CVE Vulnerability Catalog

W jądrze systemu Linux zidentyfikowano podatność, która pozwala na błędne usunięcie gniazda z kolejki odbiorczej przez zbieranie śmieci (GC) w wyniku wywołania MSG_PEEK. Problem ten występuje w sytuacji, gdy gniazdo jest zamykane podczas sprawdzania jego stanu przez GC, co prowadzi do nieprawidłowego wniosku o martwym gnieździe.

W jądrze systemu Linux zidentyfikowano podatność związana z wyciekiem pamięci w funkcji ice_set_ringparam. Problem polega na tym, że w przypadku niepowodzenia alokacji rx_rings, tx_rings i xdp_rings pozostają niezwolnione, co prowadzi do wycieku pamięci.

In the Linux kernel, the gve driver in DQ-QPL mode incorrectly uses the RDA buffer cleanup path in gve_tx_clean_pending_packets. This leads to attempts to unmap incorrect DMA addresses and out-of-bounds access on the dma_addr_t array, causing UBSAN warnings.

In the Linux kernel netfilter/nf_tables subsystem, a vulnerability was found due to unnecessary set cloning during flush operations. A memory allocation failure with GFP_KERNEL triggers a WARN splat and may cause system instability.

The Linux kernel lacks HID_CLAIMED_INPUT guards in some raw_event callbacks of HID drivers. This can cause a crash when a broken HID device is connected.

A NULL pointer dereference vulnerability was found in the Linux kernel's bridge br_do_suppress_nd() function. It occurs when IPv6 is disabled via ipv6.disable=1 and an ICMPv6 Neighbor Discovery packet reaches the bridge, causing a kernel crash.

In the Linux kernel, the ETS (Enhanced Transmission Selection) network scheduler has a divide-by-zero vulnerability in the offload path. The issue is caused by unsigned integer overflow when computing WRR weights, potentially leading to a kernel panic.

In the Linux kernel, the ice driver sets the frag_size field in XDP RxQ info to the DMA write length instead of the full buffer size xdp.frame_sz. The only user, bpf_xdp_frags_increase_tail(), expects the whole buffer size, leading to negative tailroom and a potential kernel panic. The fix uses the fill queue buffer truesize instead of the DMA write size.

In the Linux kernel, the nvmet-fcloop module's fcloop_t2h_xmt_ls_rsp does not check remoteport port_state before invoking the done callback. When the port is not online, this can lead to improper freeing of lsrsp resources.

A flaw was fixed in the Linux kernel's file_thp_enabled() function, which incorrectly allowed THP (Transparent Huge Pages) for files on anonymous inodes such as guest_memfd and secretmem. With CONFIG_READ_ONLY_THP_FOR_FS enabled, these files appeared as read-only regular files, enabling large folio creation and leading to kernel warnings or crashes (e.g., BUG: unable to handle page fault in secretmem). The fix excludes anonymous inodes from THP eligibility.

In the Linux kernel, __blk_add_trace() called tracing_record_cmdline() from process context with preemption enabled, even though that function uses __this_cpu_read/write operations that require preemption to be disabled. This triggered a kernel BUG (using __this_cpu_read() in preemptible code) and dmesg spam, as detected by the blktests/blktrace/002 test. The same issue occurs in the blk_add_trace_plug(), blk_add_trace_unplug(), and blk_add_trace_rq() paths.

W jądrze Linuxa zidentyfikowano podatność związaną z niewłaściwym dziedziczeniem parametrów przez zadania SCHED_DEADLINE podczas zmiany priorytetu. Problem ten może prowadzić do błędów w obliczaniu pasma, gdy zadanie nie jest poprawnie oznaczane jako wzmocnione.

In the Linux kernel, the dell-wmi-sysman driver's set_new_password() function hex dumped the entire buffer containing plaintext passwords. The hex dump has been removed to prevent credential leakage.

In the Linux kernel, a bug in the i2c-i801 driver was fixed by reverting a change that replaced acpi_lock with the I2C bus lock. Under rare circumstances, multiple udev threads can concurrently access i801_acpi_io_handler during boot, leading to a NULL pointer dereference and kernel panic.

An AB-BA deadlock was discovered in the Linux kernel during PHY LED trigger registration. The issue occurs when both LEDS_TRIGGER_NETDEV and LED_TRIGGER_PHY are enabled, causing mutual blocking when accessing the trigger list and the RTNL mutex.

In the Linux kernel, the radiotap parser did not reject radiotap fields with unknown bits, leading to a comparison against an uninitialized iterator->_next_ns_data value. The vulnerability was fixed by moving the rejection of unknown radiotap fields down to after the in-namespace lookup.

In the Linux kernel, the drm/client subsystem's drm_client_modeset_probe may fail to kcalloc 'modes'. On failure, it jumps to 'out' and calls modes_destroy, which dereferences NULL, potentially causing a NULL pointer dereference. The fix prevents this.

In the Linux kernel, the kalmia USB driver lacks validation of USB endpoints. A malicious USB device without the expected endpoints can cause a kernel crash when the driver blindly accesses them.

In the Linux kernel, the CAN BCM module has a locking bug for bcm_op runtime updates. When the RX_RTR_FRAME flag is set, the RX path uses bcm_can_tx() and bcm_tx_lock, which was not initialized in bcm_rx_setup(), leading to improper lock state.

In the Linux kernel, an admin queue leak occurs on NVMe controller reset. When nvme_alloc_admin_tag_set() is called during a reset, a previous admin queue may still exist and is not released before allocating a new one.