CVE Vulnerability Catalog

In the Linux kernel's AppArmor module, a race condition exists in Unix socket mediation when peer_path is used. Accessing the path outside the state lock allows a race with unix_release_sock(), potentially leading to use-after-free.

In the Linux kernel's AppArmor module, a refcount leak exists when updating sk_ctx. update_sk_ctx() transfers the plabel reference, but the caller unconditionally puts it, leading to a refcount imbalance.

In the Linux kernel's AppArmor module, a vulnerability exists where the label build is checked before the no_new_privs test. aa_change_profile() builds a replacement label that can return NULL or ERR_PTR, but the result is passed to aa_label_is_unconfined_subset() before the IS_ERR_OR_NULL() check, potentially dereferencing an invalid label.

In the Linux kernel's AppArmor module, a resource leak exists in aa_label_alloc(). The function allocates a secid before allocating or taking the label proxy. If the later proxy step fails, the error path only frees the label memory, leaking resources initialized by aa_label_init().

In the Linux kernel, the AppArmor module has a bug where an uninitialized pointer is passed to audit_log_untrustedstring(). The bug was introduced by commit 4a134723f9f1 and can lead to a page fault during file operations when the path is replaced by aa_null.dentry. The issue was observed on kernel 7.0.2 openSUSE Tumbleweed.

In the Linux kernel, the MIPI I3C HCI driver has a race in i3c_hci_addr_to_dev() that traverses the I3C device list without proper locking. The fix introduces a dedicated lookup table and synchronization via hci->lock.

In the Linux kernel's i915 (drm) driver, intel_crtc_put_color_blobs() releases CRTC color blob references but does not clear the pointers. This can lead to double-free when the CRTC state is cleaned up again.

In the Linux kernel's xfrm module, xfrm_selector_match() can perform a shift-out-of-bounds for an AF_UNSPEC selector with a large prefixlen. The fix adds validation of families and prefix lengths.

In the Linux kernel's amdkfd (drm) driver, kfd_criu_resume_svm() does not remove elements from the list before freeing memory, leading to use-after-free and double-free. The fix adds list_del() before kfree().

In the Linux kernel, the ALSA USB-audio driver for Qualcomm platforms has a vulnerability due to missing validation of the interface index in the stream disable path. A disable request with an invalid interface can lead to NULL pointer dereference or out-of-bounds memory access, potentially causing a system crash or memory corruption.

A vulnerability in the Linux kernel's flow_dissector mechanism unconditionally reads Ethernet addresses (ETH_ADDRS) from the packet header, even when the device has no link-layer header (e.g., TUN in L3 mode). This leads to reading uninitialized skb memory, which can be used as a key in a rhashtable, potentially causing unpredictable TC filter matching. The fix adds checks for device type (ARPHRD_ETHER) and whether the MAC header is set.

In the Linux kernel, the md/raid1 module has a vulnerability involving writes_pending and barrier reference leaks on write failures. Some error paths in raid1_write_request() complete the bio without calling md_write_end(), leading to unbalanced counters.

In the Linux kernel, the md/raid10 module has a vulnerability involving writes_pending and barrier reference leaks on discard failures. Some error paths in raid10_handle_discard() complete the bio without calling md_write_end() or allow_barrier(), leading to unbalanced counters.

In the Linux kernel, in the netfilter/ipset module, kfree_rcu() was called before rcu_assign_pointer() when handling the comment extension, which is incorrect order. The order was fixed so that rcu_assign_pointer() is called first.

In the Linux kernel, in the netfilter/ipset module, when destroying a set, cancel_delayed_work_sync() was called while gc unconditionally calls queue_delayed_work(), which can prevent proper shutdown of gc. This was fixed.

In the Linux kernel, in BPF, there is an effective prog array index error with BPF_F_PREORDER. replace_effective_prog() and purge_effective_progs() located the slot in the effective array by walking the program hlist and counting entries linearly, which does not match the array layout when a preorder program is present.

In the Linux kernel BPF mechanism, during cleanup of dead stack slots in 4-byte halves, when the high half of a STACK_SPILL slot is dead and the low half remains live, converting the low half to STACK_MISC or STACK_ZERO clears the spilled_ptr metadata. This is safe only for scalar spills, but for pointer spills it allows a later 32-bit fill from the live half to bypass the normal non-scalar register-fill check and be treated as an ordinary scalar stack read. The fix leaves non-scalar spill slots intact in this half-live shape, which is conservative for pruning and preserves the existing rejection path for partial fills from pointer spills.

In the Linux kernel ice driver, there is a resource leak of CTRL VSI when resetting all VFs with FDIR filters enabled. The ice_reset_all_vfs() function only invalidates CTRL VSIs but does not free them, leading to resource leak. The fix uses ice_vf_ctrl_vsi_release() instead of ice_vf_ctrl_invalidate_vsi(), aligning with the behavior of ice_reset_vf().

In the Linux kernel BPF mechanism, conntrack lookup and allocation kfuncs take an opts pointer and an opts__sz argument. The verifier checks only the memory range described by opts__sz, but the wrappers unconditionally write opts->error whenever the internal helper returns an error. For an invalid size smaller than the end of opts->error, that write can land outside the verifier-checked range. The fix keeps returning NULL for invalid arguments, but only reports the error through opts->error when the supplied size includes the field.

A race condition was found in the Linux kernel's md/raid5 subsystem during stripe batch breaking. The issue involves R5_Overlap flag operations, potentially causing a process to hang (wait_on_bit) due to a missed wake-up. The fix expands the protected zone and reorders batch_head pointer updates to prevent concurrent access.