CVE Vulnerability Catalog

In the Linux kernel, the SPI bus accesses the driver_override field without a lock when match() is called from __driver_attach(), which can cause a use-after-free. The fix uses the driver-core driver_override infrastructure that handles locking internally.

In the Linux kernel, the s390 syscall number is directly controlled by userspace but lacks an array_index_nospec() boundary to prevent access past the syscall function pointer tables.

In the Linux kernel, after removal of TIF_ISOLATE_BP, the load of the current task pointer into r12 on kernel entry was dropped but r12 was not added to the register clearing sequence. The fix adds xgr %r12,%r12 to make the register scrub consistent across all entry points.

In the Linux kernel, a potential deadlock exists during CPU hotplug in the osnoise subsystem. The incorrect lock ordering of cpus_read_lock() and mutex_lock(&interface_lock) can cause a deadlock when an osnoise task tries to acquire the mutex while a CPU is going offline.

In the Linux kernel, a vulnerability was found in softleaf_to_folio() in mm/huge_memory.c. Missing memory barrier (smp_rmb) causes a race condition between folio splitting and zap_nonpresent_ptes(), leading to VM_WARN_ON_ONCE or BUG_ON.

In the Linux kernel, the drm/amdgpu driver has an issue with immediate PASID reuse. When a process exits and frees its PASID, page faults may still be pending in the IH ring buffer, causing interrupt issues if the same PASID is immediately reused by a new process. The fix uses an idr cyclic allocator similar to the one used for kernel PIDs.

In the Linux kernel, in the drm/amd/display driver in amdgpu_dm, when a sink is connected, aconnector->drm_edid is overwritten without freeing the previous allocation, causing a memory leak on resume. The fix frees the previous drm_edid before updating it.

In the Linux kernel, the drm/amd/display driver did not check whether the ext_caps pointer is valid during backlight (BL) setup. LVDS connectors lack extended backlight caps, so accessing an invalid pointer may cause issues.

W jądrze Linuxa zidentyfikowano podatność, która pozwala na dereferencję wskaźnika NULL w przypadku, gdy użytkownik z uprawnieniami ustawi nr_contexts na 0 podczas działania DAMON. Problem występuje, gdy nie sprawdzono, czy kdamond->contexts->nr == 1 przed dostępem do contexts_arr[0].

W jądrze Linuxa zidentyfikowano podatność, która została rozwiązana. Funkcja damon_sysfs_repeat_call_fn() wywołuje inne funkcje bez sprawdzenia wartości contexts->nr, co może prowadzić do dereferencji wskaźnika NULL, jeśli nr_contexts jest ustawione na 0.

A vulnerability has been identified in the Linux kernel that occurs during the splitting of a PUD entry in the walk_pud_range() function. It may lead to a kernel bug when a thread attempts to read the numa_maps of a process while VFIO-PCI is setting up DMA.

In the Linux kernel, the ext4 filesystem replaces BUG_ON() with proper error handling in ext4_read_inline_folio. When inline data size exceeds PAGE_SIZE, instead of kernel panic, an error is logged, buffer head is released, and -EFSCORRUPTED is returned.

In the Linux kernel, the idxd dmaengine driver attempts to restore or free the event log even when it was not allocated. This can cause a crash when handling errors that trigger Function Level Reset (FLR) on hardware that does not support event log reporting.

A memory leak vulnerability was found in the Linux kernel's idxd driver during workqueue reset. The issue occurs because the workqueue type is set to NONE before its resources are released.

In the Linux kernel, the idxd dmaengine driver leaks event log memory during device removal. The driver checks whether event log support was enabled before deallocating, but a device reset zeroes the configuration registers, so the deallocation is skipped.

In the Linux kernel, the netfs subsystem's netfs_limit_iter() hits BUG() for ITER_KVEC iterators, which are not handled. This occurs, for example, when a process crashes and the kernel writes a core dump to a 9P filesystem.

A flaw was found in Red Hat Quay where the password re-verification prompt for sensitive operations, such as token generation or robot account creation, can be bypassed. A user with a timed-out session, or an attacker with access to an idle authenticated browser session, can perform privileged actions without providing valid credentials, despite the UI displaying an error for invalid credentials.

When using the zoneToCache function with a malicious authoritative server, an attacker can send a zone that results in a null pointer dereference due to a missing consistency check, leading to a denial of service.

A malicious authoritative server can send an RPZ record that triggers a null pointer dereference due to a missing consistency check, resulting in a denial of service.

An attacker can send replies that result in a null pointer dereference due to a missing consistency check, leading to a denial of service. Cookies are disabled by default.