CVE Vulnerability Catalog

A use-after-free in the Linux kernel tracing/histograms subsystem: find_synth_event() compared only the event basename, so registering or removing a histogram on a non-synthetic event whose basename matched a synthetic event erroneously modified the synthetic event's refcount. This could free the synthetic event while an active histogram action still held a pointer to it.

In the Linux kernel, syscall_copy_user_array() was fixed to use copy_from_user() instead of __copy_from_user() when copying the buffer argument of faultable syscalls (write, pwrite64, etc.). Skipping access_ok() allowed a non-user address to be accepted.

In the Linux kernel's io_uring waitid implementation, a use-after-free occurs. io_waitid_wait() clears ->head before taking ownership of the request by incrementing ->refs, allowing another thread to complete and free the request while the wake-up handler still touches it.

In the Linux kernel, io_uring_cmd_del_cancelable() was fixed to not leave LIST_POISON in ->hash_node; it used hlist_del(). Requests are recycled without reinitialisation and not every user of ->hash_node sets it up before use, leading to a write through LIST_POISON2 and a general protection fault.

In the Linux kernel, a spin in io_cqring_wait_schedule() was fixed when IO_CHECK_CQ_OVERFLOW_BIT is set and the overflow list cannot be flushed. The task spins in the kernel and cannot be killed, e.g. with IORING_SETUP_CQE_MIXED or when the application moves the CQ head.

A bug was fixed in the Linux kernel's io_uring/io-wq where the signal ending work could be lost. When a thread exits, its io-wq is torn down and workers are signalled, but a worker that had not yet started the work could lose the signal. This caused the thread to hang in do_exit(), e.g. with IORING_OP_OPENAT of a FIFO without a writer and IOSQE_ASYNC.

In the Linux kernel, the io_uring/waitid mechanism has a reference counter bug where repeated failed cancellation attempts can wrap the 31-bit reference field to zero. A later cancellation can then claim ownership and complete the request a second time.

A use-after-free flaw was fixed in the Linux kernel's find_keyring_by_name() during named keyring lookup. The function read keyring->user->uid under keyring_name_lock, which does not protect the separate key_user object, so a concurrent KEYCTL_CHOWN could free the old key_user between the pointer load and the UID read. The fix uses the inline keyring->uid field instead of dereferencing the owner account.

A vulnerability exists in the Linux kernel's search_process_keyrings_rcu() function, which validates the authorization payload and saved credentials. Due to a race condition between a request-key helper's descendant and the requester, request_key_auth_revoke() can clear the payload pointer, leading to a NULL dereference and kernel oops.

A flaw was fixed in the Linux kernel's keyctl_describe_key(), where the key type's name could be freed by a module unload (e.g., AF_RXRPC) while the key description was being formatted. This led to a use-after-free and a page fault in string(). The fix holds key->sem across the kasprintf() call.

In the Linux kernel, keyring indexes contained kernel addresses (hashes of type and domain pointers), allowing an unprivileged user to predict key ordering and recover the kernel image address, defeating KASLR. The fix removes addresses from the entire index, replacing them with lazily allocated 64-bit IDs hashed with a SipHash key.

A use-after-free vulnerability exists in the Linux kernel key management subsystem. keyctl_read_key() checks key->type->read without holding key->sem, so a surviving RxRPC key can be read while the AF_RXRPC module is being unloaded, accessing freed module memory.

In the Linux kernel, trusted_tpm_unseal() proceeded to call pcrlock() after a TPM unseal failure; if pcrlock() succeeded, its return value overwrote the unseal error, causing key instantiation to succeed despite the failure.

In the Linux kernel, the PKCS#8 parser leaves the asym_key_ids slot empty, and key_or_keyring_common() unconditionally dereferences it when a PKCS#8 key is supplied to a key_or_keyring restriction. An unprivileged caller can trigger a NULL pointer dereference via KEYCTL_RESTRICT_KEYRING followed by add_key(), causing a kernel panic.

In the Linux kernel, print_rec() leaves 'modname' and 'offset' uninitialized, and kallsyms_lookup() only sets them on success. When the lookup fails (e.g., during module load or unload), 'modname' holds a garbage value, passes the 'if (modname)' check, and is dereferenced by seq_printf(), causing a general protection fault.

In the Linux kernel, coredump_finish() releases parked threads without holding a reference on the task and outside of RCU. If the coredump client is preempted between the store and wake_up_process(), the thread can be freed and try_to_wake_up() accesses freed memory.

In the Linux kernel, the cleanup order in copy_process() caused a deadlock: a fork failing while another thread closed the bpf link fd deadlocked against its own read side of scx_fork_rwsem, blocking every fork on the system. The fix releases the child's files after sched_cancel_fork() and clears p->files up front.

The SUSE Rancher Fleet controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, an ordinary user could define a cluster in a namespace they control and associate it with administrative credentials for the management cluster, causing the controller to manage the management cluster on that user's behalf with elevated privileges. This affects Fleet 0.16.0–0.16.3, 0.15.0–0.15.8, 0.14.0–0.14.12, 0.13.0–0.13.17 and possibly older versions.

In the SUSE Rancher Manager meta proxy endpoint (/meta/proxy), the allowlist decision was evaluated where it could not stop a request from being forwarded. A rejected destination was logged but the request was still handed to the proxy's transport.

Control Web Panel (CWP) before webpanel_version 1.30 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root. The 'user' parameter is interpolated directly into a query against the oauth_clients table, enabling time-based blind SQL injection and extraction of arbitrary database contents.