CVE Vulnerability Catalog

A vulnerability has been identified in the Linux kernel related to the kexec_load_purgatory() function, which derives the start image from the SHF_EXECINSTR section. The issue occurs when the purgatory object contains multiple executable sections with overlapping addresses.

A vulnerability has been identified in the Linux kernel regarding the allocation of property blobs in DRM_IOCTL_MODE_CREATEPROPBLOB. This allows users to allocate blobs of arbitrary size, potentially leading to uncontrolled memory usage.

A vulnerability related to APEI/GHES has been resolved in the Linux kernel, which could lead to the allocation of overly large records. The logic in the ghes_new() function checks that records do not exceed the maximum size of GHES_ESTATUS_MAX_SIZE, currently set at 64KB.

A vulnerability in the Linux kernel related to exception handling in SCSI for UFS has been resolved. The issue was the lack of proper flushing of exception handling work during system suspend when the runtime power management level is set to zero.

A vulnerability has been identified in the Linux kernel related to the logic in GHES/CPER, which does not detect if the section length is too large. This may lead to improper processing of CPER records for ARM processors.

A vulnerability has been identified in the Linux kernel related to a reference count leak in the of_get_display_timings() function. This issue occurs during the processing of device nodes, potentially leading to improper memory management.

A vulnerability has been identified in the Linux kernel related to the gfs2_fiemap() function, which can lead to recursive inode lock taking. The issue occurs when the fiemap buffer is memory mapped to the same inode.

A vulnerability has been identified in the Linux kernel that has been resolved. In the error path, the function cx88_alsa_dma_unmap() has been added to release resources acquired by cx88_alsa_dma_map().

A vulnerability in the Linux kernel related to out-of-bounds access in the vfe_isr_reg_update() function has been resolved. The issue occurs during iteration in the vfe_isr() function, where an incorrect loop bound is used, potentially leading to unauthorized memory access.

A vulnerability has been identified in the Linux kernel that has been resolved. In the tw9906_probe() function, there was a potential memory leak because memory allocated in v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() was not freed.

A vulnerability has been identified in the Linux kernel related to a regmap leak on probe failure. The allocated mmio regmap is never freed, which can lead to memory issues.

A vulnerability related to out-of-bounds array access in the ntb_hw_switchtec module has been fixed in the Linux kernel. The patch protects against invalid index access to mw_sizes, which could lead to unexpected system behavior.

W jądrze Linuxa naprawiono podatność związaną z awarią workqueue w funkcji cma_netevent_work_handler. Problem dotyczy struktury rdma_cm_id, która ma człon 'struct work_struct net_work', wykorzystywany do dodawania zadań do cma_wq.

W jądrze Linuxa rozwiązano podatność dotyczącą systemu plików ISOFS, która pozwalała na wykorzystanie zbyt małego identyfikatora pliku (fid). Zgłoszenie syzbot ujawniło błąd odczytu poza granicami pamięci w funkcji isofs_fh_to_parent.

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.

W jądrze Linuxa naprawiono podatność związaną z możliwym dereferencjonowaniem wskaźnika NULL w sterowniku ICSS IEP. Problem występował podczas wyłączania sygnałów pps i perout, co prowadziło do błędów w funkcji icss_iep_exit().

W jądrze Linuxa naprawiono podatność, która występowała w funkcji avs_component_probe(). Problem polegał na braku sprawdzenia, czy funkcja devm_kasprintf() zwraca NULL w przypadku niepowodzenia alokacji pamięci, co prowadziło do dereferencji wskaźnika NULL.

W jądrze Linuxa zidentyfikowano podatność, która może prowadzić do dereferencji wskaźnika NULL podczas równoczesnych wywołań funkcji typec_partner_unlink_device. Wprowadzono poprawkę, która dodaje mutex w celu ochrony wskaźników urządzeń USB.

A vulnerability related to use-after-free in drm_crtc_commit after release has been fixed in the Linux kernel. The issue involved improper duplication of the drm_plane_state in the atmel_hlcdc_plane_atomic_duplicate_state() function.

W jądrze Linuxa zidentyfikowano podatność w systemie plików JFS, która dotyczy obliczania rozmiaru grupy alokacyjnej (AG) w funkcji dbExtendFS(). Problem występuje, gdy l2agsize przekracza 31, co jest możliwe przy agregatach większych niż 2TB na systemach 32-bitowych.