CVE Vulnerability Catalog

In the Linux kernel's nvme-fc subsystem, a double free of fabrics options occurs when nvme_add_ctrl() fails. The bug was introduced by commit 1a9e218195a5 and can be triggered under memory pressure or fault injection, leading to use-after-free.

In the Linux kernel, nvme_tcp_handle_c2h_data() failed to check the data direction of a C2HData PDU. A malicious or misbehaving NVMe/TCP controller could respond to a write command with a C2HData frame, triggering a kernel warning (WARN_ON_ONCE) and resetting the controller. No data is copied, so this is not memory corruption.

A vulnerability exists in the Linux kernel NVMe driver's error handling. The nvme_update_ns_info_block() function only checks for negative error codes, ignoring positive NVMe status codes returned by nvme_query_zone_info(). When a device, firmware, or NVMe-oF target fails the Identify command, setup continues with zero-initialized zone info, leading to a shift-out-of-bounds with a negative exponent and continued I/O submission to a zoned queue with a zero zone size.

A vulnerability was found in the Linux kernel's nvmet-tcp subsystem. The NVMe-over-TCP target accepts unsolicited H2CData PDUs without checking whether an R2T was sent for the command. A remote attacker can exploit this to cause a double-add of the command to the response list, leading to a system hang (soft-lockup) or kernel panic (kernel BUG).

In the Linux kernel, migrate_device_range() and migrate_device_pfns() clear entries following a compound folio without limiting them to the number of slots remaining in the npages-sized array. If a compound folio extends beyond the end of the caller-provided range, the loops cause an out-of-bounds write.

In the Linux kernel, the nfree field in the BTT info block is read from the medium without validation. btt_freelist_init() and btt_rtt_init() size the freelist[] and rtt[] arrays by nfree, but the I/O path indexes them by the lane bounded by num_lanes rather than nfree. An arena with nfree below the lane count causes an out-of-bounds write.

In the Linux kernel, vmemmap_populate_compound_pages() on powerpc manually advanced addr_pfn in a way that did not match the loop's progression through vmemmap addresses. This caused pfn_offset to be computed from the wrong PFN and led to incorrect head/tail mapping decisions for compound pages.

In the Linux kernel, vfio_ap_mdev_set_kvm() sets kvm->arch.crypto.pqap_hook before acquiring update locks and checking for a conflicting assignment. On error, it returns -EPERM without restoring the hook pointer, leaving a stale pointer that can lead to a use-after-free when a guest executes a PQAP instruction.

In the Linux kernel, vfio_ap_config_remove used bitmap_andnot to clear bits from the matrix_mdev->matrix.adm bitmap, which prevented explicitly unplugged control domains from being removed from the KVM guest. The fix replaces bitmap_andnot with bitmap_and.

In the Linux kernel, vfio_ap_mdev_hot_unplug_cfg() relied on the return value of bitmap_andnot() to decide whether to update the guest APCB. When the resulting bitmap was empty, the function returned false, so the update was skipped and the KVM guest retained stale hardware access to unplugged AP devices.

In the Linux kernel, the AFS v2 parser uses footer[8] to locate the image information block within the erase block, then uses region_count to walk entries in a fixed local array. The footer offset and region count come from flash contents and were not validated before use.

In the Linux kernel batman-adv module, fragment reassembly reuses the skb from the highest-numbered buffered fragment, and if the interface it was received on is deleted before the chain completes, the merged packet can re-enter the receive path with a stale skb->dev and skb_iif. This can lead to use of a freed net_device. The fix refreshes the receive device metadata before running packet handlers.

A vulnerability in the Linux kernel was found, involving an out-of-bounds read in the clock driver for Amlogic GXBB platforms. The issue stems from a hard-coded number of parents for the gxbb_32k_clk_sel clock, which is inconsistent with the actual count, leading to a KASAN error during clock registration. The fix uses ARRAY_SIZE instead of a hard-coded value.

In the Linux kernel, the ASoC loongson driver's loongson_card_parse_acpi() ignores the return value of device_property_read_string() for the `codec-dai-name` property. If the property is missing or invalid, an uninitialized pointer is used later, potentially leading to undefined behavior.

In the Linux kernel, in the IIO buffer subsystem, an anonymous buffer handle holds a reference to the underlying IIO device, which is dropped in the buffer handle's release function. If the device has been removed (unbind or hot-unplug), the buffer handle might hold the last reference. The release function takes the mutex for the buffer using a guard, so the unlock happens after iio_device_put(), which might free both the IIO device and the buffer containing the mutex, leading to use-after-free when the mutex is unlocked.

In the Linux kernel, in the IIO buffer subsystem, the iio_dma_fence implementation uses kfree() to free the dma_fence object, which violates the dma_fence documentation requiring RCU-safe freeing. This might result in a use-after-free.

In the Linux kernel, in the IIO buffer subsystem, the iio_dma_fence implementation uses a lock embedded in iio_dmabuf_priv, but iio_dma_fence can outlive iio_dmabuf_priv, causing a use-after-free. The fix ties the lifetime of the lock to the lifetime of the fence by embedding them in the same struct.

In the Linux kernel, in the IIO chemical atlas-sensor driver, the driver requests its hardware data-ready IRQ with devm_request_threaded_irq(); its threaded handler queues an irq_work, atlas_work_handler(), that calls iio_trigger_poll(data->trig). Since the IRQ is devm-managed, free_irq() runs after atlas_remove() without flushing that irq_work, so a pending irq_work can run after the unwind has freed atlas_data/indio_dev and the trigger, causing a use-after-free when atlas_work_handler() dereferences data->trig.

In the Linux kernel, KVM nVMX does not flush vpid02 on first use because last_vpid is not reset when vpid02 is freed on VMXOFF. This can lead to the use of stale TLB entries from a previous lifetime of the VPID, associated with a different vCPU or VM.

In the Linux kernel, KVM nVMX may execute INVVPID on a different physical CPU than the one L2 is running on. This can lead to TLB entries not being invalidated on the correct CPU if L1 migrates between CPUs.