CVE Vulnerability Catalog

In the Linux kernel, there is a missing validation of the MODULE_NOTIFICATION payload size before reading bytes/channel data in control update handling.

In the Linux kernel, the sof_ipc3_control_update() function calculates expected_size using firmware-provided num_elems, which can overflow on 32-bit platforms. This could allow size comparison to pass with mismatched sizes, potentially leading to out-of-bounds access.

In the Linux kernel, the sof_ipc3_bytes_put() and sof_ipc3_bytes_get() functions have TOCTOU vulnerabilities and incorrect bounds checking. In bytes_put, the copy size is derived from the old buffer, and in bytes_get, the flex array offset is not accounted for.

In the Linux kernel, the qrtr_endpoint_post() function has a 32-bit integer overflow in the ALIGN(size, 4) calculation, which can lead to out-of-bounds write and kernel oops on 32-bit platforms.

In the Linux kernel, the check_tp() function does not reject ATM traffic classes above ATM_ANYCLASS, which can lead to out-of-bounds read when reading /proc/net/atm/pvc.

In the Linux kernel for LoongArch, KVM lacks validation of the irqchip index in irqfd routing, which can lead to out-of-bounds access past the routing table's chip array.

In the Linux kernel for LoongArch, the kvm_vcpu_ioctl_interrupt() function did not validate the IRQ number passed from userspace. Validation has been added to prevent potential issues.

In the Linux kernel for KVM nVMX, the consistency check for vTPR vs. TPR threshold was moved into normal controls checks. Previously, the check was done late, which could lead to running L1 with an incorrect CR3. The fix simplifies vTPR access and skips the check in some cases.

In the Linux kernel for KVM SEV, intra-host migration/mirroring of SNP VMs has been disallowed because the feature is not fully implemented. Proper migration requires additional SNP-specific state to be transferred. The fix rejects SNP source VMs in migration/mirroring.

In the Linux kernel for KVM TDX, concurrent change to CPUID entry count during initialization is now rejected. Previously, a user could change cpuid.nent between read and copy, potentially leading to out-of-bounds access. The fix requires the copied count to match the value used for allocation.

In the Linux kernel, KVM x86 has a bug where the internal request to service a pending PV EOI is not ignored if the vCPU has disabled PV EOIs since the request was made. This can lead to a kernel BUG in kvm_lapic_sync_from_vapic.

In the Linux kernel, KVM x86 has a vulnerability where the irqfd->producer pointer is not nullified if updating the IRTE for bypass fails. Leaving a dangling pointer can lead to a use-after-free if the irqfd is reachable through KVM's routing, but the producer is freed separately.

In the Linux kernel, KVM's kvm_io_bus_get_dev() returns a device matched only by address, which can cause lifetime issues if the device is not of the expected type. The fix moves the srcu lock responsibility to the caller to avoid use-after-free.

In the Linux kernel, KVM arm64 (nested mode) has a bogus WARN when a guest writes to the ZCR_EL2 sysreg alias in a nested context. The fix removes this warning, which could cause a hypervisor panic.

In the Linux kernel, a heap overflow was found in ASoC SOF ipc3-control in bytes_ext put/get. The ipc_control_data buffer is allocated as kzalloc(max_size), but bounds checks compared user data lengths directly against max_size, ignoring the offset of cdata->data. This allowed writing up to sizeof(struct sof_ipc_ctrl_data) bytes past the end of the heap buffer from unprivileged userspace via the ALSA TLV kcontrol interface, and similarly allowed over-reading adjacent heap data. The fix subtracts sizeof(*cdata) from max_size in all bounds checks.

In the Linux kernel, a missing size validation was found in ASoC SOF ipc3-control in snd_sof_update_control. The firmware-provided cdata->num_elems is checked against local_cdata->data->size but never against the actual allocation size. If local_cdata->data->size was previously set to an inconsistent value, the memcpy could write past the allocated buffer. The fix adds a bounds check to ensure num_elems fits within the available space in the ipc_control_data allocation.

In the Linux kernel, an issue was found in netfilter nf_queue regarding pinning the bridge device while NFQUEUE holds a fake dst. The br_netfilter fake rtable is embedded in struct net_bridge and attached to bridged packets with skb_dst_set_noref(). If such a packet is queued to NFQUEUE, __nf_queue() upgrades that fake dst with skb_dst_force(). The fix keeps the bridge fake dst model unchanged and pins the bridge master device only while the packet sits in NFQUEUE, recording the bridge device in nf_queue_entry and taking a device reference for the queue lifetime.

In the Linux kernel, the nft_fib netfilter module has a NULL pointer dereference vulnerability when a fib expression is used in a netdev egress base chain. Validation incorrectly accepts the egress hook, leading to a system crash.

In the Linux kernel, the nf_conntrack_sip netfilter module lacks validation of skb_dst() before accessing it. When routing information is unavailable (e.g., in tc ingress or openvswitch), a crash may occur.

In the Linux kernel, the nft_set_pipapo netfilter module has a vulnerability that leaks a bad clone into a future transaction. Memory allocation failure can lead to out-of-bounds writes during subsequent operations.