CVE Vulnerability Catalog

In the mlx5e driver for Mellanox network cards, a vulnerability was found involving zero-sized buffer allocation for HV VHCA stats. The buffer is allocated before channel initialization when the channel count is zero, resulting in ZERO_SIZE_PTR instead of NULL. After channels open and hypervisor reporting is enabled, a memset operation on this pointer causes a page fault at address 0x10.

In the mlx5e driver for Mellanox network cards, a race condition was found during HV VHCA stats agent registration. The asynchronous control path may run before work structure and agent pointer initialization, leading to NULL pointer dereference or kernel data structure corruption.

A vulnerability in the Linux kernel affects Microchip network drivers (sparx5, lan969x) related to the shared Super VCAP block. VCAP instances are not independent but were locked separately, causing races during concurrent access. An attacker can use debugfs to read rules outside rtnl, leading to corruption of hardware entries.

In the Linux kernel's net/sched: act_pedit module, there is a TOCTOU vulnerability leading to a heap out-of-bounds write during TC offload. A race between sizing a flow_rule buffer and filling it can allow an attacker with CAP_NET_ADMIN to write controlled content beyond the allocated memory region.

In the Linux kernel Bluetooth (MGMT) subsystem, a use-after-free vulnerability exists during advertisement monitor addition. Improper ownership handling between the MSFT add path and management command completion can lead to use of freed memory, as shown by a KASAN report.

In the Linux kernel's Bluetooth ISO subsystem, there is a vulnerability related to improper handling of ISO_END/CONT packets. Incorrect handling can lead to memory leak of conn->rx_skb, kernel panic on skb_put, or acceptance of too short ISO_END packets.

In the Linux kernel's accel/amdxdna driver, there is a use-after-free vulnerability due to a race in VMA access. The functions aie2_populate_range() and amdxdna_umap_release() access a saved VMA pointer that may have already been freed, leading to potential use-after-free.

In the Linux kernel's net/tls module, there is an issue in tls_sw_read_sock() that causes empty TLS application data records to block subsequent data records. Empty records (allowed in TLS 1.3) are not consumed, leading to an infinite loop and connection stall.

In the Linux kernel's accel/amdxdna module, there is a race condition in amdxdna_umap_release() that can lead to use-after-free when aie2_populate_range() runs concurrently.

In the Linux kernel, a vulnerability in the CIFS/SMB client causes a busy dentry warning during unmount after direct I/O (DIO) operations. The issue stems from delayed dentry reference release via workqueues, potentially leading to improper unmount. The fix adds a per-superblock outstanding request counter and waits for it to reach zero before unmounting.

In the Linux kernel, the regulator_lock_two() function compares the error code against -EDEADLOCK instead of -EDEADLK. On MIPS, SPARC, and PowerPC architectures these values differ, causing the code to fall into WARN_ON and return with only one regulator locked when a real deadlock backoff occurs. In practice, the bug only affects MIPS because the regulator core is not built or used on the other platforms.

In the Linux kernel octeontx2-af driver, mbox handling for a VF with promiscuous and all_multi flags set to false causes deletion of the PF's promiscuous and allmulti MCAM rules. This occurs because the APIs that enable/disable these rules operate only on the PF, even when the request comes via a VF interface. The fix adds an is_vf() check in the disable paths to prevent a VF from inadvertently clearing the PF's MCAM rules.

In the Linux kernel SMB client, smb2_ioctl_query_info() validates the PASSTHRU_FSCTL response payload before copying it to userspace. The addition of OutputOffset and qi.input_buffer_length can wrap in 32-bit arithmetic, allowing a malicious server to bypass the bounds check and read outside the response buffer. The fix uses size_add() for safe addition.

In the Linux kernel, the sof_ipc4_bytes_put() function has a TOCTOU vulnerability where the copy size is derived from the old buffer instead of the new data. This can lead to truncation of valid data or copying stale bytes.

In the Linux kernel, there is a missing validation of the MODULE_NOTIFICATION payload size before reading bytes/channel data in control update handling.

In the Linux kernel, the sof_ipc3_control_update() function calculates expected_size using firmware-provided num_elems, which can overflow on 32-bit platforms. This could allow size comparison to pass with mismatched sizes, potentially leading to out-of-bounds access.

In the Linux kernel, the sof_ipc3_bytes_put() and sof_ipc3_bytes_get() functions have TOCTOU vulnerabilities and incorrect bounds checking. In bytes_put, the copy size is derived from the old buffer, and in bytes_get, the flex array offset is not accounted for.

In the Linux kernel, the qrtr_endpoint_post() function has a 32-bit integer overflow in the ALIGN(size, 4) calculation, which can lead to out-of-bounds write and kernel oops on 32-bit platforms.

In the Linux kernel, the check_tp() function does not reject ATM traffic classes above ATM_ANYCLASS, which can lead to out-of-bounds read when reading /proc/net/atm/pvc.

In the Linux kernel for LoongArch, KVM lacks validation of the irqchip index in irqfd routing, which can lead to out-of-bounds access past the routing table's chip array.