CVE Vulnerability Catalog

In the Linux kernel, KVM for ARM64 in nested virtualization mode, kvm_handle_vncr_abort() assumed that -EFAULT from kvm_translate_vncr() always indicates an abort. However, 'late' failures on the output of S1 translation are possible, e.g., a GFN outside memslots. The fix prepares an external abort before returning from kvm_translate_vncr() and removes the BUG_ON() in the fault injection path.

In the Linux kernel, netfilter xt_nat SNAT and DNAT target handlers assume IP-family conntrack state and can dereference a NULL pointer when instantiated from an unsupported family through nft_compat. A bridge-family compat rule can trigger a NULL-dereference in nf_nat_setup_info(). The fix rejects non-IP families in xt_nat_checkentry() so unsupported targets cannot be installed, while keeping NFPROTO_INET allowed.

In the Linux kernel, the intel-speed-select tool (tools/power/x86) daemon uses a fixed pidfile path under /tmp. A local unprivileged user can pre-create a symlink at that path and cause a root-run daemon instance to write into an attacker-chosen file. The fix opens the pidfile with O_NOFOLLOW and validates it with fstat() before locking/writing.

In the Linux kernel, a vulnerability was found in the CXL subsystem where CXL_HEADERLOG_SIZE was defined as 512 bytes, while the actual Header Log register size in the RAS Capability structure is 64 bytes. This caused an out-of-bounds read (by 448 bytes) during data copying, and in the CPER caller path led to leaking 448 bytes of kernel stack memory into the trace event ring buffer, readable by userspace via tracefs.

In the Linux kernel, the UFS core driver trace events in drivers/ufs/core/ufs_trace.h used a pointer to the hba structure in TP_printk(), which is not allowed because TP_printk() is executed when the trace file is read, potentially much later when the pointer may be stale. The fix saves the device name at the time the tracepoint is called and places it into the ring buffer, eliminating the risk of dereferencing a freed pointer.

In the Linux kernel, the HFS+ filesystem lacked validation of B-tree node size. A corrupted HFS+ image with an invalid node size could lead to reading uninitialized memory during mount. Added a sanity check based on the technical specification.

In the Linux kernel, the scsi: hisi_sas driver lacked a slave_destroy interface, causing warnings during simultaneous link reset and module removal. The fix adds this interface to ensure proper link removal after workqueues are flushed.

In the Linux kernel, the scmi_power_name_get() function in firmware: arm_scmi lacked validation of the domain number, which could lead to out-of-bounds access. Fixed by returning "unknown" for invalid domains, like scmi_reset_name_get() does.

In the Linux kernel, there is a possible NULL pointer dereference in __in6_dev_stats_get(). The dev_get_by_index_rcu() function can return NULL if the original physical device is unregistered.

In the Linux kernel, the rapidio/tsi721 driver has an issue in tsi721_db_dpc(). In a list_for_each() loop, the 'found' variable is not reset at the start of each iteration, which can lead to incorrectly marking all items as found after the first correct doorbell, and if the item is not found, it may dereference invalid memory.

In the Linux kernel, the OCFS2 filesystem has an out-of-bounds write in ocfs2_remove_refcount_extent, which can lead to a kernel panic. The issue occurs when unlinking a refcounted file and the last leaf block is removed.

In the Linux kernel, the netfilter synproxy module has an unaligned memory access issue when adjusting the timestamp. Using unsafe operations can cause performance degradation or crashes on strict alignment architectures.

In the Linux kernel, the wcn36xx driver has an out-of-bounds read due to a short trigger BA firmware response. Lack of length validation can lead to reading stale heap data and corrupting the BA session state.

In the Linux kernel, the iommufd module lacks the dma_resv lock before calling dma_buf_unpin() in the release path, causing a kernel warning. This occurs when destroying or unmapping IOAS.

In the Linux kernel, in the Btrfs filesystem's LZO decompression function, there is an out-of-bounds read vulnerability. The segment length validation does not account for the compressed data size, which can lead to a null-ptr-deref and system crash.

A vulnerability in the Linux kernel's ALSA SEQ OSS subsystem involves a race condition in the read queue reset path. The snd_seq_oss_readq_clear() function modifies queue state without holding q->lock, which can race with concurrent read/free operations, leading to stale records, dropped events, or incorrect readiness reporting.

In the Linux kernel, in the tlclk driver, there is a use-after-free vulnerability in the tlclk_cleanup() function. The issue involves freeing memory before device operations are complete, which can lead to crashes or incorrect behavior.

In the Linux kernel's AppArmor module, the function aa_replace_profiles accessed udata->size after calling aa_put_loaddata(udata), potentially causing a use-after-free (UAF). The fix saves the size to a local variable before dropping the reference.

In the Linux kernel's tun_dst_unclone function, there is a false-positive memcpy overflow warning. The compiler with clang and source fortification estimates that options cannot fit into the structure, even though memory is actually allocated, causing a warning.

In the Linux kernel's emac driver, there is a NULL pointer dereference in emac_probe. The function devm_request_irq() is called before devm_platform_ioremap_resource(), which can cause an interrupt to hit emac_irq() before dev->emacp is mapped, leading to a crash.