CVE Vulnerability Catalog

In the Linux kernel on LoongArch architecture, a vulnerability was found related to missing dirty page tracking in pte_wrprotect() and pmd_wrprotect(). When hardware page table walker (PTW) is enabled, it may set _PAGE_DIRTY without setting _PAGE_MODIFIED, leading to loss of dirty information during copy-on-write (fork). As a result, a page may be considered clean and freed without writeback, causing data corruption.

In the Linux kernel IPMI subsystem, a vulnerability exists where the user refcount is underflowed during event delivery. On delivery failure, the rollback path decrements the refcount excessively, potentially leading to use-after-free or a refcount_t warning.

In the Linux kernel network scheduler sch_multiq, a vulnerability exists due to direct dequeue call instead of using peek and qdisc_dequeue_peeked. When the child is non-work-conserving, direct dequeue can lead to qlen/backlog desync and potential kernel panic.

In the Linux kernel network scheduler sch_taprio, a vulnerability exists due to direct dequeue call instead of using peek and qdisc_dequeue_peeked. When the child is non-work-conserving, direct dequeue can lead to qlen/backlog desync and potential kernel panic.

In the Linux kernel capable_wrt_mount() function, a vulnerability exists due to not rejecting detached mounts. If a mount is detached between checks, the function may dereference NULL, leading to kernel panic.

In the Linux kernel, the iosm driver for WWAN modems has a vulnerability due to missing validation of modem-supplied offsets and lengths in the MUX downlink decoder. A malicious modem can cause out-of-bounds reads and infinite loops in the decoder, leading to system crashes or memory disclosure.

In the Linux kernel's memory compaction module (mm/compaction), the compaction_free() function does not properly handle the failure case of free_pages_prepare(). Failed pages should not be added back to cc->freepages for future use, as they can be either PageHWPoison or free_page_is_bad() and might cause data corruption.

In the Linux kernel, in the mac802154 subsystem, interface removal does not use RCU, which can lead to use-after-free during asynchronous transmit completion. The fix changes list_del() to list_del_rcu() to ensure safe removal in RCU context.

In the Linux kernel, in the IPVS subsystem, the set_sctp_state() function incorrectly calculates the offset for IPv6 SCTP packets with extension headers, leading to incorrect state machine behavior. The fix uses the parsed transport offset passed from ip_vs_set_state() to correctly read the SCTP header.

In the Linux kernel, in the macsec_encrypt() function, an unset MAC header is read, leading to an out-of-bounds read (12-byte over-read) and data leak to the wire. The fix uses skb_eth_hdr() instead of eth_hdr() to correctly obtain the L2 header.

In the Linux kernel, in the dibs loopback driver, the move_data() function does not validate that offset and size do not exceed the DMB length, which can lead to out-of-bounds write. The fix adds an explicit bounds check before memcpy, returning -EINVAL for invalid requests.

In the Linux kernel's tracing/osnoise module, there is a missing synchronize_rcu() call during unregistering. This can lead to use-after-free when RCU readers are still traversing the instance list.

In the Linux kernel's pmdomain module for i.MX93, there is an issue with shared control bits for clock and reset between DSI and CSI domains. This can lead to incorrect behavior if one domain disables shared resources while the other is still active.

In the rt2x00 driver in the Linux kernel, rt2x00lib_probe_dev() uses the full teardown path for all probe failures, even when work structures are not yet initialized. This can lead to invalid work drains and DEBUG_OBJECTS reports.

In the brcmfmac driver in the Linux kernel, there is a heap overflow when processing short authentication frames. The frame length can be less than the management header, causing arithmetic wrap and copying a huge amount of data beyond the buffer.

In the Linux kernel's Bluetooth btrtl driver, there is a vulnerability due to improper bounds checking of firmware patches. A too-short patch can cause arithmetic underflow and lead to oversized read/write during Bluetooth setup.

In the Linux kernel's powerpc/spufs driver, there is an out-of-bounds access in spufs_mem_mmap_access(). The offset is checked against vm_end instead of the local store size, allowing access beyond the buffer.

In the Linux kernel, the mask_user_address() function incorrectly checks for CONFIG_E500 instead of CONFIG_PPC_E500, preventing mask_user_address_isel() from being used on E500 hardware. The fix corrects the check to use the proper name.

In the Linux kernel's cfg80211 subsystem, a vulnerability exists due to missing validation of the EHT MLE type and size before reading the MLD ID. A malicious access point can send a short EHT MLE in an MBSSID beacon, leading to an out-of-bounds read by ieee80211_mle_get_mld_id(). The fix adds validation before the read.

In the Linux kernel, the ieee80211_mle_common_size() function has an issue with validating the common info length in MLE elements. For Reconfiguration and Priority Access types, the length is not correctly checked, potentially leading to improper reads. The fix accounts for the Reconfiguration length and validates the length for all known MLE types.