CVE Vulnerability Catalog

In the Linux kernel's NTFS filesystem, a use-after-free vulnerability was found in ntfs_attr_fallocate(). The issue arises from dereferencing a runlist element pointer after releasing the lock, which can lead to accessing freed memory. An attacker could exploit this flaw to cause a system crash or potentially escalate privileges.

In the Linux kernel, the HID-BPF module has a vulnerability in hid_bpf_get_data() due to an incorrect range check. Because of unsigned arithmetic, a very large size can wrap the sum and bypass the check, allowing a pointer outside the buffer to be returned.

In the Linux kernel, the netfilter xt_u32 module lacks validation of shift counts supplied by rules. A malformed rule can provide a shift count of 32 or more, triggering an undefined shift out-of-bounds during packet evaluation. Validation of XT_U32_LEFTSH and XT_U32_RIGHTSH operands was added in u32_mt_checkentry() to reject malformed rules before they reach the packet path.

In the Linux kernel, the netfilter xt_connmark module (revision 2) lacks validation of shift parameters. A shift_bits value of 32 or more triggers an undefined shift, and invalid shift_dir values are accepted and silently fall back to left shift. The fix rejects invalid parameters in connmark_tg_check() so errors are caught at rule installation time.

In the Linux kernel, the net/mlx5 (LAG) module has an off-by-one error in mlx5_lag_create_single_fdb() during error rollback. The cleanup loop starts at index i, which can operate on uninitialized state or double-tear-down a rule. The fix changes the loop start to i - 1 so only successfully-installed entries are undone.

In the Linux kernel, the mlx5e (TC) driver has a vulnerability causing a kernel crash when cleaning up peer flows in a LAG configuration. The issue occurs when mlx5_lag_get_dev_seq() returns an error, leading to invalid memory access. The fix skips peer processing when the LAG sequence lookup fails.

In the mlx5e driver for Mellanox network cards, a vulnerability was found involving zero-sized buffer allocation for HV VHCA stats. The buffer is allocated before channel initialization when the channel count is zero, resulting in ZERO_SIZE_PTR instead of NULL. After channels open and hypervisor reporting is enabled, a memset operation on this pointer causes a page fault at address 0x10.

In the mlx5e driver for Mellanox network cards, a race condition was found during HV VHCA stats agent registration. The asynchronous control path may run before work structure and agent pointer initialization, leading to NULL pointer dereference or kernel data structure corruption.

A vulnerability in the Linux kernel affects Microchip network drivers (sparx5, lan969x) related to the shared Super VCAP block. VCAP instances are not independent but were locked separately, causing races during concurrent access. An attacker can use debugfs to read rules outside rtnl, leading to corruption of hardware entries.

In the Linux kernel's net/sched: act_pedit module, there is a TOCTOU vulnerability leading to a heap out-of-bounds write during TC offload. A race between sizing a flow_rule buffer and filling it can allow an attacker with CAP_NET_ADMIN to write controlled content beyond the allocated memory region.

In the Linux kernel Bluetooth (MGMT) subsystem, a use-after-free vulnerability exists during advertisement monitor addition. Improper ownership handling between the MSFT add path and management command completion can lead to use of freed memory, as shown by a KASAN report.

In the Linux kernel's Bluetooth ISO subsystem, there is a vulnerability related to improper handling of ISO_END/CONT packets. Incorrect handling can lead to memory leak of conn->rx_skb, kernel panic on skb_put, or acceptance of too short ISO_END packets.

In the Linux kernel's accel/amdxdna driver, there is a use-after-free vulnerability due to a race in VMA access. The functions aie2_populate_range() and amdxdna_umap_release() access a saved VMA pointer that may have already been freed, leading to potential use-after-free.

In the Linux kernel's net/tls module, there is an issue in tls_sw_read_sock() that causes empty TLS application data records to block subsequent data records. Empty records (allowed in TLS 1.3) are not consumed, leading to an infinite loop and connection stall.

In the Linux kernel's accel/amdxdna module, there is a race condition in amdxdna_umap_release() that can lead to use-after-free when aie2_populate_range() runs concurrently.

In the Linux kernel, a vulnerability in the CIFS/SMB client causes a busy dentry warning during unmount after direct I/O (DIO) operations. The issue stems from delayed dentry reference release via workqueues, potentially leading to improper unmount. The fix adds a per-superblock outstanding request counter and waits for it to reach zero before unmounting.

In the Linux kernel, the regulator_lock_two() function compares the error code against -EDEADLOCK instead of -EDEADLK. On MIPS, SPARC, and PowerPC architectures these values differ, causing the code to fall into WARN_ON and return with only one regulator locked when a real deadlock backoff occurs. In practice, the bug only affects MIPS because the regulator core is not built or used on the other platforms.

In the Linux kernel octeontx2-af driver, mbox handling for a VF with promiscuous and all_multi flags set to false causes deletion of the PF's promiscuous and allmulti MCAM rules. This occurs because the APIs that enable/disable these rules operate only on the PF, even when the request comes via a VF interface. The fix adds an is_vf() check in the disable paths to prevent a VF from inadvertently clearing the PF's MCAM rules.

In the Linux kernel SMB client, smb2_ioctl_query_info() validates the PASSTHRU_FSCTL response payload before copying it to userspace. The addition of OutputOffset and qi.input_buffer_length can wrap in 32-bit arithmetic, allowing a malicious server to bypass the bounds check and read outside the response buffer. The fix uses size_add() for safe addition.

In the Linux kernel, the sof_ipc4_bytes_put() function has a TOCTOU vulnerability where the copy size is derived from the old buffer instead of the new data. This can lead to truncation of valid data or copying stale bytes.