CVE Vulnerability Catalog

In the Linux kernel, the drm/amdgpu/userq driver was fixed to properly validate userq buffer objects (BOs). Previously, the loop did not iterate over the individual evicted list, so BOs created and evicted before a userq was made would never be rearmed in the eviction fence. A missing reference to the BO before drm_exec locks was also added.

In the Linux kernel, the drm/i915/dmc driver hardened DMC firmware payload parsing. It validates the conversion of firmware size from dwords to bytes using check_mul_overflow() before calculating the payload size, rejects zero-length payloads and zero MMIO counts in the header, and sets dmc_fw_size only after successful allocation.

In the Linux kernel bridge multicast subsystem, the port group walk during teardown is truncated because hlist_del_init() clears the ->next pointer of a deleted node, terminating the iteration early. This leaves port groups in the bridge mdb with a dangling ->key.port after the port is freed, causing a slab-use-after-free detected by KASAN in __mdb_fill_info.

In the Linux kernel, the net/psp subsystem fixed an issue where the Rx association was inherited on socket clone. Because sk->psp_assoc sits past sk_dontcopy_end, sock_copy() copied it into every accepted socket without taking a reference, leading to a use-after-free in psp_twsk_assoc_free. The fix clears the association on clone.

In the Linux kernel, the ksmbd server was fixed to fill in the FileSysIdentifier field in FS_POSIX_INFORMATION responses. smb2_get_info_filesystem() reported 56 bytes but never assigned the field, so eight bytes from the response buffer were sent to the client. In compound requests this could leak data from previous responses.

In the Linux kernel, the ksmbd server was fixed to initialize the FileSystemControlFlags field in FS_CONTROL_INFORMATION responses. smb2_get_info_filesystem() reported 48 bytes but never assigned the field, so four bytes from the response buffer were sent to the client. In compound requests this could leak data from previous responses.

In the Linux kernel, the ksmbd server was fixed to zero the FS_OBJECT_ID_INFORMATION buffer before filling it in. smb2_get_info_filesystem() reported 64 bytes but wrote only 46, leaving 31 bytes uninitialized. In compound requests this could leak data from previous responses, including those that failed with access denied.

In the Linux kernel, net/sched: cls_flower has a mask pointer validation flaw after nla_next(). fl_set_enc_opt() iterates the key's nested tunnel-option attributes while advancing a single mask pointer via nla_next() based on the number of key attributes rather than the mask's own attributes; the pointer produced by nla_next() is used in the next iteration without validation, leading to an out-of-bounds read (slab-out-of-bounds) in __nla_validate_parse called from fl_change().

In the Linux kernel, the SMB client (cifs) was fixed for data corruption with concurrent writes and O_TRUNC. cifs_do_truncate() flushed dirty pages and truncated the file on the server without holding i_rwsem or invalidate_lock, so a concurrent write could dirty new pages that were then silently discarded. The fix adds locks to make the flush-truncate-resize sequence atomic.

In the Linux kernel SMB client, cifs_set_acl() validates ACL size using the xattr format (4 + count*8), but cifs_do_set_acl() writes the larger CIFS wire format (6 + count*10) into the same buffer, which can overflow the heap. The size is also not checked against USHRT_MAX, so an oversized ACL truncates the on-wire packet length and causes the server to apply a partial ACL.

In the Linux kernel SMB client, CIFSSMBSetEA() copies the caller's extended attribute value into the SMB request buffer without checking that it fits. An unprivileged setxattr(2) on an SMB1 mount with a large attribute causes a slab-out-of-bounds write. The fix applies SendReceive()'s limit before the copy and widens byte counters to prevent overflow.

In the Linux kernel NTFS filesystem, ntfs_trim_fs() aligns the start of a free extent up to the discard granularity but derives the discard length by aligning the original extent length down. When the extent start is not discard-aligned, the resulting discard range can extend past the free extent into allocated clusters, which get zeroed.

In the Linux kernel NTFS filesystem, ntfs_new_attr_flags() passes the wrong MFT record pointer to ntfs_attr_record_resize(). When the attribute resides in an extent record, the base record pointer is passed instead of the extent record, causing incorrect size calculations in memmove.

In the Linux kernel drm/amdgpu driver, amdgpu_cs_parser_bos() allocates HMM ranges for userptr entries but does not free them when later CS processing stages (patch_jobs, vm_handling, sync_rings, early submit) fail. Each such failure leaks the range, its hmm_pfns array, and the BO reference.

In the Linux kernel sched_ext scheduler, a task enqueued with SCX_ENQ_LAST that lands back on its CPU's local DSQ does not trigger rescheduling. The CPU idles with the task queued until an unrelated wakeup or watchdog fires, stalling exiting tasks.

In the Linux kernel sched_ext scheduler, scx_bypass() claims bypass dispatch only for the scheduler whose depth goes from zero to one but does not propagate the claim to descendants. This leaks the claim when a sub-scheduler is enabled/disabled during PM suspend, leading to WARN_ON_ONCE or tasks left on bypass DSQs with no consumer.

A use-after-free vulnerability was fixed in the Linux kernel workqueue subsystem regarding unbound worker pool lifetime. Canceling the last inactive work skipped pwq_dec_nr_active(), leaving an empty pwq on pending_pwqs, and pwq_release_workfn() put the pool before removing that pwq. This could cause the pool to be RCU-freed while the pwq remained reachable, leading to use-after-free in node_activate_pending_pwq().

In the Linux kernel NTFS filesystem, ntfs_setattr_size() updates i_size and resizes the on-disk attribute without holding mapping->invalidate_lock. A racing page fault can resolve a VCN against transient runlist state and fail with a spurious SIGBUS, or interleave with the size-change epilogue, causing inconsistency.

In the Linux kernel NTFS filesystem, ntfs_new_attr_flags() shrinks the attribute record before moving its name and mapping pairs to shorter-header offsets. Shrinking first moves the following attribute over the old record's tail, so memmove copies wrong bytes, producing a malformed mapping pairs array.

Sensitive information disclosure occurs due to missing SSL certificate verification affecting one component. The vulnerability affects Acronis Cyber Protect 17 (Linux, Windows) before build 42587.