Sashiko

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** DAMON RECLAIM and DAMON LRU SORT may dereference NULL pointers if the allocation of their `damon ctx` objects fails. In DAMON RECLAIM, the `damon reclaim enabled store()` function incorrectly assumes that the allocation of the `damon ctx` object for its kdamond will always succeed. If the allocation fails, the execution reaches the `damon commit ctx()` function while the `ctx` variable is NULL, leading to a NULL pointer dereference. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An issue exists in the network PHY subsystem where the `sfp bus del upstream()` function is not called during a probe failure path. This results in the sfp-bus retaining a dangling `upstream` field, which may be incorrectly accessed during subsequent SFP events. This behavior was present both in the generic phylib SFP support and in earlier versions where drivers invoked `phy sfp probe()` directly. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A double-free issue exists in the `netdev nl bind rx doit()` function. This occurs because `genlmsg reply()` always consumes the socket buffer (skb), but the error path incorrectly calls `nlmsg free(rsp)`, leading to the memory being freed twice. This situation typically arises when the kernel is called with an already-full receive buffer (`rcvbuf`). **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An issue exists in the RDMA core where the `ib get ucaps()` function fails to properly validate the passed-in file operations (fops). Because character and block devices can share the same `dev t` (device identifier), a user could potentially use a block device with a matching `dev t` to masquerade as a ucap character device file descriptor. This occurs because the system relied solely on the `dev t` for identification rather than verifying the actual file operations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A flaw exists in the netfilter component where the `ebt redirect tg()` function dereferences the return value of `br port get rcu()` without a NULL check. This can lead to a kernel panic if a bridge port is removed between the original hook invocation and an NFQUEUE reinject. Additionally, if userspace moves the device to a different virtual device, such as macvlan, the packet cannot be reinjected into the bridge path and must be dropped. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An issue exists in the network PHY subsystem where the system attempts to set up PHY-driven SFP cages when using genphy. Because genphy does not support PHY-driver SFP cages, calling the `sfp bus add upstream()` function leads to a deadlock on RTNL (Routing Netlink), as PHY probing for genphy occurs under RTNL unlike non-genphy drivers. This occurs when the `phy sfp probe()` function is executed during the genphy probing path. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A race condition exists in the Direct Rendering Manager (DRM) Graphics Execution Manager (GEM) subsystem of the Linux kernel. The issue occurs within the `change handle` ioctl during concurrent operations between `gem close` and `gem change handle` functions. This flaw can lead to incorrect graphics memory handling, which may result in system instability or unexpected behavior. **Recommendations** As a temporary workaround, disable the `change handle` ioctl until a permanent fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A use-after-free and resource leak issue exists in the `spi: mpc52xx` component. The problem occurs when controller registration fails, as interrupts are not properly disabled and freed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) openSUSE Tumbleweed versions prior to kernel-devel-7.0.11-1.1 **Description** An out-of-bounds read exists in the `spi nor params show()` function within the spi-nor debugfs component. The issue occurs because the `snor f names` array is passed to the `spi nor print flags()` function using `sizeof()`, which returns the total byte size of the pointer array rather than the number of elements. On 64-bit systems, this results in a length eight times larger than intended. If a flag bit is set that exceeds the actual element count but falls within the inflated byte-size count, the `names len` argument fails to properly bounds-check the `names` array access, leading to an out-of-bounds read. **Recommendations** Update to a version where `ARRAY SIZE()` is used instead of `sizeof()` to pass the actual number of string pointers in the array. Update to kernel-devel-7.0.11-1.1 or a newer version.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 7.0.11-1.1 **Description** A memory corruption issue exists in the RDMA hns component. The function `hns roce qp remove()` is called without the required locks during the error unwind process within the `hns roce create qp common()` function. **Recommendations** Update to version 7.0.11-1.1.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 7.0.11-1.1 **Description** A flaw exists in the RDMA mana component where a user can specify Work Queues (WQs) sharing the same Completion Queue (CQ) as part of the user API. This action triggers a `WARN ON()` condition within the `mana ib create qp rss()` function, which can lead to kernel corruption. **Recommendations** Update to version 7.0.11-1.1.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A NULL pointer dereference occurs in the RDMA/ocrdma component within the `ocrdma copy pd uresp()` function. The issue arises because `pd->uctx` is not initialized until late in the function execution, causing error flow references to be NULL and resulting in a system crash. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) openSUSE Tumbleweed versions prior to kernel-devel-7.0.11-1.1 **Description** An error unwind issue exists in the RDMA mana component. Specifically, the `mana ib create qp rss()` function fails to properly handle error unwinding, which leads to a leak of `mana ib cfg vport steering()`. This resource is typically cleaned up during the normal destroy path but is not handled correctly during the error path. **Recommendations** Update to a version of the Linux kernel where the `mana ib create qp rss()` error unwind is fixed. Update to kernel-devel-7.0.11-1.1 or a newer version for openSUSE Tumbleweed.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 7.0.11-1.1 **Description** An issue exists in the RDMA/mana component where the `rx hash key len` variable, which originates from a uAPI structure, is passed to the `memcpy()` function without proper validation. This lack of bounds checking allows userspace applications to cause a memory overflow, potentially leading to the corruption of kernel memory. **Recommendations** Update to version 7.0.11-1.1.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) openSUSE Tumbleweed versions prior to kernel-devel-7.0.11-1.1 **Description** A resource leak occurs in the RDMA/mlx4 component of the Linux kernel. The issue exists within the `mlx4 ib create srq()` function, where the `mlx4 srq alloc()` function is not properly undone during error unwind, leading to a failure to call `mlx4 srq free()`. **Recommendations** Update to a version where the `mlx4 srq free()` call has been added to the error unwind path in `mlx4 ib create srq()`. Update to kernel-devel-7.0.11-1.1 or a newer version.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A race condition exists between the `damon call()` and `damos walk()` functions and the `kdamond fn()` termination process. Because the registration of requests in `damon call()` and the unsetting of `damon ctx->kdamond` are protected by different mutexes, a caller may register a new request and begin waiting for it just as the `kdamond` thread is terminating. Since the terminating thread no longer handles new requests, this leads to infinite waiting and deadlocks. Additionally, if a request in repeat mode includes `dealloc on cancel`, memory leaks may occur. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A race condition exists between the `damos walk()` and `kdamond fn()` functions. When the `kdamond fn()` main loop finishes, it cancels remaining `damos walk()` requests and unsets `damon ctx->kdamond`. Because request registration and the unsetting of `damon ctx->kdamond` are protected by different mutexes, `damos walk()` may register a new request and perceive the context as still running just before `damon ctx->kdamond` is unset. This leads to a situation where the caller thread waits indefinitely for a request that will never be handled, resulting in a deadlock. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An issue exists in the ext4 filesystem where pending discard work is not properly handled during remounting. If a filesystem is initially mounted with the discard option and files are deleted, the `s discard list` is populated and `s discard work` is queued. If the filesystem is subsequently remounted with the nodiscard option, the `EXT4 MOUNT DISCARD` flag is cleared, but the pending `s discard work` is neither cancelled nor flushed. This can lead to a bug when the filesystem is unmounted before the queued work drains automatically. The flaw involves the `ext4 mb release()` function. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.