CVE Vulnerability Catalog

In the Linux kernel, the xcrb_msg_to_type6_ep11cprb_msgx() function for s390/zcrypt lacks minimum size validation, has arithmetic overflow in length calculations, and improper ASN.1 payload parsing. This can lead to uninitialized memory access and buffer overflows.

In the Linux kernel, the zcrypt_msgtype6_send_ep11_cprb() function for s390/zcrypt uses fragile struct overlays to access and modify the domain field in the EP11 CPRB payload, causing maintainability and security concerns. It lacks validation of actual ASN.1 encoding and has error-prone length format detection.

In the Linux kernel, the amdgpu driver's AMDGPU_GEM_CREATE checked domain bits against AMDGPU_GEM_DOMAIN_MASK but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA, causing amdgpu_bo_placement_from_domain() to exceed AMDGPU_BO_MAX_PLACEMENTS and hit BUG_ON().

In the Linux kernel, the amdgpu driver incorrectly calculates the minimum size for UVD decode images because it uses width instead of pitch. Additionally, it does not reject pitch over 4096, which could lead to overflow.

In the Linux kernel, the XFS filesystem's xfs_rtginode_ensure() treats every error from xfs_rtginode_load() other than -ENOENT as success. This can leave the realtime group inode unset after an I/O, allocation, or corruption error, and growfs continues as though the inode had been loaded.

In the Linux kernel, the XFS filesystem has a vulnerability due to an off-by-one error in the validation of the root level of the rtrefcount B-tree. A crafted filesystem image with metadir, realtime, and reflink enabled can cause a slab-out-of-bounds write during mount or recovery, leading to a kernel panic.

In the Linux kernel XFS filesystem, during log recovery, the function xlog_recover_do_reg_buffer() copies data into a buffer based on a dirty bitmap without proper bounds checking. An attacker can supply a crafted filesystem image that causes an out-of-bounds write and corrupts the kernel heap. The issue is fixed by replacing the ASSERT with a real XFS_IS_CORRUPT() check that aborts recovery with -EFSCORRUPTED.

In the Linux kernel XFS filesystem, the function xrep_tempfile_create can lead to a use-after-free (UAF) if the tempfile creation code fails after setting sc->tempip. The fix addresses this issue.

In the Linux kernel XFS filesystem, during exchange-range operations with the XFS_EXCHMAPS_INO1_WRITTEN flag, the function xmi_can_exchange_reflink_flags() may move the reflink flag to another file, but not all mappings are exchanged, which can lead to clearing the reflink flag on a file that still has shared written extents. This can result in data corruption. The fix disables the reflink flag exchange when XFS_EXCHMAPS_INO1_WRITTEN is requested.

A vulnerability in the Linux kernel's Ceph filesystem can cause read operations to hang indefinitely. The issue stems from an incorrect mds_wanted flag state, where a client may wait forever for FILE_RD rights after they were revoked by the MDS. The patch introduces a bounded wait and forces a synchronous OPEN renew when the required caps are not actually held.

In the Linux kernel, the ASoC tas2562 driver's tas2562_volume_control_put() function does not validate the value written by userspace. This value is used as an index into a fixed-size array, which can lead to buffer overflow and writing incorrect data to the device.

In the Linux kernel, the clk spacemit k3 driver does not mark the HDMA clock as critical. This clock is responsible for the internal TCM access path of the X100 RISC-V core, and turning it off can cause the system to hang, e.g., on a page fault during vector access.

In the Linux kernel, the crypto tegra driver's tegra_gcm_do_one_req() function incorrectly calculates rctx->cryptlen, which can lead to a write beyond the rctx->dst_sg buffer during decryption if ctx->authsize remains zero.

In the Linux kernel, the af_unix function unix_del_edge() does not unlink the scc_entry before freeing the vertex, which can lead to partial freeing of a dead SCC by the garbage collector, causing errors.

In the Linux kernel, the ovpn driver's ovpn_crypto_kill_key function assumes both crypto slots are populated and dereferences each slot before checking it. This can lead to a NULL pointer dereference when a peer has only one key or when the key to be removed is not present.

In the Linux kernel, the perf subsystem's perf_event_open() accepts events in the EXIT state as group leaders, which can lead to use-after-free when the leader is closed and a new sibling retains a pointer to the freed event.

In the Linux kernel's ovpn module, key slot crypto freeing is performed from an RCU callback, which is unsafe because crypto_free_aead can sleep (e.g., for hardware implementations). The fix defers the freeing to a workqueue where sleeping is allowed.

A vulnerability in the Linux kernel netfilter ipset module involves a race condition between list:set garbage collection and set swap operations. The issue causes a reference count decrement on a set whose reference has already moved to another index, leading to a BUG_ON and kernel panic.

In the Linux kernel's IPVS module, ip_vs_nat_icmp() does not revalidate the ihl field after reading from skb fragments, which can lead to out-of-bounds access. A local process can change the ihl field, causing issues in ip_send_check() calls.

In the Linux kernel, the bnxt driver has a deadlock vulnerability when canceling the IRQ affinity notifier. The notifier restarts the queue under the netdev instance lock, and cancellation waits for the callback, causing a deadlock.