CVE Vulnerability Catalog

A vulnerability was found in the Linux kernel's netfilter nf_nat module, involving the use of an invalid nat_net pointer after a failed nf_nat_init(). This leads to an out-of-bounds read (slab-out-of-bounds), which could be exploited by a local user to cause a system crash or potentially escalate privileges.

A vulnerability in the Linux kernel's netfilter (nf_conncount) causes incorrect packet drops for valid connections when using connlimit in soft-limiting scenarios. The issue occurs when a new connection reuses a socket in TIME_WAIT state, where the connection tracking entry is mistakenly treated as confirmed, leading to a zeroed active connection count and false rejection of traffic. The fix replaces the loopback interface check with protocol-agnostic state checks (IPS_ASSURED), allowing early-confirmed setup packets to be properly evaluated and counted.

In the Linux kernel, the nft_compat layer fails to reject non-bridge targets in ebtables emulation. xtables targets return verdicts incompatible with ebtables, which may lead to incorrect behavior.

In the Linux kernel, the ge_put_enum_double() function in ASoC SDCA lacks validation of the index value before use. This may lead to an out-of-bounds read of the values buffer.

In the Linux kernel, the DSA driver mxl862xx has a use-after-free of DSA ports in crc_err_work. The work may run after ports are freed, leading to dereferencing freed memory.

In the Linux kernel, in the octeontx2-af subsystem, an incorrect condition checking whether any LFs (Logical Functions) have been assigned to a PF/VF was fixed. The patch addresses validation of the maximum number of LFs set via the devlink command.

In the Linux kernel, the mvneta driver (Marvell Armada 370/XP/38x) has a vulnerability causing permanent masking of per-CPU interrupts after resume from suspend. If suspend occurs while NAPI poll is pending, the interrupt is never re-enabled, leading to complete loss of network connectivity.

In the Linux kernel, in the sungem subsystem, a double-free of resources during error handling in gem_init_one() was fixed. Previously, when register_netdev() failed, gem_remove_one() was called, and then the same resources were freed again, leading to a double-free.

In the Linux kernel, in the udp_tunnel subsystem, a vulnerability was fixed involving double queueing of work in udp_tunnel_nic_device_sync, leading to a use-after-free. The fix involves returning early if the work_pending flag is already set.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's TIPC UDP media bearer. The cleanup_bearer() function destroys the dst_cache before synchronizing with RCU readers, which can lead to system crashes or rcuref warnings. Additionally, freeing the ub structure after synchronize_net() without closing the socket first leaves a window for UAF for concurrent receivers.

In the Linux kernel, seg6_validate_srh() lacks a minimum length check before reading fixed SRH fields. The BPF SEG6 encap path can supply a too-short buffer, leading to an out-of-bounds read.

In the Linux kernel's hwmon subsystem (pmbus/core), pmbus_data2reg_vid() always uses VR11 encoding, ignoring the configured vrm_version. This can lead to sending wrong codes to PMBUS_VOUT_COMMAND, resulting in incorrect voltage.

In the Linux kernel's hwmon subsystem (pmbus), regulator events are passed to the regulator core as a combined bitmask. If multiple distinct faults occur, the mask does not match any case in regulator_handle_critical(), bypassing the critical hardware protection trigger.

A vulnerability in the Linux kernel's net/sched sch_teql module involves missing synchronization of the teql master's slaves list, leading to race conditions and use-after-free (UAF) during concurrent queue operations. This can compromise memory integrity.

A use-after-free vulnerability was found in the Linux kernel's bridge subsystem related to STP. Missing IFF_UP check in br_topology_change_detection() allows arming the topology change timer while the bridge is administratively down, leading to use-after-free when the bridge is deleted.

In the Linux kernel's SCTP subsystem, a race condition was found in sctp_free_addr_wq() regarding the addr_wq_timer. Using timer_delete() does not guarantee that a currently running timer handler has completed, which can lead to use-after-free.

In the Linux kernel's ksmbd server, a vulnerability was found where undersized DACLs are not properly rejected before parsing ACEs. Due to an underflow in the calculation, a malicious client can bypass the ACE count limit and cause excessive memory allocations.

In the Linux kernel's xen/pvcalls driver, the request ID (req_id) from the backend is not validated before being used as an index into the rsp[] array. A malicious or buggy backend can set req_id out of bounds, leading to an out-of-bounds write. Additionally, the int type for req_id does not cover u32 values, allowing negative indexing.

In the Linux kernel, in afs_extract_vl_addrs(), error codes are only set on the first iteration of the loop. Subsequent iterations do not update them, which can lead to incorrect error reporting.

In the Linux kernel's AFS filesystem, initializing the work_struct lock_work only once in the slab init function is insufficient. This causes DEBUG_OBJECTS warnings and potential issues on reuse. The fix requires reinitialization after inode allocation and flush before eviction.