CVE Vulnerability Catalog

In the Linux kernel's SMB client, smb3_insert_range() does not check whether the new file size (i_size + len) is valid. This allows FALLOC_FL_INSERT_RANGE to bypass RLIMIT_FSIZE, exceed s_maxbytes, or produce a size outside the loff_t range. The fix uses check_add_overflow() to calculate the new EOF and validates it with inode_newsize_ok().

In the Linux kernel SMB client, smb3_zero_range() may extend a file's EOF without checking RLIMIT_FSIZE when FALLOC_FL_ZERO_RANGE is used without FALLOC_FL_KEEP_SIZE. The fix calls inode_newsize_ok() before sending the zero-range request when the operation would extend EOF.

In the Linux kernel SMB client, smb3_insert_range() and smb3_collapse_range() failed to properly invalidate the page cache when the offset or old EOF was not page-aligned. Boundary pages were only partially zeroed and remained uptodate, so the client could return stale data after a successful insert/collapse range operation.

A flaw was found in the Linux kernel SMB/CIFS client where server-side range operations (zero range, punch hole, insert range, collapse range) modified file contents without invalidating the FS-Cache cookie. As a result, subsequent reads could return stale data cached before the range operation.

A vulnerability in the Linux kernel's SCTP implementation causes a soft lockup due to inconsistent parameter iteration in ASCONF-ACK handling. A crafted ASCONF-ACK packet can trigger an infinite loop in softirq context, leading to a remote denial of service. Additionally, missing length validation for SCTP_PARAM_ERR_CAUSE allows an out-of-bounds read.

In the Linux kernel msc313e watchdog driver, msc313e_wdt_probe() does not set the platform device driver data, so dev_get_drvdata() in msc313e_wdt_suspend() and msc313e_wdt_resume() returns NULL, leading to a NULL pointer dereference. The fix sets the platform device driver data in msc313e_wdt_probe().

In the Linux kernel netfs subsystem, a subrequest reference leak occurs in netfs_unbuffered_write() when subreq->io_iter ends up zero length during preparation. The fix addresses this reference leak.

In the Linux kernel netfs subsystem, when netfs_alloc_subrequest() fails, subreq is NULL, and netfs_prepare_write() then tries to initialize its members, leading to a NULL pointer dereference. The fix properly handles the netfs_prepare_write() error.

In the Linux kernel, parse_dacl() in ksmbd silently accepted truncated ACEs and allocation failures, allowing set_info_sec() to continue with an incomplete ACL conversion. The fix propagates parsing and allocation errors to parse_sec_desc() so malformed security descriptors are rejected before inode attributes or ACL xattrs are updated.

In the Linux kernel, ksmbd allows a client to include many structurally valid but unmapped SIDs in a DACL, causing hundreds of kernel error messages per request. The fix rate-limits the logging of these mapping failures.

A vulnerability in the Linux kernel's Bluetooth subsystem (hci_core) involves a race condition during device registration. The power_on work item is queued before full initialization, and concurrent execution can lead to using an uninitialized mutex in msft_do_close(), triggering DEBUG_LOCKS warnings and potential instability.

In the Linux kernel, several places in IPv6 multicast where RCU-protected lists were updated without rcu_assign_pointer() were fixed. The fix ensures consistent use of rcu_assign_pointer() along with appropriate dereference helpers.

In the Linux kernel, a vulnerability in the TIPC module was fixed where exceeding the TIPC_MAX_PUBL (65535) limit of local service publications prevented protocol service types (node state, link state) from being inserted into the name table. This caused missing event notifications and a NULL pointer dereference in tipc_named_node_up() when the publication list was empty.

In the Linux kernel, a problem in TIPC where random pad bytes were sent in RESET/ACTIVATE messages was fixed. Previously, strcpy() was used, which could send random data from the skb buffer to the remote system. Now memcpy() is used, which copies zeroed pad bytes.

In the Linux kernel, tpacket_parse_header() in the af_packet subsystem cast the user-provided tpacket_hdr.tp_len (u32) to int. A value larger than INT_MAX became negative, passed the size check, and was returned up to sock_sendmsg_nosec(), triggering BUG().

In the Linux kernel, the fbtft staging driver's dirty_lock was not IRQ-safe. fbtft_mkdirty() can be reached from the fbcon rendering path in hardirq context, while fbtft_deferred_io() takes the same lock in workqueue context with local interrupts enabled, leading to a possible lock inversion and deadlock.

In the Linux kernel, the ASoC amd yc driver's acp6x_pdm_dma_close() does not free the runtime->private_data buffer allocated in acp6x_pdm_dma_open(). The missing kfree causes a memory leak.

In the Linux kernel, in the btrfs filesystem, when creating the first metadata chunk for a sprout filesystem, create_chunk() adds the new device to the transaction dev_update_list. If the subsequent system chunk creation fails, btrfs_init_new_device() aborts the transaction and releases the device while post_commit_list is still linked, causing a warning and leaving the transaction list referencing freed memory.

In the Linux kernel, in the btrfs filesystem, btrfs_init_new_device() switches latest_dev and possibly s_bdev from the seed device to the new sprout device before creating the first writable chunks. If chunk creation or the subsequent sprout setup fails, the error path releases the new device without switching those pointers back, so btrfs_show_devname() can dereference the freed latest_dev and crash.

In the Linux kernel's btrfs filesystem, there is a memory leak of the bioc structure on the bioc_list of an ordered_extent. The bug can occur during RAID extent insertion or when an ordered extent encounters an I/O error, causing the bioc to not be freed.