CVE Vulnerability Catalog

In the Linux kernel, the BPF verifier's process_bpf_exit_full() passes check_lock = !curframe to check_resource_leak(), which is false when bpf_throw() is called from a static subprog. This skips validation of active locks on exception exits from subprograms, potentially causing runtime issues. The fix sets check_lock = true for exception exits.

In the Linux kernel, the HID: asus driver's asus_report_fixup() function returned a newly kmemdup()-allocated buffer that was never freed, causing a memory leak. The fix switches to devm_kzalloc() so the memory is managed and freed automatically when the device is removed. It also fixes a harmless out-of-bounds read by copying only the original descriptor size.

In the Linux kernel nvme-pci driver, it is possible to poll a queue that is not polled because a user can change the polled queue count at runtime. During a reset, a hipri task may poll the queue before the block layer updates the queue maps, potentially causing double completions.

In the Linux kernel, the HID: magicmouse driver's magicmouse_report_fixup() function returned a newly kmemdup()-allocated buffer that was never freed, causing a memory leak. The caller of report_fixup() does not take ownership of the returned pointer, but it is permitted to return a sub-portion of the input rdesc whose lifetime is managed by the caller.

A vulnerability in the Linux kernel's module loader lacks bounds checking for the ELF section index in simplify_symbols(). An out-of-bounds st_shndx value (e.g., 0xffff) can cause a kernel panic due to invalid memory access.

In the Linux kernel, the HID: apple driver's apple_report_fixup() function returned a newly kmemdup()-allocated buffer that was never freed, causing a memory leak. The caller of report_fixup() does not take ownership of the returned pointer, but it is permitted to return a sub-portion of the input rdesc whose lifetime is managed by the caller.

In the Linux kernel btrfs subsystem, a flaw exists where BTRFS_ROOT_ORPHAN_CLEANUP is not set during subvolume creation. This leads to a race between lookup and delayed iputs, producing broken dentries (shown as 'd?????????'), causing subvolume deletion to fail with ENOENT while creating a new file over it fails with EEXIST and may abort the filesystem.

A vulnerability was found in the Linux kernel's ESP over TCP (espintcp) implementation with async crypto. When the transmit queue is full, esp_output_tail_tcp returns an error but does not free the skb buffer, causing a memory leak. With synchronous crypto, the issue does not occur because the xfrm code drops the packet automatically.

In the Linux kernel, the af_key module's pfkey_send_migrate() function fails to validate address families (old/new), causing a skb buffer overflow (skb_over_panic) and system crash. The issue was reported by syzbot.

In the Linux kernel, a vulnerability was resolved in erofs: set fileio bio failed in short read case. For file-backed mount, IO requests are handled by vfs_iocb_iter_read(), which can be interrupted by SIGKILL, returning the number of bytes actually copied; unused folios in bio are unexpectedly marked as uptodate.

In the Linux kernel, the Enhanced Credit Based Flow Control path in l2cap_ecred_data_rcv() reads the SDU length field from skb->data without first verifying that the skb contains at least 2 bytes. When skb->len is less than 2, this reads past the valid data in the skb.

In the Linux kernel Bluetooth (L2CAP) subsystem, a missing NULL check on the sk pointer in l2cap_sock_ready_cb leads to a null-ptr-deref. This results in a kernel panic. The vulnerability is fixed by adding a null check before using the pointer.

A vulnerability in the Linux kernel's UDP implementation causes wildcard bind conflict checks to be skipped when the hash bucket count exceeds 10. The issue occurs because the code switches to the hash2 table (keyed by address and port) instead of the hash table (keyed by port only), allowing a wildcard bind to succeed despite existing specific-address binds on the same port.

In the Linux kernel, l2cap_conn_del() has a potential AB-BA deadlock. Cancellation of info_timer and id_addr_timer occurs while holding conn->lock, while the corresponding work functions also acquire the same lock.

In the Linux kernel, the L2CAP reconfiguration path in l2cap_config_req() re-invokes l2cap_ertm_init() without freeing previous allocations, leaking ERTM resources. Additionally, missing validation of the minimum remote_mps value allows zero, which in l2cap_segment_sdu() causes an infinite loop and memory exhaustion.

In the Linux kernel, the btusb driver in btusb_work() indexes the alts[] table with data->sco_num - 1 without constraining it to the number of available table entries. This can cause a read past the alts[] array.

In the Linux kernel, a vulnerability in the netfilter module allowed displaying connection expectations from other network namespaces via the /proc interface. The fix adds filtering to skip expectations not belonging to the current netns.

In the Linux kernel netfilter subsystem, a vulnerability in ctnetlink allowed accepting invalid values for TCP protocol attributes, potentially causing undefined behavior when used as shift counts. The fix replaces manual range and mask validations with netlink policy annotations, rejecting invalid values early.

In the Linux kernel, in irdma_create_qp, if ib_copy_to_udata fails, irdma_destroy_qp is called and waits on the not-yet-initialized free_qp completion. The fix initializes the completion before the ib_copy_to_udata call.

In the Linux kernel, the SQ/RQ/SRQ depth calculation functions in the irdma RDMA driver can receive U32_MAX, causing integer overflow and truncation of depth while returning success instead of failure. The fix performs calculations and boundary checks in u64.