CVE Vulnerability Catalog

In the Linux kernel CIFS client, cifs_remap_file_range() with len == 0 (clone to EOF) computes the effective length as i_size - off. If off exceeds the file size, the result is a negative loff_t, corrupting the ByteCount in the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range in filemap_write_and_wait_range(). The existing off >= i_size check only fires after the ioctl has already been sent.

In the Linux kernel CIFS client, cifs_do_truncate() invoked from cifs_open() with O_TRUNC cannot use cifs_resize_file_locked() because i_rwsem is not held, so it fails to properly resize the fscache cookie. The fix adds a cifs_invalidate_cache() call after cifs_setsize(), which invalidates the cache without requiring i_rwsem.

In the Linux kernel SMB client (cifs.ko), writing to a file with the setuid/setgid bit set did not clear that bit on the server when mounted with cifsacl, modefromsid, or POSIX/Unix extensions. The VFS requested clearing the bit, but the cifs driver unconditionally skipped the mode change (ATTR_MODE), so the cleared mode was never sent to the server.

In the Linux kernel SMB client, reparse_buf_ptr() reads the ReparseDataLength field before verifying that the received data covers the full fixed header. If a server returns OutputCount < 6, the read at offset 4-5 reaches past the end of the received data.

In the HID sensor custom driver, hid_sensor_custom_add_attributes() did not remove previously created sysfs groups when a subsequent sysfs_create_group() call failed. This left invalid structures and potential access to freed memory.

In the Linux kernel, universal_pidff_probe() starts the device with hid_hw_start() but, if force-feedback initialization fails, returns the error without stopping the device. This leaves the registered hidraw device alive after the driver is cleared, leading to a use-after-free write when /dev/hidrawX is opened.

In the mcp2221 HID driver, mcp_i2c_smbus_read() stored a buffer pointer in mcp->rxbuf but never cleared it after the transfer completed. A delayed or spurious MCP2221_I2C_GET_DATA report could write data into freed memory.

In the Linux kernel, the intel-quickspi HID driver does not validate the report size before copying it into the report_buf heap buffer. The buffer is sized from the device descriptor (max_report_len), but the report length coming from a hidraw ioctl is unbounded, allowing a buffer overflow with attacker-controlled data.

In the Linux kernel, quickspi_get_report() in the intel-quickspi HID driver copies the entire device response into the caller's buffer without checking its length. A response larger than the caller's buffer overflows it with device-controlled content.

In the Linux kernel, the fs/ntfs3 driver does not validate the dirty page table during log replay. A crafted DIR_PAGE_ENTRY with an invalid lcns_follow field lets the v0->v1 conversion and later replay passes run off the entry.

In the Linux kernel, ni_read_frame() in fs/ntfs3 trusts decompress_lznt()'s return value, which may be smaller than the frame size. Unwritten bytes remain in the vmapped pages and are returned to userspace, disclosing uninitialized kernel memory.

In the Linux kernel, the copy_lcns and redo shorten loops in fs/ntfs3 index page_lcns[] based on the log record's lcns_follow, which is not checked against the target entry. A crafted record can overflow page_lcns[] of an otherwise valid entry.

In the Linux kernel, ecryptfs_exorcise_daemon() dropped queued messages from a dying daemon without holding ecryptfs_msg_ctx_lists_mux, but ecryptfs_msg_ctx_alloc_to_free() requires that lock. This created a race with other users of the global message context list.

In the Linux kernel, ecryptfs_parse_packet_set() calculated the remaining packet buffer size as PAGE_SIZE - 8, even though for version 1 headers the packet set starts later in the header. This could overstate the available buffer and lead to parsing errors.

In the Linux kernel, parse_tag_3_packet() fails to bound encrypted_key_size against ECRYPTFS_MAX_KEY_BYTES (64). When encrypted_key_size exceeds 64, decrypt_passphrase_encrypted_session_key() performs two out-of-bounds writes, corrupting the ecryptfs_auth_tok and ecryptfs_crypt_stat structures. Only AES-192 (cipher code 0x08) triggers this because it sets crypt_stat->key_size = 24 independently of encrypted_key_size.

In the Linux kernel, ecryptfs_parse_tag_70_packet() subtracted fixed metadata fields from the parsed packet body size to derive the encrypted filename size. A malformed packet with a body smaller than those fixed fields could underflow that size calculation.

In the Linux kernel, ecryptfs_send_message_locked() moved a message context from the free list to the allocated list before sending the request to the userspace daemon. If ecryptfs_send_miscdev() failed, the context was left on the allocated list and could not be reused.

In the Linux kernel, in the erofs filesystem, z_erofs_gbuf_nrpages is advanced only after every global buffer has been grown. If a resize fails after some buffers were enlarged, a retry revisits those enlarged buffers, which can lead to allocation errors or pointer array overflow.

In the Linux kernel, ext2_setsize() and ext2_xattr_set2() contained a construct that for IS_SYNC inodes called sync_inode_metadata() instead of marking the inode dirty. Since sync_inode_metadata() only acts if the inode is already dirty, inode updates could be lost.

A use-after-free vulnerability exists in the Linux kernel's fanotify subsystem regarding file range information. A pointer to the range position stored on the triggering task's stack is saved in a heap-allocated permission event, and when a signal interrupts the triggering task, the stack frame is unwound while the event reader still dereferences that pointer. This causes a stale stack value to be copied to userspace.