CVE Vulnerability Catalog

In the Linux kernel F2FS filesystem, a bug causing a crash (BUG) during garbage collection (GC) was found. The issue occurs when an already updated page is re-read from disk, triggering a VM_BUG_ON_FOLIO assertion.

A vulnerability in the Linux kernel's F2FS filesystem causes data loss when fsync on a newly created file runs concurrently with a checkpoint operation. Incorrect use of nat_entry flags leads to premature assumption that the checkpoint has completed, resulting in data loss after a power failure.

In the Linux kernel, the EROFS filesystem vulnerability was found where the `lcn` variable was typed as `unsigned long`, which is only 32 bits wide on 32-bit platforms. This causes truncation of the `(lcn << lclusterbits)` shift beyond 4 GiB, potentially leading to block addressing errors.

In the Linux kernel's net/sched/act_mirred module, a bug was found in the tcf_blockcast_redir function. When iterating block ports to redirect packets to multiple devices, the mac_header_xmit flag was queried from the wrong device (the next in iteration, not the one being sent to). This causes incorrect decisions about pushing or pulling the MAC header, leading to skb header corruption and, in worst cases, a kernel panic due to headroom exhaustion.

In the Linux kernel's macvlan driver, the macvlan_get_size() function does not reserve space for the IFLA_MACVLAN_BC_CUTOFF attribute. This causes -EMSGSIZE errors and a WARN_ON in rtnetlink when dumping the interface if bc_cutoff is set to a value other than 1.

In the Linux kernel, a vulnerability occurs when an IPv6 nexthop is replaced with an IPv4 nexthop without updating the has_v4 flag in all groups containing this nexthop. This allows IPv6 routes to reference groups with only AF_INET members, causing a NULL pointer dereference and system panic.

A race condition was found in the Linux kernel's ice driver during TX timestamp ring cleanup. Lack of proper synchronization between ice_free_tx_tstamp_ring() and ice_tx_map() can lead to a NULL pointer dereference.

In the Linux kernel's ice driver, a potential NULL pointer dereference was found in the error path of ice_set_ringparam(). The issue occurs because tstamp_ring is nullified without clearing the ICE_TX_RING_FLAGS_TXTIME flag, leading to a NULL dereference in ice_free_tx_tstamp_ring() if ice_setup_tx_ring() fails.

A vulnerability in the Linux kernel netfilter xtables module incorrectly uses NFPROTO_UNSPEC in the xt_mac, xt_owner, xt_physdev, and xt_realm extensions. This causes filtering rules to be applied to unexpected protocol families, potentially leading to firewall misconfiguration.

In the Linux kernel's dualpi2 queuing discipline (net/sched), a vulnerability was found in the draining of both C-queue and L-queue during configuration change. The dualpi2_change() function incorrectly handled cases where packets were only in the L-queue, leading to a NULL pointer dereference.

In the Linux kernel, a durable file descriptor leak was found in ksmbd during durable v2 open when ClientGUID mismatches. The reference obtained from ksmbd_lookup_fd_cguid() is not released in the mismatch path, causing resource leaks.

In the Linux kernel's RDS subsystem, a vulnerability was found where the per-item info buffer is not zeroed before being passed to visitor functions. This leads to kernel stack data leakage to user space when the RDS connection is not in RDS_CONN_UP state.

In the Linux kernel, the vsock/virtio driver had a bug in virtio_transport_init_zcopy_skb() that used an already-consumed iterator (iter->count) for pinned-pages accounting, skipping RLIMIT_MEMLOCK enforcement on the last skb. This could lead to uncontrolled memory usage.

In the Linux kernel, an inode reference leak occurs in fsnotify_recalc_mask() because the return value of __fsnotify_recalc_mask() (an inode pointer) is discarded, preventing iput() and fsnotify_put_sb_watched_objects() from being called. This leads to a hung task during filesystem unmount.

In the Linux kernel, a vulnerability in the netdevsim module was found where the nsim_dev_trap_skb_build function does not zero-initialize the IP header structure in a dummy sk_buff. This can lead to uninitialized data leaks detected by KMSAN.

In the Linux kernel's net/sched: netem subsystem, a vulnerability was found where the queue limit check only counted packets in the internal tfifo, ignoring packets placed in sch->q by the reorder path (__qdisc_enqueue_head). This allowed the total queue occupancy to exceed sch->limit during reordering.

A vulnerability in the Linux kernel's CFS scheduler causes a newly forked task to inherit an incorrect rel_deadline flag. This leads to a deadline miscalculation, vruntime overflow, and a subsequent NULL pointer dereference when sched_yield() is called.

In the Linux kernel's PSP (Packet Security Protocol) module, a vulnerability was found due to missing check for device unregistration when creating an association. The psp_assoc_device_get_locked() function may obtain a reference to a device that has been unregistered in the meantime, leading to a use-after-free condition.

In the Linux kernel, a vulnerability was found in the PSP (Platform Security Processor) module where dev-set and key-rotate operations modify shared device state (PSP version configuration and cryptographic key material) without requiring CAP_NET_ADMIN privileges. The only access control is psp_dev_check_access(), which only checks network namespace membership.

A vulnerability in the Linux kernel's futex subsystem can cause a live lock during requeue-PI operations. The race condition occurs when a task leaves the queue due to a signal or timeout while a higher-priority task holds the lock, leading to an infinite loop.