CVE Vulnerability Catalog

A race condition in the Linux kernel between pressure write and cgroup file release leads to a use-after-free vulnerability in the priv member of struct kernfs_open_file.

In the Linux kernel netfilter/nf_tables subsystem, a vulnerability was found where new hooks are published unsafely into the basechain/flowtable list during the commit phase. The lack of splice_list_rcu() can cause race conditions between netlink dump traversal and concurrent ruleset updates.

In the Linux kernel, the amdgpu driver has a double call to drm_exec_fini() in the userq validation function. When new_addition is true, exec is finalized first, and then on error from amdgpu_ttm_tt_get_user_pages(), drm_exec_fini() is called again, causing a double free. The issue was found by a static analysis tool and confirmed by code review.

In the Linux kernel, a vulnerability was found in the airoha network driver causing a BQL (Byte Queue Limits) imbalance in the TX path. The issue stems from incorrect TX queue indexing, where inflight packets are accounted only for a limited number of queues, while completions are accounted for all queues.

In the Linux kernel, the neigh_xmit function leaks an skb when called with an uninitialized neighbor table (e.g., NEIGH_ND_TABLE with IPv6 disabled). The function did not free the packet in that case, and its return value was ignored by callers like MPLS. The fix ensures full skb ownership and removes the last code path that neither transmits nor frees the packet.

Two bugs were found in the drm/xe graphics driver's xe_exec_queue_create_ioctl() function. The first leaves a dangling pointer when xe_hw_engine_group_add_exec_queue() fails. The second fails to remove the queue from the engine group after xa_alloc() failure, causing a use-after-free.

A data race was found in the Linux kernel's bonding 802.3ad (LACP) implementation due to missing RCU protection for the port->aggregator pointer. The fix adds the __rcu qualifier and proper RCU API usage.

A memory leak was discovered in the Linux kernel's TLS subsystem. During a failed attempt to switch TLS RX to hardware offload, the cleanup function did not free the anchor skb allocated by strparser. The issue was introduced after a change to the strparser implementation.

A vulnerability in the Linux kernel futex subsystem where need_futex_hash_allocate_default() incorrectly required CLONE_THREAD for proper hash allocation. This caused a use-after-free bug when sharing memory (mm) in non-thread ways, such as via child processes.

In the Linux kernel, a use-after-free vulnerability was found in the ena driver's get_timestamp function. The issue is caused by missing synchronization when checking the active flag and reading the DMA memory pointer, potentially leading to NULL pointer dereference.

A vulnerability was found in the Linux kernel's KVM subsystem in the kvm_reset_dirty_gfn() function. Missing overflow check when adding offset and mask allows bypassing range validation via integer wrap. An attacker can exploit this for out-of-bounds memory access.

In the Linux kernel, a vulnerability in the KVM subsystem for s390 architecture causes double-scaling of pointer arithmetic when indexing the GAIT table. Functions kvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and aen_host_forward() manually multiply the index by sizeof(struct zpci_gaite), leading to out-of-bounds access for aisb >= 32.

In the Linux kernel, the SMB/client subsystem has a vulnerability causing an infinite loop and out-of-bounds read in the symlink_data() function. On 32-bit architectures, an invalid ErrorDataLength value can make the next pointer point to the beginning of the structure or beyond it.

A buffer leak was discovered in the __ceph_setxattr() function in the Ceph filesystem within the Linux kernel. During retries, the old_blob variable stores the ci->i_xattrs.prealloc_blob value but is never freed via ceph_buffer_put(), causing a memory leak.

In the Linux kernel, a vulnerability was found in the Ceph filesystem where folios not suitable for writeback were not released properly. The function removing folios from the batch did not call `folio_put`, causing a memory leak.

In the Linux kernel's sev-guest driver, a vulnerability was found where a host-controlled value is used to compute the page order when freeing a buffer. The host may return an expected buffer size, which is then used to calculate the page order, potentially leading to corruption in the page allocator.

In the Linux kernel's libceph library, a null pointer dereference vulnerability was found during decoding of choose_args in the CRUSH map. The issue occurs when a received message contains a bucket_index pointing to a non-existent (NULL) bucket, potentially causing a system crash.

In the Linux kernel's libceph, a potential out-of-bounds access vulnerability was found in __ceph_x_decrypt(). An attacker can send a crafted authentication frame causing a read beyond the allocated buffer, potentially leading to information disclosure or system crash.

In the Linux kernel's libceph, the decode_choose_args() function lacks proper error handling for rbtree insertion. A corrupted CEPH_MSG_OSD_MAP message with duplicate choose_args indices triggers an assertion leading to a kernel BUG.

A vulnerability in the Linux kernel's iommu/vt-d driver causes an Oops when killing a QEMU process. The issue is due to out-of-scope access to the global static blocked domain, which lacks a proper dmar_domain structure.