CVE Vulnerability Catalog

In the Linux kernel, in the DAMON sysfs subsystem, when setting up a DAMOS scheme directory fails after the access_pattern directory is created, the subdirectories of access_pattern are not cleaned up. This leaves the DAMON sysfs interface nearly broken until the system reboots and leaks memory for the unremoved directories.

W jądrze systemu Linux zidentyfikowano podatność w funkcji btrfs: send, która nieprawidłowo sprawdza inline extents w funkcji range_is_hole_in_parent(). Niewłaściwy dostęp do pola disk_bytenr może prowadzić do nieprawidłowego dostępu do pamięci, co jest szczególnie niebezpieczne w przypadku inline extents.

In the Linux kernel, the BPF test_run subsystem does not account for the size of the xdp_frame structure when checking the allowed metadata size. This allows userspace to supply an overly large metadata size, which in live packet mode causes xdp_update_frame_from_buff() to fail and packet transmission to proceed with an uninitialised frame structure.

In the Linux kernel, the tracing subsystem has an infinite recursion when recording kernel stack traces with the stack trace trigger enabled for RCU events. The stack trace code calls back into RCU, which calls the stack trace again. The fix expands ftrace recursion protection with a set of bits for contexts (normal, softirq, interrupt, NMI) and uses interrupt context to protect the stack trace.

In the Linux kernel, in the unittest_data_add() function, there is a memory leak. If of_resolve_phandles() fails, the allocated unittest_data is not freed, leading to a memory leak.

W jądrze Linuxa naprawiono podatność związaną z funkcją dma_free_coherent(), która niewłaściwie używała adresów wyrównanych zamiast adresów z pól XXX_unaligned podczas zwalniania bufora DMA.

W jądrze Linuksa naprawiono podatność związaną z funkcją dma_free_coherent(), która niepoprawnie używała wyrównanych adresów zamiast adresów z pól XXX_unaligned podczas zwalniania bufora. To może prowadzić do problemów z zarządzaniem pamięcią w kontekście DMA.

In the Linux kernel, the wifi ath12k driver has a deadlock while flushing management frames. After management transmission was converted to a wiphy work, ath12k_mac_op_flush() called with a NULL vif holds the wiphy lock, preventing the queued transmission work from running. This results in failed authentication/association and a 'failed to flush mgmt transmit queue' error.

In the Linux kernel dpll subsystem, the registration helpers dpll_xa_ref_{dpll,pin}_add() accepted duplicate registrations of the same pin, leading to incorrect reference counting and warnings on unregistration. The fix rejects duplicates by returning -EEXIST.

In the Linux kernel on arm64, a bug occurs when resuming from hibernation. The swsusp_arch_resume() function attempts to verify the CFI hash for swsusp_arch_suspend_exit(), which lacks such a hash, leading to a DABT (Data Abort) and kernel crash. The fix marks swsusp_arch_resume() with __nocfi to disable the CFI check.

A race condition was found in the Linux kernel netdevsim driver regarding operations on the bpf_bound_progs list. Concurrent addition (nsim_bpf_create_prog) and deletion (nsim_bpf_destroy_prog) of list entries without synchronization can cause list corruption and trigger a kernel crash (kernel BUG in lib/list_debug.c).

In the Linux kernel SCTP subsystem, a null-ptr-deref occurs in the transmit path when SCTP-AUTH key initialization fails while processing an INIT_ACK. Because SCTP_CMD_ASSOC_SHKEY runs after the T1_COOKIE timer is started, an authenticated DATA chunk with a NULL shkey can be queued and transmitted, leading to a kernel crash.

A data race was fixed in the Linux kernel's ndisc_router_discovery() function handling IPv6. The function could read and write in6_dev->ra_mtu without holding a lock, as detected by syzbot using KCSAN. The fix adds READ_ONCE()/WRITE_ONCE() macros to document and mitigate the race.

In the Linux kernel, the igc driver reduces the TSN TX packet buffer from 7 KB to 5 KB per queue to avoid TX unit hangs under heavy timestamping load, matching I225/I226 TSN recommendations.

A data race around the dev->work field in the Linux kernel mISDN subsystem has been fixed. The field was read without locking in mISDN_read() and mISDN_poll(), as detected by KCSAN. The fix adds READ_ONCE()/WRITE_ONCE() annotations for safe access.

A data-race in the Linux kernel's l2tp_tunnel_del_work() function in the L2TP module has been fixed. The sk_socket field should only be read for kernel sockets, and the careless read raced with sk_common_release() closing the socket.

In the Linux kernel, the bonding module calls __skb_flow_dissect() without providing a net pointer, leading to a warning and potential crash. Syzbot triggered this via XDP in a bonding context, which can cause stability issues.

In the Linux kernel rxrpc subsystem, a data-race and potential load/store tearing affects the last_tx_at field. Lockless accesses to this 64-bit value can trigger KCSAN warnings and cause issues on 32-bit architectures.

In the Linux kernel, the ice network driver fails to call ice_deinit_hw() in the devlink reinit path. After ice_init_hw() fails with -EBUSY, removing the ice driver causes a NULL pointer dereference in ice_unload/ice_remove.

In the imx8m-blk-ctrl pmdomain driver for the i.MX8MQ platform, separate reset and clock masks for the VPU domain were removed because the ADB in the VPUMIX domain has no separate reset and clock enable bits. Previously, resetting G1 or G2 separately could cause a system hang.