CVE Vulnerability Catalog

W jądrze Linuxa rozwiązano podatność związaną z obsługą błędów w funkcji otx2_flows.c. Dodano sprawdzenie wskaźnika błędu po wywołaniu otx2_mbox_get_rsp().

In the Linux kernel, a memory leak was fixed in the export_udmabuf() error path in udmabuf, where a dma_buf_fd() failure left a dma_buf with a dangling pointer. The fix moves the dma_buf_fd() call out of the function.

In the Linux kernel, the BPF verifier incorrectly assumed that raw tracepoint arguments are always non-NULL, while they can actually be NULL. This caused explicit NULL checks to be removed and could lead to kernel crashes when accessing such pointers. The fix marks raw_tp arguments as PTR_MAYBE_NULL and adjusts dereference and helper/kfunc passing handling.

In the Linux kernel, a vulnerability was resolved in gpio: graniterapids: moving the setting of irq_chip.name from probe() to the initialization of the irq_chip struct fixes a vGPIO driver crash during bootup caused by unauthorized modification of the irq_chip.name field when the irq_chip struct was initialized as const.

W jądrze Linuxa rozwiązano podatność związaną z systemem ALSA, która dotyczyła użycia funkcji WARN() do zgłaszania błędów przy tworzeniu dowiązań symbolicznych. Zmiana polega na zastąpieniu WARN() funkcją dev_err(), co ma na celu poprawę przejrzystości komunikatów o błędach.

W jądrze systemu Linux naprawiono podatność, która mogła prowadzić do wystąpienia błędu ip_rt_bug w przypadku awarii linku ARP przy włączonym xfrm. Problem ten dotyczył generowania tras dla pakietów ICMP, co mogło prowadzić do nieprawidłowego przetwarzania pakietów.

In the Linux kernel, the HSR (High-availability Seamless Redundancy) module's hsr_init_skb() failed to allocate enough space in the skb buffer for the RedBox case. As a result, send_hsr_supervision_frame() attempts to add extra structures (hsr_sup_tlv and hsr_sup_payload), causing a buffer overflow and kernel panic (skb_over_panic).

In the Linux kernel, a vulnerability exists where memory for cacheinfo is not allocated during early boot on some architectures (e.g., x86). Consequently, during the cacheinfo CPU hotplug callback, last_level_cache_is_valid() attempts to dereference a NULL pointer, causing a kernel oops.

In the Linux kernel, migrate_to_node() in mm/mempolicy assumed there is at least one VMA in a MM, which is not always true. When find_vma() returns NULL, the code dereferences NULL, causing a general protection fault. The fix properly handles find_vma() returning NULL.

In the Linux kernel BPF subsystem, a lock ordering issue occurs during hash map (htab) updates. The free_htab_elem() function is called while holding a bucket lock (raw_spinlock_t) and then attempts to acquire map_idr_lock (spinlock_t), triggering a lockdep invalid wait context warning. The fix defers free_htab_elem() until after the bucket lock is released and batches element freeing to avoid the issue.

In the Linux kernel, the hisi_sas SCSI driver created debugfs files dynamically on each dump trigger. If a dump was triggered while the driver was being unbound, a NULL pointer dereference occurred, causing a kernel oops/hang. The fix creates all debugfs directories and files during initialization, so each dump only allocates memory for the saved data.

In the Linux kernel's deadline scheduler, a warning occurred during migration of boosted tasks. setup_new_dl_entity was called again for a task whose parameters were already set by rt_mutex_setprio. The fix avoids this call for boosted tasks.

In the Linux kernel, a vulnerability was resolved in ftrace regarding a regression with the module command in stack_trace_filter. Executing the command echo "write*:mod:ext3" > /sys/kernel/tracing/stack_trace_filter causes a null pointer dereference, and while a previous partial fix (commit 0f17976568b3f) addressed part of the issue, an unhandled corner case still results in a kernel crash.

In the Linux kernel, a list corruption occurs in mm/slub when removing a slab from the full list. If an allocated object fails consistency checks, the slab is marked as used and removed from the partial list; later, when an object from that slab is freed, remove_full() attempts to remove it from a list it is not on, causing list corruption and a kernel BUG. This affects SLUB debugging with slub_debug=UFPZ.

In the Linux kernel, the f2fs filesystem was fixed for a bug where creating a snapshot on an LVM device sets discard_max_bytes to zero, causing a zero value to be passed to __blkdev_issue_discard and resulting in a kernel panic. The fix drops remaining discards in f2fs_unfreeze and checks discard_max_bytes before submitting discards.

In the Linux kernel, a vulnerability exists in the Hyper-V HID driver (hid_hyperv) where unloading the module triggers a devres warning due to an unallocated devres group. The driver overrides hid_dev->driver and reimplements the probe function without calling devres_open_group(), causing an error during driver removal. The fix involves dropping the driver override and using standard registration functions.

In the Linux kernel, the udmabuf module changed the folios array from kmalloc to kvmalloc because large allocations with kmalloc can fail and return NULL, triggering a warning and buffer creation failure. The fix allows fallback to vmalloc, guaranteeing allocation of any size.

W jądrze systemu Linux zidentyfikowano podatność w module f2fs, która prowadzi do dereferencji wskaźnika null w funkcji f2fs_submit_page_bio(). Problem występuje podczas równoczesnej instalacji modułu f2fs.ko i montowania systemu plików f2fs, gdy zestaw f2fs nie jest zainicjowany przed rejestracją typu systemu plików.

In the Linux kernel, the dcn20_program_pipe() function in the drm/amd/display driver may dereference a NULL pointer because pipe_ctx->plane_state can be NULL and its attributes are used without checking in multiple if statements. The fix adds necessary NULL checks to ensure stability.

In the Linux kernel, improper use of userspace_irqchip_in_use in KVM for arm64 leads to a WARN_ON() in kvm_timer_update_irq(). A specific sequence of VM and vCPU initialization (with KVM_ARM_VCPU_PMU_V3 but without proper setup, followed by re-initialization) triggers the warning. The fix removes the static key and replaces it with !irqchip_in_kernel().