CVE Vulnerability Catalog

In the Linux kernel padata module, padata_mt_helper() could cause a divide-by-zero panic when ps->chunk_size was 0. This occurs when min_chunk in the padata_mt_job structure is 0.

An access control issue was discovered in autMan version 2.9.6. This vulnerability may allow unauthorized users to bypass authorization mechanisms.

In the Linux kernel, a vulnerability was resolved in BPF: a crash due to out-of-bounds access into reg2btf_ids was fixed. Commit e6ac2450d6de added kfunc support and defined reg2btf_ids to translate verifier reg type to BTF ID. Commit c25b2ae13603 moved __BPF_REG_TYPE_MAX, causing direct usage of reg->type to index reg2btf_ids to potentially fall out of range, leading to out-of-bounds access and kernel crash.

In the Linux kernel, cfg80211_calculate_bitrate_he() did not handle 2x996 RU allocation (NL80211_RATE_INFO_HE_RU_ALLOC_2x996), leading to a kernel warning: 'invalid HE MCS: bw:6, ru:6' and a WARNING in net/wireless/util.c. The fix handles 2x996 RU allocation in the same way as 160 MHz bandwidth.

In the Linux kernel devres module, devm_free_percpu() caused a memory leak because it used devres_destroy() instead of devres_release() to free memory allocated by devm_alloc_percpu().

In the Linux kernel, the soc: qcom: icc-bwmon driver has a refcount imbalance during bwmon_remove, causing a warning in _opp_table_kref_release. The fix involves releasing the OPPs after use.

In the Linux kernel, the wifi rtw89 driver (WoW - Wake on Wireless feature) has a bug where an oversized skb is placed, exceeding skb->end and causing a kernel panic (skb_over_panic) during system resume from sleep. The vulnerability has been fixed.

In the Linux kernel, an invalid wait context issue exists in page_pool_destroy(). When a driver uses XDP and calls page_pool_destroy() followed by xdp_unreg_mem_model(), it attempts to acquire a mutex under RCU read lock, triggering an invalid wait context warning. The fix replaces rhashtable_lookup() with rcu_read_lock() with rhashtable_lookup_fast() without RCU lock.

In the Linux kernel ext4 module, an infinite loop could occur during fast_commit replay due to an uninitialised extent_status struct. ext4_ext_determine_insert_hole() did not detect the replay and called ext4_es_find_extent_range(), which returned without initialising the 'es' variable.

In the Linux kernel, the PCI: endpoint: pci-epf-test module's pci_epf_test_core_init() uses epc_features from the API instead of the cached value, leading to a false positive NULL warning. The fix removes the redundant check and uses the cached value.

In the Linux kernel, the s390 KVM subsystem now rejects the KVM_SET_USER_MEMORY_REGION and KVM_SET_USER_MEMORY_REGION2 ioctls when called on ucontrol VMs. Previously these could cause a NULL pointer dereference because kvm->arch.gmap is set to 0; memory management must be done in userspace via KVM_S390_UCAS_MAP and KVM_S390_UCAS_UNMAP.

In the Linux kernel, sysctl always initializes i_uid/i_gid inside the sysfs core so set_ownership() can safely skip setting them. A previous commit added defaults for i_uid/i_gid when set_ownership() was not implemented, but missed adjusting net_ctl_set_ownership() to use the same default values in case the computation of a better value failed.

A flaw was found in the Linux kernel ext4 filesystem in make_indexed_dir(), which assumes the first two entries in a directory block are '.' and '..'. A crafted filesystem image lacking these entries can cause a page fault and kernel crash during a rename operation.

In the Linux kernel, the nexthop dumping function did not initialize two reserved fields in the nexthop_grp structure, leaking kernel memory. The flaw affects the net: nexthop mechanism and can be observed e.g. via strace.

In the Linux kernel, in the MediaTek network driver, a potential NULL pointer dereference in dummy net_device handling was fixed. The freeing of the dummy device was moved from mtk_free_dev() to mtk_remove(). Previously, if alloc_netdev_dummy() failed in mtk_probe(), dummy_dev was NULL, and the error path called free_netdev() on an unallocated pointer, potentially causing a NULL pointer dereference.

In the Linux kernel, the BPF subsystem did not linearize the skb when downgrading gso_size, which could later trigger a BUG_ON() during skb segmentation. The flaw affects the bpf function and has been fixed.

In the Linux kernel, a vulnerability was resolved in do_dup2() where despite verifying fd is not greater than max_fds, speculative execution may access fdt->fd[fd] out of bounds. array_index_nospec was applied.

An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service (DoS) via the password change function.

The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. Adding a new file to the argument list can trigger `Buf*` autocommands, and closing the buffer leads to freeing the window structure, resulting in a use-after-free error.

In Intel TDX module software before version TDX_1.5.01.00.592, incomplete filtering of special elements may allow an authenticated user to potentially enable escalation of privilege via local access.