CVE Vulnerability Catalog

In the Linux kernel, the dm-integrity module has a bug that can lead to a deadlock. When dm_integrity_check_limits fails, the code exits with DM_MAPIO_KILL, but the range is already locked and not unlocked. The fix moves the limit check earlier to avoid resource leaks.

In the Linux kernel, the dm-integrity module has a bug where the hash_offset variable is incremented twice. The variable is already incremented in the loop, and the code increments it again, leading to incorrect behavior. The fix removes the extra increment.

In the Linux kernel, the dma_fence_dedup_array() function returns 1 when called with a count of 0, which contradicts the documentation and may lead to dereferencing an uninitialized pointer in amdgpu_userq_wait_*(). The fix makes the function return 0 for an empty array.

In the Linux kernel, the accel/amdxdna module has a use-after-free bug in amdxdna_gem_dmabuf_mmap(). When vm_insert_pages() fails, the error path calls close, which releases the GEM object, and then the code releases it again, leading to access to freed memory. The fix returns directly from close_vma.

In the Linux kernel accel/amdxdna driver, amdxdna_drm_sync_bo_ioctl() for SYNC_DIRECT_FROM_DEVICE passes the BO's client pointer to amdxdna_hwctx_sync_debug_bo() instead of the ioctl file's client. This causes the wrong client to be used as the handle namespace and hardware context owner, potentially leading to synchronization errors. The fix passes filp->driver_priv instead.

In the Linux kernel accel/ivpu driver, fw_log_from_bo() does not check that the log size is at least the header size. When the log is smaller, fw_log_print_buffer() computes data_size with an underflow, leading to reads far past the small real data region of the BO. A size of 0 also causes infinite looping. The fix rejects logs whose size is smaller than the header.

In the Linux kernel, a use-after-free vulnerability was found in the resctrl subsystem during unmount. A concurrent reader of a monitoring event file may access already freed memory because the RDT_DELETED flag is not set for the default resource group. The fix sets this flag unconditionally and prevents remounting when there are pending readers.

In the mlx5e driver for Mellanox network cards, a use-after-free vulnerability was found in MACsec handling. Deleting an RX SC freed the metadata_dst object without respecting the reference count, which could lead to use of freed memory by a concurrent packet receive process. Additionally, publishing an element in the xarray before metadata_dst initialization could expose incomplete data.

A use-after-free vulnerability was found in the Linux kernel's user_event_mm_dup() function related to the user_events mechanism. The issue occurs during fork() when the enabler list is traversed without locking while another thread removes an enabler, leading to use of freed memory. An unprivileged attacker can trigger this bug, resulting in a system crash or potential privilege escalation.

In the Linux kernel, the CPU hotplug mechanism has a bug in cpuhp_invoke_callback() that hides the original error during rollback of earlier callbacks. The ret variable is reused to store the rollback result, which can mask the original error.

In the Linux kernel, the CPU hotplug mechanism has a buffer overflow vulnerability in states_show(). The function writes hotplug state names to a sysfs buffer using sprintf(), which can write past the end of the PAGE_SIZE buffer when many states are registered.

In the Linux kernel, the SIT driver's ipip6_changelink() did not check CAP_NET_ADMIN in the tunnel's network namespace. A caller privileged in the device's netns but not in the tunnel's netns could modify the tunnel. Added rtnl_dev_link_net_capable() check at the beginning.

In the Linux kernel, the act_ct module's tcf_ct_handle_fragments() does not save and restore skb->cb during defragmentation. This causes loss of qdisc metadata like pkt_segs and can trigger WARN_ON_ONCE(). Added save and restore of tc_skb_cb.

In the Linux kernel, the IP6VTI driver's vti6_changelink() did not check CAP_NET_ADMIN in the tunnel's network namespace. A caller privileged in the device's netns but not in the tunnel's netns could modify the tunnel. Added rtnl_dev_link_net_capable() check at the beginning.

In the Linux kernel, the IPVTI driver's vti_changelink() did not check CAP_NET_ADMIN in the tunnel's network namespace. A caller privileged in the device's netns but not in the tunnel's netns could modify the tunnel. Added rtnl_dev_link_net_capable() check at the beginning.

In the Linux kernel, the IPIP driver's ipip_changelink() did not check CAP_NET_ADMIN in the tunnel's network namespace. A caller privileged in the device's netns but not in the tunnel's netns could modify the tunnel. Added rtnl_dev_link_net_capable() check at the beginning.

In the Linux kernel, the ip6_gre driver has a vulnerability where CAP_NET_ADMIN is not required in the tunnel's network namespace during changelink operations. A caller privileged in the device's namespace but not in the tunnel's namespace can modify a tunnel residing in another namespace.

In the Linux kernel, the ip6_tunnel driver has a vulnerability where CAP_NET_ADMIN is not required in the tunnel's network namespace during changelink operations. A caller privileged in the device's namespace but not in the tunnel's namespace can modify a tunnel residing in another namespace.

A vulnerability was found in the Linux kernel's legacy netlink interface for IEEE 802.15.4. The LLSEC dump operations in the IEEE802154_NL family lacked the required administrative permission flag, allowing any local user to read raw 16-byte AES-128 keys from the kernel key table. The issue affects only the legacy API, while the modern nl802154 family is properly secured.

In the Linux kernel, the octeontx2-af (cn10k) driver has a vulnerability due to lack of validation of the base_pcifunc field in rvu_mbox_handler_lmtst_tbl_setup(). This allows a VF function to read the physical LMTLINE address of another function if base_pcifunc points outside its own PF space. The fix rejects the request with -EPERM when base_pcifunc is not a valid function under its own PF.