In the Linux kernel, the following vulnerability has been resolved: net: atm: reject out-of-range traffic classes in QoS validation Reject ATM traffic classes above ATM_ANYCLASS in check_tp(). SO_ATMQOS stores the supplied QoS after check_qos() succeeds, so accepting larger values leaves invalid traffic_class values in vcc->qos. That bad state later reaches pvc_info(), which indexes class_name[] with vcc->qos.{rx,tp}.traffic_class. Values above ATM_ANYCLASS cause an out-of-bounds read when /proc/net/atm/pvc is read. Tighten the existing QoS validation so invalid traffic_class values are rejected at the point where user supplied QoS is accepted.
A vulnerability in the Linux kernel's qede driver causes an off-by-one error in buffer descriptor (BD) ring consumption when memory allocation fails. This occurs because qede_rx_build_skb() and qede_tpa_rx_build_skb() do not properly check for NULL returns from qede_build_skb(), leading to desynchronization of the BD ring and potential memory corruption. The issue has been fixed by adding proper NULL checks to prevent BD ring manipulation on failure.
A vulnerability in the Linux kernel's AFS subsystem was fixed by adding a missing NULL pointer check in the afs_break_some_callbacks() function. The flaw involved not verifying if afs_lookup_volume_rcu() returned NULL, which could occur if the specified volume was unknown. This issue affects specific versions of the linux-hwe-edge kernel. The vulnerability has a high severity score and a patch is available.
A use-after-free vulnerability was identified and resolved in the Linux kernel's fbnic network driver related to caching shared info pointers across skb reallocations during LSO calls. This flaw could lead to kernel memory corruption and potential system compromise. The issue affects multiple specific Linux kernel versions and has been addressed by official patches. The vulnerability has a high CVSS score of 9.8, indicating critical impact on confidentiality, integrity, and availability. Users should apply the available kernel updates and reboot to mitigate the risk.
A vulnerability in the Linux kernel's netfilter nf_conncount module caused valid connections to be falsely dropped when using connection limits in soft-limiting scenarios. This regression occurred when a new connection reused a socket in the TIME_WAIT state, leading to incorrect connection tracking and connection drops. The issue was fixed by changing the connection counting logic to be protocol-agnostic and properly handle early-confirmed connections. The fix has been tested to ensure soft-limiting scenarios are not broken.
A vulnerability in the Linux kernel's AppArmor subsystem caused an uninitialized pointer to be passed to the audit_log_untrustedstring() function. This bug, introduced by a recent commit, could lead to a kernel page fault and system crash when certain path structures were replaced with a null dentry. The issue has been fixed in updated Linux kernel versions.
A use-after-free vulnerability in the Linux kernel's NVIDIA Tegra embedded controller (NVEC) staging driver was fixed. The flaw occurs in the nvec_rx_completed() function when it accesses freed memory after returning a message to the pool. This can lead to reading stale or overwritten data. The issue affects specific Linux kernel versions related to NVIDIA Tegra. A patch is available to address this vulnerability.
A vulnerability in the Linux kernel's xilinx SPI driver caused incorrect determination of the FIFO buffer size, leading to a potential infinite loop and driver lockup when operating in interrupt mode. The issue arises because the driver overestimates the FIFO size by one due to the presence of a shift register, causing a mismatch in RX FIFO handling. This flaw has been fixed by correcting the FIFO size calculation logic.
A vulnerability in the Linux kernel's Btrfs filesystem code caused an invalid pointer dereference in the __btrfs_run_delayed_refs() function due to improper handling of error pointers returned by btrfs_select_ref_head(). This could lead to a denial of service (system crash). The issue was introduced after a code refactoring and has been fixed by restoring proper error handling and loop control logic.
A time-of-check to time-of-use (TOCTOU) heap overflow vulnerability was fixed in the Linux kernel's RDMA/rxe subsystem. The function get_srq_wqe() reads a user-space mapped shared receive queue buffer field num_sge twice, validating it once but using the second read for memcpy size calculation. This allows a concurrent user-space thread to modify num_sge between validation and use, causing a heap buffer overflow. The issue affects specific linux-azure kernel versions. A patch is available that reads num_sge once into a local variable for consistent validation and use.
A vulnerability in the Linux kernel's RDMA/rxe component for non-SRQ Queue Pairs (QPs) allowed malicious users to modify Work Queue Element (WQE) fields during kernel processing, causing out-of-bounds reads. This issue was addressed by copying the WQE to a kernel-local buffer after validating fields, preventing unsafe user-space modifications. The vulnerability affects specific linux-azure kernel versions and has a CVSS score of 7.8, indicating a high impact on confidentiality, integrity, and availability. A patch is available to remediate this issue.
An off-by-one heap buffer overflow vulnerability was identified and fixed in the Linux kernel's crypto CCP subsystem in the function snp_filter_reserved_mem_regions(). The flaw involved an incorrect bounds check that allowed writing beyond the allocated buffer size when the number of elements was at a boundary value. This vulnerability has been addressed with an official patch. The CVSS score is 7.8, indicating a high impact on confidentiality, integrity, and availability. Multiple specific Linux kernel versions are affected. No known exploits in the wild have been reported.
A vulnerability in the Linux kernel's rtw89 WiFi driver was fixed by adding a bounds check on the firmware mac_id used in link lookup. The mac_id field in RX descriptors is 8 bits wide (0-255), but the driver only supports 128 entries, and the firmware value was not validated before use as an array index. This could lead to out-of-bounds access. The issue affects specific Linux kernel versions and has been patched.
A vulnerability in the Linux kernel's rxrpc subsystem could lead to a NULL pointer dereference due to improper handling of buffer allocation in the rxrpc_verify_data function. This flaw occurs when rxrpc_recvmsg_data calls rxrpc_verify_data without ensuring the rx_dec_buffer is allocated, potentially causing a crash. The issue has been fixed by modifying rxrpc_verify_data to always attempt allocation if the buffer is NULL. Multiple specific Linux kernel versions are affected. A patch is available to address this vulnerability.
A vulnerability in the Linux kernel's rxrpc subsystem involving improper handling of out-of-band (OOB) messages with MSG_PEEK has been resolved. The flaw allowed a peeked OOB message to be moved onto a pending queue without proper unlinking, causing memory corruption and use-after-free conditions. This could lead to system instability or compromise. The issue affects specific Linux kernel versions and has been addressed by official patches.
A use-after-free vulnerability was identified and resolved in the Linux kernel's Rockchip DRM driver, specifically in the inno-hdmi encoder handling. The issue arose because the encoder's internal structure was allocated with device-managed memory (devm_kzalloc) but accessed after it was freed during cleanup, leading to potential use-after-free. The fix involved switching to drm-managed allocation (drmm_kzalloc) to ensure the structure remains valid during encoder cleanup. This vulnerability affects specific versions of the linux-hwe-edge kernel and has been addressed with an official patch.
A double unlock vulnerability in the Linux kernel's rxrpc_recvmsg() function was fixed. This flaw involved improper handling of out-of-band (OOB) messages leading to a double unlock condition. The issue affects multiple specific Linux kernel versions and has a high CVSS score of 9.8, indicating critical impact on confidentiality, integrity, and availability. The vulnerability has been addressed in official Linux kernel updates, and users are advised to apply these patches and reboot their systems. No known exploits are reported in the wild.
A vulnerability in the Linux kernel's rxrpc subsystem was fixed to address a reference leak in the recvmsg(MSG_PEEK) function. The issue involved the function holding a reference on an already-released call, which could lead to resource leaks. This flaw was resolved by ensuring the reference is properly dropped when MSG_PEEK is specified. Multiple specific Linux kernel versions are affected. A patch is available to remediate this issue.
A vulnerability in the Linux kernel's rxrpc subsystem was fixed to properly handle the reception of a reply data packet before any request data packets are sent on a client call. Without this fix, the kernel could experience a crash (oops) due to improper handling of the transmission window. The issue was addressed by correcting the rxrpc_receiving_reply() function and modifying rxrpc_rotate_tx_window() to handle cases where the transmission queue is empty, such as when a call is terminated early by a reply. This vulnerability affects specific versions of the linux-hwe-edge kernel and has a CVSS score of 7.5.
A vulnerability in the Linux kernel's rxrpc subsystem could cause a potential infinite loop in the rxrpc_recvmsg() function due to improper wait handling and out-of-band queue checks. This issue has been resolved in specific Linux kernel versions. The vulnerability has a CVSS score of 7.5, indicating a medium severity with a high impact on availability but no impact on confidentiality or integrity. A patch is available to fix this issue.