CVE Vulnerability Catalog

A bug in the Linux kernel's IPv6 route handling caused an ECMP sibling count mismatch when clearing the RTF_ADDRCONF flag. Adding a static route with the same gateway as an existing route could trigger a kernel BUG in fib6_add_rt2node(). The fix only clears RTF_ADDRCONF for routes without a gateway.

In the Linux kernel, a safety check was added in the HID Intel-thc-hid (Intel-thc) driver before reading the DMA buffer to avoid unexpected NULL pointer access. The fix adds a DMA buffer readiness check before reading the buffer.

W jądrze Linuxa naprawiono podatność związana z wyciekiem pamięci w operacjach DMA dla acp3x PDM w module ASoC dla AMD.

In the Linux kernel, the hwmon acpi_power_meter driver has a deadlock issue related to acpi_power_meter_notify(). It calls hwmon_device_unregister() under a lock that is also acquired by sysfs attribute callbacks of the device being unregistered, which can cause deadlocks between sysfs access and device removal. The fix moves the hwmon device removal outside that lock, adds a static mutex to serialize notification handling, and adds error checks for hwmon device registration.

In the Linux kernel, the SMB server (ksmbd) has a refcount leak in smb2_open(). When ksmbd_vfs_getattr() fails, the reference count of ksmbd_file is not released.

W jądrze Linuxa rozwiązano podatność związaną z brakiem odpowiedniej przestrzeni w buforze skb przed operacją skb_push. Problem ten mógł prowadzić do sporadycznych błędów typu skb_under_panic w funkcji wl1271_tx_work.

In the Linux kernel, the net/mlx5e TC flow deletion code iterated over all possible devcom ports, including non-existent peers. This caused a NULL pointer dereference and kernel oops during TC operations on Mellanox interfaces. The fix limits cleanup to actual existing devcom peers.

In the Linux kernel, the ice driver (Intel E810) contains a NULL pointer dereference in ice_vsi_set_napi_queues() during resume from suspend. When rings[q_idx]->q_vector is NULL, a kernel oops occurs and the system crashes. The issue affects kernel v6.18 and was fixed by adding NULL checks.

In the Linux kernel, the rocker driver has a memory leak in rocker_world_port_post_fini(). The wpriv memory allocated for each port is not freed when the port_post_fini callback is NULL (as in rocker_ofdpa_ops), leading to a memory leak on every device removal.

In the Linux kernel, the amdgpu driver has a NULL pointer dereference in amdgpu_gmc_filter_faults_remove. On APUs such as Raven and Renoir, the ih1/ih2 interrupt rings are not initialized, but the function unconditionally uses ih1, causing a crash when retry fault handling is enabled (noretry=0). The issue was exposed by changing the default for Renoir from noretry=1 to noretry=0.

A memory leak exists in the octep_device_setup() function in the Linux kernel. If octep_ctrl_net_init() fails, the function returns without unmapping mapped resources and freeing allocated configuration memory.

W jądrze Linuxa zidentyfikowano podatność, która prowadzi do zastoju systemu z powodu oczekiwania procesów na zakończenie operacji zapisu stron metadanych w systemie plików btrfs. Problem dotyczy mechanizmu ograniczania zanieczyszczenia pamięci, który w niektórych przypadkach może prowadzić do deadlocku.

In the gs_usb CAN driver, gs_usb_receive_bulk_callback() may dereference an uninitialized netdev pointer on a short read when netdev has not yet been assigned. The fix initializes the pointer to NULL and reports the error value of the failed URB resubmit.

A bug in GSO segmentation for GRO packets with frag_list was fixed in the Linux kernel, causing low throughput during IPv4/IPv6 protocol translation by XLAT. The issue occurred because skb_segment_list incorrectly processed GRO packets after translation, as XLAT only translates the header of the head skb, leaving frag_list skbs untranslated. The patch forces the SKB_GSO_DODGY flag for GSO packets in translation helpers, ensuring fallback to the safer skb_segment function instead of skb_segment_list.

In the Linux kernel, the wifi mac80211 subsystem incorrectly decodes TTLM (TID-To-Link Mapping) elements with a default link map. When a default mapping is used, parsing is not skipped properly, causing a one-byte read beyond the end of the element.

In the Linux kernel Bluetooth MGMT subsystem, set_ssp_complete() fails to free mgmt_pending_cmd structures after removing them from the pending list, causing a memory leak. The same issue exists in set_advertising_complete().

In the Linux kernel, the DRM subsystem's drm_gem_change_handle_ioctl() allows userspace to pass a new handle larger than INT_MAX, triggering a kernel warning in idr_alloc().

In the Linux kernel, a flaw was fixed in hci_uart where hci_uart_set_proto() sets HCI_UART_PROTO_INIT before hu->priv is initialized by proto->open(). If a TTY write wakeup occurs during this window, write_work may be scheduled and access the uninitialized hu->priv pointer, causing a NULL pointer dereference in hci_uart_write_work(). The fix moves setting the flag after proto->open() succeeds.

W jądrze Linuksa naprawiono podatność związaną z wyciekiem iloc.bh w funkcji ext4_xattr_inode_update_ref. Problem polegał na tym, że w przypadku błędu nie zwalniano licznika referencji dla iloc.bh.

In the Linux kernel, a flaw was fixed in mm/damon/sysfs where, if a DAMON context sysfs directory setup failed after creating the attrs/ directory, subdirectories of attrs/ were not cleaned up. This nearly broke the DAMON sysfs interface until reboot and leaked memory for the unremoved directory. The fix ensures cleanup on such failures.