These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability in the Linux kernel's net/smc has been addressed. The SMC-Rv2 LLC messages were not properly handled, allowing oversized messages to be carried in the queue entry. This could lead to deletion of registered rtokens and installation of new rtokens. The issue has been resolved by copying the tail into the queue entry and declaring rkeys that fit inline as a member of the union.
A vulnerability in the Linux kernel's net/smc module could allow a local attacker to cause a NULL pointer dereference on the SMC-D teardown path, potentially leading to a system crash. The vulnerability was resolved by sampling the pointer once in the helper and reporting nothing prepared while it is unset. Linux kernel developers and administrators should review the Linux kernel patch notes and apply the [truncated]
A Linux kernel vulnerability has been identified in the net/smc implementation, which could lead to a socket reference count leak. This issue arises from the smc_switch_conns function not properly releasing a reference to the SMC socket in certain error scenarios, potentially resulting in the socket remaining alive indefinitely. This could prevent the network namespace from being torn down and lead to resource leaks.
A use-after-free vulnerability was found in the Linux kernel's net/smc component. The smc_rx_pipe_buf_release function did not properly handle socket state changes, leading to potential use-after-free issues. This vulnerability has been resolved by taking the socket lock first and testing conn->freed instead. The vulnerability affects Linux kernel developers and maintainers, as well as system administrato [truncated]
A use-after-free vulnerability was found in the Linux kernel's net/smc component. The smc_llc_srv_add_link function improperly accesses memory after it has been freed, potentially leading to unexpected behavior or crashes. This issue has been resolved in the kernel. The vulnerability can be triggered when a link without a shared v2 receive buffer is used. The smc_llc_srv_add_link function keeps add_llc po [truncated]
A vulnerability in the Linux kernel's net/smc has been resolved, where three connection state flags (killed, freed, and out_of_sync) shared a byte, leading to potential read-modify-write issues. The flags have been separated to prevent unintended modifications. This change ensures that modifications to one flag do not affect the others, enhancing the stability and security of the Linux kernel's net/smc fu [truncated]
A vulnerability in the Linux kernel's net/smc has been resolved. The issue involves unregistering a connection before draining the rx tasklet, which can lead to a use-after-free issue. Linux kernel users should assess exposure and verify vulnerability status. The CVE record and NVD entry provide details on the vulnerability. However, the scope of affected systems and versions is not explicitly stated. The [truncated]
A vulnerability in the Linux kernel has been resolved, affecting the net: cap advertised IP tunnel headroom. The IP tunnel devices derive their advertised needed_headroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can represent. Once IP output reserves it, skb head expansion can wrap those offsets.
A vulnerability in the Linux kernel's network stack has been addressed. The issue, resolved in a recent commit, pertains to the handling of zerocopy state in the `skb_tx_error()` function. When a cloned skb is passed to this function, it could potentially modify shared zerocopy state, leading to unexpected behavior. This situation can occur in Open vSwitch when a non-last `OVS_ACTION_ATTR_RECIRC` action i [truncated]
A vulnerability in the Linux kernel's seg6 implementation can cause an out-of-bounds read when processing IPv6 packets. The issue arises from the incorrect handling of the IPv6 control block after decapsulation. An unprivileged user can exploit this by injecting a specially crafted packet, potentially leading to a denial of service. The vulnerability was resolved by resetting the IP6CB after IPv6 decapsul [truncated]
A vulnerability in the Linux kernel's qnap-mcu driver allows for stack corruption due to improper handling of a receive buffer. The buffer is allocated on the stack and its address is published to the receive path. If a command times out or qnap_mcu_write() fails, the buffer remains allocated on the stack and can be written to by a late or unsolicited message from the MCU, corrupting the stack frame.
A memory leak vulnerability was found in the Linux kernel's mfd sm501 driver. The sm501_pci_probe() and sm501_plat_probe() functions allocate memory for struct sm501_devdata, but the corresponding remove functions sm501_pci_remove() and sm501_plat_remove() do not free this memory. This could potentially lead to memory leaks when the device is removed.
A Linux kernel vulnerability was found in the ALSA 6fire driver, where the usb6fire_comm_receiver_handler() function forwards MIDI events with a user-supplied length, without bounds checking. This could lead to a buffer overflow when reading from the receiver buffer. The issue arises from the function not properly validating the length of MIDI events received from the device, potentially allowing an attac [truncated]
A vulnerability in the Linux kernel's ALSA aloop driver allows for out-of-bounds access when a manually bound device has an invalid card index. This issue has been resolved with an added sanity check. The vulnerability was addressed by adding a check for the card index validity at probe time, preventing potential out-of-bounds access. Linux kernel maintainers, Linux distribution vendors, and users of Linu [truncated]
A use-after-free vulnerability exists in the Linux kernel's ALSA bcd2000 driver. When a USB device is disconnected, the URB pointers are not cleared, allowing a substream that is still open to access the freed URB. This can lead to a slab-use-after-free error. The vulnerability was discovered by XBOW and triaged by Baul Lee. The issue is caused by the bcd2000_free_usb_related_resources function freeing th [truncated]
A Linux kernel vulnerability allows uninitialized data to be copied to userspace. The ALSA FCP ioctl_init function allocates a response buffer and copies it back to userspace without clearing it. This can lead to exposure of kernel memory. The issue was resolved by zeroing the buffer and requiring the step-0 transfer to deliver the full step0_resp_size bytes.
A vulnerability in the Linux kernel's ALSA mpu401 driver allows for out-of-bounds access when a manually bound device has an invalid card index. This issue has been resolved with a sanity check for the card index. The vulnerability was addressed by adding a check to ensure the card index is within the valid range, preventing potential out-of-bounds access. This fix helps to enhance the security of the Lin [truncated]
A vulnerability in the Linux kernel's ALSA mts64 driver allows for out-of-bounds access due to a missing check for negative card index values. This issue can occur when the driver is bound via sysfs. A fix has been applied to add a sanity check for the card index and correct it if it's out of range. The fix ensures the card index is within a valid range, preventing potential out-of-bounds access and syste [truncated]
A vulnerability in the Linux kernel's ALSA portman2x4 driver has been addressed. The driver did not check for negative card index values when bound via sysfs, potentially leading to out-of-bounds access. A sanity check has been added to warn and correct invalid card index values. This change helps prevent potential out-of-bounds access by ensuring valid card index values are used, improving the security a [truncated]
A vulnerability in the Linux kernel's ALSA serial-u16550 driver allows for out-of-bounds access when a manually bound device has an invalid card index. This issue has been resolved with a sanity check for the card index. The vulnerability was addressed by adding a check to ensure the card index is within the valid range, preventing potential out-of-bounds access. Linux kernel developers and administrators [truncated]
The Linux kernel's ALSA virmidi driver has a vulnerability due to improper validation of the card index. This can lead to out-of-bounds access if a device is bound manually via the sysfs interface. The issue has been resolved with a sanity check for the card index. The vulnerability requires attention from Linux kernel developers, maintainers, and users of Linux systems with ALSA virmidi driver. Affected [truncated]
A vulnerability in the Linux kernel's dm-stats component can cause a crash if allocation of per-cpu data fails. The issue arises when dm_kvzalloc() fails, leading to a NULL pointer dereference in dm_stat_free(). This vulnerability affects Linux kernel maintainers, administrators, and security teams responsible for patching and mitigating vulnerabilities in Linux-based systems. The affected component, dm-s [truncated]
Linux kernel vulnerability in dm-pcache allows for out-of-bounds access and potential data corruption due to insufficient validation of on-disk cache_info geometry fields. This vulnerability could lead to system crashes or potential data corruption if exploited. Defenders should review and apply kernel updates, verify cache device integrity, and monitor system logs. The CVE record and NVD entry provide de [truncated]
The Linux kernel's dm-pcache module is vulnerable to out-of-bounds reads due to unbounded kset key_num and intra-segment bounds. This allows users with CAP_SYS_ADMIN privileges to potentially leak adjacent persistent memory to user space. The vulnerability arises from the lack of bounds checking on kset key_num and intra-segment offsets, leading to potential out-of-bounds reads. System administrators and [truncated]
The Linux kernel's dm-pcache module is vulnerable to an out-of-bounds write due to improper validation of on-media seg_num against the cache device size. This issue can be triggered at table load by a user with CAP_SYS_ADMIN privileges, potentially leading to a denial of service or privilege escalation. Administrators should assess their exposure and apply patches or mitigations as necessary. The vulnerab [truncated]
A vulnerability in the Linux kernel's dm-pcache module allows an attacker with CAP_SYS_ADMIN privileges to read past the segment data, potentially leading to information disclosure. The issue arises from the cache_pos_decode function not properly bounding the persisted tail-position offset. This could allow an attacker to access sensitive information. Linux kernel users should assess their exposure and ve [truncated]
The Linux kernel has a vulnerability in the dm-pcache module. A tail near the segment end reads past the segment data into the following control area. This issue has been resolved by clamping the read to cache_seg_remain(), the data region. The vulnerability requires verification and potential patching to prevent data exposure. Linux kernel developers, administrators, and users who utilize the dm-pcache m [truncated]
A vulnerability in the Linux kernel's dm-pcache module has been resolved. The vulnerability occurs when the cache_replay() function follows the on-media last-kset chain with no cond_resched(), allowing a forged chain to cause an infinite loop. This issue can lead to a denial-of-service attack if exploited. Linux kernel maintainers and users should assess exposure and apply patches to prevent potential att [truncated]
A vulnerability in the Linux kernel's dm-pcache module could allow a local attacker to cause a denial of service or potentially execute arbitrary code. The vulnerability exists because the get_cache_segment function does not properly check if a cache segment is initialized before handing it out, which can lead to a NULL pointer dereference when the cache_kset_close function writes through the returned seg [truncated]
A vulnerability in the Linux kernel's i3c subsystem allows for an unlocked dereference of dev->desc in the i3c_device_get_supported_xfer_mode() function. This could potentially lead to a crash or other undefined behavior. The issue arises from the function's failure to hold the bus->lock when accessing dev->desc, which is necessary for safe dereferencing. This vulnerability impacts the stability and secur [truncated]