CVE Vulnerability Catalog

In the Linux kernel's KVM nVMX, the vmcs02 MSR bitmap (msr_bitmap02) is not refreshed during nested VM-Enter when runtime eVMCS controls are modified. As a result, TPR remains in passthrough mode even when TPR virtualization is disabled, allowing L2 (or L1 by proxy) to read and write L0's TPR.

In the Linux kernel's KVM SEV, the have_run_cpus mask pointer is not nullified after being freed, leading to a double-free in sev_vm_destroy() on the error path of __sev_guest_init(). The fix introduces a helper and nullifies the pointer after freeing.

In the Linux kernel's KVM SEV, cache maintenance is performed after clearing the SEV state on the source VM during intra-host migration. This creates a window where memory reclaim can free a page without a prior cache flush, and a subsequent hardware flush overwrites the new page owner's data with the guest's old ciphertext.

A vulnerability was fixed in the Linux kernel's KVM module (x86 MMU handling). If memslot creation races with a stage-2 page fault (EPT violation or #NPF) from L2, KVM may attempt to walk shadow page tables using the zero page, leading to a NULL pointer dereference and kernel oops. The fix terminates such walks when the root is invalid or a dummy root.

In the Linux kernel's KVM SVM, the check for whether an MSR access is intercepted uses the MSR permission bitmap of the active VMCB instead of assuming vmcb02's bitmap is always used. KVM uses msrpm02 only when L1 wants to intercept MSR accesses.

In the Linux kernel's KVM SVM, a failed VMRUN resets the VMCB's TLB control, effectively dropping the requested TLB flush. The fix preserves TLB control on failed VMRUN and tracks the need to flush all ASIDs on a per-CPU basis.

In the Linux kernel's KVM SVM, the control.erap_ctl and control.clean fields in the VMCB are not updated when VMRUN fails. Per AMD, there is no guarantee that requested actions were performed, so updating these fields can mislead KVM.

In the Linux kernel, KVM on arm64 was fixed to apply fine-grained UNDEFs (FGUs) without requiring hardware FEAT_FGT support. Previously, FGT trap configuration was gated on FGT, causing a spurious WARN when a TLBI OS ran on a vEL1 guest without FEAT_TLBIOS on non-FEAT_FGT hardware.

In the Linux kernel, KVM/arm64 vgic was fixed to take a refcount on IRQs referenced by last_lr_irq. Previously, referencing the last interrupt inserted in an LR was fragile because the interrupt could vanish if a concurrently unmapped LPI occurred.

In the Linux kernel, the cw1200 wifi driver was fixed for an out-of-bounds read in the TX path that leaked kernel heap data to the device. The transfer size was rounded up to bus alignment (up to 511 bytes for SDIO), but the padding was sent straight from the frame buffer, which had no room reserved for it.

In the Linux kernel, the iwlegacy 3945 wifi driver was fixed for an EEPROM data memory leak on PCI device removal. il3945_pci_probe() allocates memory for EEPROM data, but the remove path did not free it after a successful probe.

In the Linux kernel, the mac80211 wifi module was fixed in ieee80211_vif_use_reserved_switch(), where reservations were counted too broadly, making a channel replacement appear complete too early. This could free the WILL_BE_REPLACED chanctx while an unmatched link and driver still used it.

In the Linux kernel, the mac80211 wifi module was fixed for premature freeing of the old WILL_BE_REPLACED chanctx during in-place replacement. Early free paths only considered assigned and reserved link users, so the old chanctx could be freed while the replacement partner still pointed back to it.

In the Linux kernel, the mac80211 wifi module was fixed for an RX BA session timer left queued on a freed tid_rx during teardown. Later timer-wheel processing and the timer callback then ran against freed memory.

In the Linux kernel, the mac80211 wifi module was fixed for draining PS delivery work during station teardown. A worker could be delayed while teardown set sta->dead and removed the station from the driver, then still run full delivery when it resumed.

In the Linux kernel, the mac80211 wifi module was fixed for accounting proxy paths against the mesh path limit. mpp_path_add() never reserved a slot in the counter, so removing or expiring a proxy path returned a slot that was never charged, potentially exceeding MESH_MAX_MPATHS.

In the Linux kernel, the mac80211 wifi module was fixed for reading freed memory when associating to a non-transmitted MBSSID profile. When an association response omitted WMM, HT, or VHT information, ieee80211_assoc_config_link() copied element pointers from parse-owned storage that was freed at the end of the fallback block.

In the Linux kernel mac80211 (minstrel_ht) module, the debugfs file fixed_rate_idx accepts any u32 value without validation. An oversized value causes out-of-bounds indexing into minstrel_mcs_groups[] and mi->groups[].rates[], corrupting adjacent kernel memory.

In the Linux kernel mac80211 module, the HT/VHT channel definition validator can receive a 320 MHz bandwidth indication from a received CSA frame on a non-6 GHz link. It warns but continues with an uninitialized vht_operation.chan_width, which with panic_on_warn enabled lets a received frame panic the kernel.

In the Linux kernel mac80211 module, mesh_path_add() reserves a slot before allocating and inserting a path but does not release it on failure. Repeated failed or duplicate mesh path additions can exhaust MESH_MAX_MPATHS, preventing new paths to reachable destinations from being created.