CVE Vulnerability Catalog

A bug was fixed in the Linux kernel's KCM (Kernel Connection Multiplexor) module related to handling partial sendmsg errors. When copying data into a newly allocated skb in the frag_list failed, an empty skb remained in the chain, later triggering a WARN_ON in kcm_write_msgs(). The fix tracks the predecessor skb (frag_prev) and removes the empty skb on error.

W jądrze Linuxa rozwiązano podatność związaną z brakiem sprawdzenia typu sygnału w funkcji dcn401 get_phyd32clk_src. Próba dostępu do linku enc na linku dpia może prowadzić do awarii systemu.

A vulnerability has been identified and resolved in the Linux kernel. The issue occurs when the second-stage kernel is booted via kexec with limiting parameters, potentially leading to a kernel panic due to memory range errors.

In the Linux kernel, the net/sched act_skbedit module's tcf_skbedit_hash() can trigger a divide-by-zero when the queue mapping range is 65536 and wraps to 0 in u16. The fix computes mapping_mod in a wider type and rejects ranges larger than U16_MAX.

A vulnerability was fixed in the Linux kernel's team driver where a NETDEV_CHANGEMTU event was triggered during slave unregistration. This led to a reference leak and a hang in unregister_netdevice, preventing the network device from being freed.

In the hfs filesystem, next_id, folder_count, and file_count in the super block info were expanded to 64 bits, and BUG_ONs were added to detect overflow. If the MDB is corrupted, the BUG_ON is triggered, causing a crash. The patch replaces this mechanism with proper error handling.

In the Linux kernel, the media: pvrusb2 driver has a URB leak in pvr2_send_request_ex. When a write URB is submitted successfully but the read URB submission fails (e.g., returns -ENOMEM), the function returns immediately without waiting for the write URB to complete, leading to a 'URB submitted while active' warning on subsequent calls.

In the Linux kernel, the AMD IOMMU subsystem has a sequence allocation serialization issue under concurrent TLB invalidations. The cmd_sem_val counter was incremented outside the IOMMU spinlock, causing random completion wait timeouts and breaking CMD_COMPL_WAIT ordering. The fix moves the increment under iommu->lock.

In the Linux kernel, a vulnerability in the cpsw_new network driver may cause an attempt to unregister a network device that has not been registered yet. This occurs when an error happens during the registration of the first MAC, leaving the second MAC unchanged, potentially leading to an incorrect unregister_netdev() call.

In the Linux kernel, a lock was dropped in skb_may_tx_timestamp() that could lead to a deadlock when handling TX timestamps in interrupt context. The function could acquire sock::sk_callback_lock, which must not be used in IRQ context. The fix removes the lock and uses READ_ONCE() to read pointers, adding WRITE_ONCE() when clearing them.

A previous attempt to ignore DSP responses arriving after a stream had been closed did not work — those responses were still handled, causing lockups. The fix unconditionally drops all DSP responses associated with closed data streams.

In the Linux kernel, the APEI/GHES ARM processor error handling lacks size checks, potentially leading to out-of-bounds memory access. If the BIOS generates a very small or incomplete error record, the kernel may crash (OOPS) when accessing section_length or ctx_info->size.

In the Linux kernel, the drm/amdgpu driver lacks validation of user queue sizes. The size must be a power of two and at least AMDGPU_GPU_PAGE_SIZE to prevent GPU faults or unexpected behavior.

On DCN35, disabling TMDS output turned off the PHY PLL, which caused the OTG to remain stuck and could lead to a hang in DCHVM's ability to ACK invalidations. The fix backports the DCN401 implementation to DCN35, ensuring an atomic PHY FSM transition to PLL_ON.

In the Linux kernel, the media: v4l2-async subsystem has error handling issues after finding a match. Improper management of async connection lists and pointers can lead to use-after-free or other problems.

W jądrze systemu Linux zidentyfikowano podatność, która dotyczy nieprawidłowego sprawdzania wsparcia dla PTP w funkcji ixp4xx_get_ts_info(). Wywołanie ixp46x_ptp_find() odbywa się bezwarunkowo, co prowadzi do błędu dereferencji wskaźnika NULL i awarii systemu.

In the Linux kernel, cper_print_fw_err() did not check whether the error record length was large enough to handle the offset. On bad firmware, if the offset exceeds the actual record, length -= offset underflows, causing a dump of the entire memory region.

In the Linux kernel, the USB dwc3 gadget driver could call dwc3_gadget_vbus_draw() from atomic context, which invoked power-supply-core APIs performing operations that may sleep. This led to kernel panics. The fix moves vbus_draw into a workqueue context.

In the Linux kernel, the drm/buddy module lacks validation of rounded allocation sizes, potentially leading to BUG_ON. Rounding up the size can exceed available memory and trigger a kernel crash.

In the Linux kernel, the ocfs2 filesystem has a bug in reflink preserve cleanup of xattr entries. The previous fix (commit c06c303832ec) did not handle all cases: the 'last' pointer was not shifted by one unit after cleaning an array entry, and the first entry was not cleaned when xh_count is 1.