service condition for the affected GPU context. This vulnerability can be exploited by any process with access to the '/dev/dri/renderD*' devices.

A vulnerability in the Linux kernel's AMD GPU driver has been addressed. The issue arose in the page retrieval function for the Heterogeneous Memory Management (HMM) range, where the notifier sequence could be read multiple times, potentially leading to the use of invalid pages. This vulnerability affects the Linux kernel stable tree.

A vulnerability in the Linux kernel's AMD GPU driver allows for memory allocation issues in the GEM_OP GET_MAPPING_INFO operation. The vulnerability arises because the driver does not properly validate the user-supplied entry count, leading to potential memory allocations that exceed system limits. This flaw can cause a kernel warning and, on systems configured to panic on warnings, a complete system crash. The issue has been addressed by implementing a size check to prevent excessive entry counts from causing harmful allocations.

A vulnerability has been identified in the Linux kernel's handling of the DECstation DZ serial driver. The issue arises from the driver using legacy probing methods, which can lead to a null pointer dereference and a kernel crash when the first serial port is initialized. This problem occurs because no device is available with the old probing method, and the driver fails to properly manage the serial controller resources. The vulnerability affects the Linux kernel versions prior to the latest stable release, specifically in the DECstation DZ serial driver.

A vulnerability has been addressed in the Linux kernel's handling of the DECstation Z85C30 serial driver. The issue arose because the driver was not properly initializing the first serial port, leading to a kernel crash. This crash occurred due to a null pointer dereference when the driver attempted to access the parent device of the serial port. The vulnerability was present in the Linux kernel versions prior to 6.4.0-rc3 and was caused by the driver using legacy probing methods to discover devices, which is no longer recommended. Instead, the driver has been updated to use platform devices, allowing for a more reliable initialization process that prevents such crashes.

A vulnerability in the Linux kernel's handling of page table entries can lead to incorrect page table walks on ARM64 architectures. This issue arises when the 'huge_pmd_unshare()' function is called to unshare a PMD table. The 'tlb_unshare_pmd_ptdesc()' function sets 'tlb->unshared_tables=true', but the subsequent 'tlb_flush()' call only checks 'tlb->freed_tables'. As a result, stale PMD page table entries can remain in the walk cache, potentially causing errors in page table traversal.

A race condition vulnerability has been identified in the Linux kernel's MCTP USB transport driver. This issue arises from a timing conflict between completing a USB Request Block (URB) and canceling a scheduled retry operation, which can lead to unintended behavior. The vulnerability is present in the Linux kernel stable tree.

A reference leak vulnerability has been identified in the Linux kernel's AMD DNA acceleration component. The issue arises in the 'aie2_populate_range()' function, which fails to properly release a reference to the 'mm_struct' before jumping back to a previous label, leading to a memory leak. This vulnerability affects the Linux kernel stable tree.

A vulnerability exists in the Linux kernel's ESP (Encapsulating Security Payload) handling for both IPv4 and IPv6. When the 'inplace' flag is false, the old page fragments are replaced with new ones from the xfrm page fragment cache. The source scatterlist is created from the old fragments before the replacement, and a function is supposed to release the old page references after the cryptographic operation. However, if the process of building the destination scatterlist from the new page fails, the old page references in the source scatterlist are not released, leading to a memory leak. This issue arises because the error handling only frees the memory for the new page, leaving the old ones unreferenced.

A data-race vulnerability has been identified in the Linux kernel's Bluetooth ISO connection management. The issue arises in several functions, including iso_connect_bis(), iso_connect_cis(), iso_listen_bis(), and iso_conn_big_sync(). These functions call hci_get_route() using certain socket fields without holding the necessary lock, allowing concurrent modifications by other operations. This oversight leads to data-races, as reported by the Kernel Concurrency Sanitizer (KCSAN). The vulnerability has been addressed by modifying the functions to snapshot the required fields under lock before calling hci_get_route(), thereby preventing concurrent access issues.

A vulnerability exists in the Linux kernel's handling of packets on 6LoWPAN interfaces. The issue arises when the AoE driver (or similar) sends non-IPv6 packets, such as those carrying the AoE Ethernet protocol, through the 6LoWPAN interface. The 6LoWPAN header creation process fails to properly initialize the necessary address information for these packets, leading to the transmission of data with uninitialized fields. This vulnerability can be exploited by queuing non-IPv6 packets for transmission on a 6LoWPAN interface, either manually or through automated testing.

A vulnerability in the Linux kernel's mac80211 wireless subsystem allows for out-of-bounds bit shifting when parsing the radiotap header of injected frames. The issue arises in the 'ieee80211_parse_tx_radiotap' function, where an 8-bit value from userspace is used as a shift count. This can lead to undefined behavior, as the shift exponent can exceed the limits of a 64-bit unsigned long, causing a shift-out-of-bounds error. The vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's GARP (Generic Attribute Registration Protocol) attribute parser has been identified, specifically in the receive-side processing of GARP attributes. The issue arises from the parser incorrectly calculating the data length by subtracting the on-wire attribute length (which includes the GARP header) from the size of the attribute structure. This miscalculation creates an unsigned integer underflow, as normal attributes with data have a length greater than the size of the structure. The underflowed value is then truncated and passed to the `garp_attr_lookup()` function, leading to a mismatch between the parsed data length and the length of locally registered attributes. As a result, GARP Join/Leave events are ignored, disrupting the GARP receive path for common attributes like GVRP VLAN registration. The vulnerability affects several versions of the Linux kernel.

A time-of-check to time-of-use (TOCTOU) race condition vulnerability has been identified in the Linux kernel's Multipath TCP (MPTCP) implementation. This issue arises because the MPTCP output path accesses the MPTCP-level acknowledgment sequence multiple times without proper locking, potentially leading to inconsistencies. The vulnerability affects the announced receive window for the same packet, which could confuse the peer. The issue has been addressed by refactoring the code to ensure that the MPTCP receive window is updated only when the egress packet contains a Data-Synchronization Service (DSS) acknowledgment.

A vulnerability exists in the Linux kernel's WiFi MT76 MT7996 driver, where the Wireless Client Identifier (WCID) pointer is not properly cleared when deinitializing a station link. This issue can lead to potential memory management problems. The vulnerability affects several versions of the Linux kernel.

A vulnerability exists in the Linux kernel's handling of certain BPF LSM hooks, specifically 'task_to_inode' and 'inet_conn_established'. These hooks are not compatible with sleepable LSM programs due to being called under contexts that do not allow sleeping. The issue has been addressed by removing these hooks from the sleepable LSM context.

A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem has been addressed. The issue arose because a recent commit added a function to handle tail calls in BPF but failed to check for errors from that function. This oversight could lead to improper handling of stack liveness during BPF tail calls, potentially causing issues in BPF program execution.

A vulnerability has been identified in the Linux kernel's Direct Rendering Manager (DRM) GPU Shared Virtual Memory (SVM) handling. This issue involves an unbalanced lock and unlock sequence for the GPU SVM notifier lock, which can lead to potential synchronization problems. The vulnerability was introduced in version 6.19.0-rc6 and has been fixed in the stable branch.

A vulnerability in the Linux kernel's PCI Mediatek Gen3 controller has been addressed. The issue involved improper handling of IRQ domains in the 'mtk_pcie_setup_irq()' function. IRQ domains were allocated before retrieving the controller's IRQ. If the IRQ retrieval failed, the function returned an error without cleaning up the allocated domains, potentially leading to a resource leak. The vulnerability has been fixed by changing the order of operations, ensuring that IRQ domains are allocated only after successfully fetching the controller's IRQ.

A vulnerability exists in the Linux kernel's SPI MTK SNFI driver, specifically within the NAND Flash Interface handling. The issue arises because the driver fails to properly unregister the on-host NAND Error Correction Code (ECC) engine during probe failures and device removals. This oversight can lead to resource leaks or undefined behavior, as the ECC engine remains registered even when it is no longer needed. The vulnerability affects the Linux kernel stable tree.

A vulnerability in the Linux kernel's RDMA (Remote Direct Memory Access) component has been addressed. The issue arose because certain netlink attributes were treated as C-strings for comparison purposes, but the attribute type 'NLA_STRING' did not ensure the presence of a null terminator. This could lead to improper string handling and potential vulnerabilities. The solution was to change the attribute type to 'NLA_NUL_STRING', which correctly accounts for the null terminator. This change was necessary to prevent any ambiguity in string termination, ensuring that user space applications can reliably interpret the strings being passed.

A vulnerability exists in the Linux kernel's handling of the QDMA TX queue for Airoha Ethernet drivers. The issue arises because the TX descriptors are not properly reset in the cleanup routine, which can lead to incorrect management of the TX ring. This vulnerability affects the stable version of the Linux kernel.

A vulnerability in the Linux kernel's netfilter component, specifically within the nf_tables subsystem, has been addressed. This issue involved the management of hook transactions during the deletion of device hooks, which could disrupt the proper functioning of netlink dump operations. The vulnerability arose because the previous method of handling hook deletions interfered with readers of the RCU-protected hook list, leading to potential inconsistencies.

A vulnerability exists in the Linux kernel's Airoha Ethernet driver, specifically in the fragment transmission loop of the 'airoha_dev_xmit' function. During the final iteration of the loop, the function reads fragment addresses and lengths when the loop index matches the number of fragments. At this point, the fragment data is uninitialized, creating a risk of an unsafe read that could trigger a page fault. Although the uninitialized data is not used, the read operation itself poses a potential risk. This vulnerability affects the Linux kernel stable tree.

A vulnerability in the Linux kernel's AMDGPU VCN 2.0 encoder and decoder rings has been addressed. These rings do not support 64-bit user fence writes, leading to a rejection of command submissions that include user fences. The vulnerability has been fixed by setting the 'no_user_fence' option for the VCN 2.0 rings, allowing them to properly handle command submissions without user fence interference.

A vulnerability in the Linux kernel's AMDGPU VCN version 2.5 encoder and decoder rings has been addressed. These rings do not support 64-bit user fence writes and previously rejected command stream submissions that included user fences. The vulnerability has been resolved by modifying the ring functions to disable user fence support, ensuring compatibility with the hardware's capabilities.

A vulnerability in the Linux kernel's AMDGPU driver for VCN 3.0 has been addressed. The issue arose because the VCN encoder and decoder rings do not allow 64-bit user fence writes, leading to a rejection of command submissions that include user fences. This vulnerability was present in the Linux kernel stable tree.

A vulnerability in the Linux kernel's AMDGPU VCN 4.0 encoder and decoder rings has been addressed. These rings do not support 64-bit user fence writes, leading to a rejection of command submissions that include user fences. The vulnerability has been fixed by setting the 'no_user_fence' option for the VCN 4.0 encoding ring, ensuring compatibility with the hardware's capabilities.

A vulnerability in the Linux kernel's AMDGPU VCN 4.0.3 encoder and decoder rings has been addressed. These rings do not support 64-bit user fence writes, which can lead to issues when command submissions include user fences. The vulnerability arises because the VCN 4.0.3 encoding ring rejects command submissions that use user fences, creating a potential disruption in processing.

A vulnerability in the Linux kernel's AMDGPU VCN 4.0.5 encoder and decoder rings has been addressed. These rings do not support 64-bit user fence writes, leading to a rejection of command submissions that include user fences. The issue has been fixed by setting the 'no_user_fence' option for the VCN 4.0.5 encoding ring.

A vulnerability in the Linux kernel's AMDGPU VCN 5.0.0 encoder and decoder rings has been addressed. These rings do not support 64-bit user fence writes, leading to a rejection of command submissions that include user fences. The vulnerability has been fixed by disabling user fence support for the VCN 5.0.0 encoding ring.

A vulnerability in the Linux kernel's AMDGPU VCN 5.0.1 encoder and decoder rings has been addressed. These rings do not support 64-bit user fence writes, leading to a rejection of command stream submissions that include user fences. The issue has been resolved by modifying the VCN ring functions to disable user fence support, ensuring compatibility with the hardware's capabilities.

A vulnerability in the Linux kernel's AMDGPU driver for JPEG version 2.0 has been addressed. The issue arose because JPEG rings do not accommodate 64-bit user fence writes, leading to the rejection of command stream submissions that included user fences. This vulnerability affects the Linux kernel stable group.

A vulnerability in the Linux kernel's AMD GPU JPEG V2.5 ring has been addressed. This issue arose because JPEG rings do not accommodate 64-bit user fence writes, leading to the rejection of command stream submissions that included user fences. The vulnerability has been resolved by modifying the JPEG V2.5 ring to disable user fence support, ensuring compatibility with the ring's operational requirements.

A vulnerability in the Linux kernel's AMDGPU driver for JPEG V3.0 has been addressed. The issue arose because JPEG rings do not accommodate 64-bit user fence writes, leading to the rejection of command stream submissions that included user fences. The vulnerability has been resolved by modifying the JPEG V3.0 ring to disable user fence support, ensuring compatibility with the ring's capabilities.

A vulnerability in the Linux kernel's AMDGPU JPEG V4.0 ring has been addressed. JPEG rings do not accommodate 64-bit user fence writes, leading to the rejection of command stream submissions that include user fences. This issue has been resolved by setting the 'no_user_fence' attribute for the JPEG V4.0 ring, preventing the use of user fences in a way that could cause compatibility issues.

A vulnerability in the Linux kernel's AMDGPU JPEG V4.0.3 ring has been addressed. This issue arose because JPEG rings do not accommodate 64-bit user fence writes, leading to the rejection of command stream submissions that included user fences. The vulnerability has been resolved by modifying the ring's configuration to disable user fence support, ensuring compatibility with the expected operation of the JPEG hardware.

A vulnerability in the Linux kernel's AMDGPU JPEG V4.0.5 ring has been addressed. This issue arose because JPEG rings do not accommodate 64-bit user fence writes, leading to the rejection of command stream submissions that included user fences. The vulnerability has been resolved by modifying the ring's configuration to disallow user fence writes.

A vulnerability in the Linux kernel's AMD GPU JPEG handling in version 5.0.0 has been addressed. The issue arose because JPEG rings do not accommodate 64-bit user fence writes, leading to the rejection of command stream submissions that included user fences. The vulnerability has been resolved by modifying the JPEG v5.0.0 ring to disable user fence support, ensuring compatibility with the ring's capabilities.

A vulnerability in the Linux kernel's AMDGPU JPEG V5.0.1 ring has been addressed. This issue arose because JPEG rings do not accommodate 64-bit user fence writes, leading to the rejection of command stream submissions that included user fences. The vulnerability has been resolved by modifying the ring's configuration to disallow user fence writes.

A vulnerability in the Linux kernel's AMDGPU JPEG driver for version 5.3.0 has been addressed. The issue arose because JPEG rings do not accommodate 64-bit user fence writes, leading to the rejection of command submissions that included user fences. The vulnerability has been resolved by configuring the JPEG v5.3.0 ring to disallow user fence writes.

A memory leak vulnerability has been identified in the Linux kernel's Lenovo WMI helpers. The issue arises in the function 'lwmi_dev_evaluate_int()', which fails to properly free a pointer when the return value is NULL. This vulnerability is present in the stable version of the Linux kernel.

A potential out-of-bounds access vulnerability has been identified in the Linux kernel's ASoC (ALSA System on Chip) rsnd component, specifically within the Renesas R-Car audio driver. This issue arises because the 'component_dais' array, which is used to manage audio data interfaces, is initially zero-initialized and later populated by the 'rsnd_dai_of_node()' function. The existing boundary check fails to ensure that the last valid element of the array remains zero, allowing the possibility for the loop to incorrectly assume that 'component_dais[RSND_MAX_COMPONENT]' is zero. This flaw can lead to out-of-bounds access, potentially causing memory corruption or other unintended behavior.

A vulnerability in the Linux kernel's ENA (Elastic Network Adapter) driver can lead to an information leak. The issue arises in the PHC (Precision Time Protocol Hardware Clock) support implementation. The function 'ena_phc_gettimex64()' improperly sets the output timestamp parameter without verifying if the preceding timestamp retrieval function succeeded. This oversight can result in the output containing uninitialized memory or invalid hardware values. When these erroneous timestamps are conveyed to userspace through the PTP ioctl, it creates a security risk by leaking sensitive information and introduces a correctness bug. The vulnerability affects the Linux kernel stable tree.