CVE Vulnerability Catalog

In the Linux kernel's AFS filesystem, callback service message parsers do not pass through -EAGAIN correctly. afs_extract_data() returns -EAGAIN, but it is inadvertently converted to 0, which can lead to incorrect processing.

In the Linux kernel's AFS filesystem, afs_break_some_callbacks() does not check if afs_lookup_volume_rcu() returned NULL (e.g., when the volume is unknown). This could lead to a NULL pointer dereference.

In the Linux kernel's AFS filesystem, there is a lack of locking around modifications of net->cells_dyn_ino. The fix requires taking net->cells_lock exclusively and moving the removal of the cell from net->cells_dyn_ino to afs_destroy_cell_work(), because afs_cell_destroy() runs in RCU cleanup context.

In the Linux kernel's AFS filesystem, afs_insert_volume_into_cell() sets the AFS_VOLUME_RM_TREE flag on the new volume instead of the replaced one. This causes the old volume to be removed from the tree twice and the new volume never to be removed.

In the Linux kernel Minix filesystem, minix_check_superblock() uses minix_blocks_needed() to verify bitmap block counts. The calculation uses unsigned int arithmetic, which can overflow when s_ninodes or s_zones is near UINT_MAX. This leads to accepting a zero bitmap block count, and then minix_fill_super() dereferences s_imap[0] or s_zmap[0], causing a kernel panic.

In the Linux kernel cachefiles module, the nomem_d_alloc error path in cachefiles_get_directory() has a double unlock. When start_creating() fails with -ENOMEM, it already releases the parent directory lock, but the error path calls inode_unlock() again, corrupting the rwsem state.

In the Linux kernel iomap code, when trimming io_size to EOF, an underflow can occur if end_pos is below ioend->io_offset. This causes io_size to wrap to a huge value, potentially leading to errors in write handling and data corruption.

In the Linux kernel netfs module, error handling in the writeback_iter() loop is incorrect. If an error occurs, writeback_iter() needs to be called again with the error set to clean up iteration state, and the current folio needs unlocking and redirtying.

In the Linux kernel, the drm/xe/pf driver was found to process FAST_REQ or EVENT messages, which can break the VF/PF ABI protocol and trigger an assert on the PF side. The fix prevents the PF from handling these message types.

In the Linux kernel, the drm/xe/pt driver has an issue with invalid cursor access for purged BOs. Functions xe_pt_hugepte_possible() and xe_pt_scan_64K() did not check if the BO was purged, leading to warnings and potential misbehavior.

In the Linux kernel, the uprobes mechanism for x86 has a bug where the wrong mm_struct is used in __in_uprobe_trampoline. In the unregister path, current->mm is used instead of the traced process's mm_struct, which is incorrect in the tracer context.

In the Linux kernel, the cifs module has a missing credit release in the failure path of cifs_issue_read(). This can lead to overwriting the credits value when retrying the subrequest, disrupting resource management.

In the Linux kernel, a use-after-free vulnerability was found in the NTFS filesystem's $MFT writeback path. The issue arises from dereferencing a runlist element pointer after releasing the lock, while concurrent $MFT allocation extension can free the underlying memory. This can lead to system crashes or potential code execution.

In the Linux kernel's NTFS filesystem, a use-after-free vulnerability was found in ntfs_attr_fallocate(). The issue arises from dereferencing a runlist element pointer after releasing the lock, which can lead to accessing freed memory. An attacker could exploit this flaw to cause a system crash or potentially escalate privileges.

In the Linux kernel, the HID-BPF module has a vulnerability in hid_bpf_get_data() due to an incorrect range check. Because of unsigned arithmetic, a very large size can wrap the sum and bypass the check, allowing a pointer outside the buffer to be returned.

In the Linux kernel, the netfilter xt_u32 module lacks validation of shift counts supplied by rules. A malformed rule can provide a shift count of 32 or more, triggering an undefined shift out-of-bounds during packet evaluation. Validation of XT_U32_LEFTSH and XT_U32_RIGHTSH operands was added in u32_mt_checkentry() to reject malformed rules before they reach the packet path.

In the Linux kernel, the netfilter xt_connmark module (revision 2) lacks validation of shift parameters. A shift_bits value of 32 or more triggers an undefined shift, and invalid shift_dir values are accepted and silently fall back to left shift. The fix rejects invalid parameters in connmark_tg_check() so errors are caught at rule installation time.

In the Linux kernel, the net/mlx5 (LAG) module has an off-by-one error in mlx5_lag_create_single_fdb() during error rollback. The cleanup loop starts at index i, which can operate on uninitialized state or double-tear-down a rule. The fix changes the loop start to i - 1 so only successfully-installed entries are undone.

In the Linux kernel, the mlx5e (TC) driver has a vulnerability causing a kernel crash when cleaning up peer flows in a LAG configuration. The issue occurs when mlx5_lag_get_dev_seq() returns an error, leading to invalid memory access. The fix skips peer processing when the LAG sequence lookup fails.

In the mlx5e driver for Mellanox network cards, a vulnerability was found involving zero-sized buffer allocation for HV VHCA stats. The buffer is allocated before channel initialization when the channel count is zero, resulting in ZERO_SIZE_PTR instead of NULL. After channels open and hypervisor reporting is enabled, a memset operation on this pointer causes a page fault at address 0x10.