CVE Vulnerability Catalog

In the Linux kernel, addrconf_dad_failure() in IPv6 could overwrite DEAD state with ERRDAD, leading to use-after-free and system crash. The fix checks the state before transitioning to ERRDAD and performs operations in a single critical section.

In the Linux kernel, in the RDMA/srpt driver, the immediate data length check did not check for integer overflow, allowing a malicious initiator to bypass bounds check and pass ~4GB length to sg_init_one(). The fix uses check_add_overflow().

A vulnerability was found in the Linux kernel's nvme-multipath driver. The nvme_ns_head structure has a flexible array current_path[] indexed by NUMA node ID. Memory allocation used num_possible_nodes, which on systems with sparse NUMA IDs (e.g., POWER9) leads to out-of-bounds access (slab-out-of-bounds).

In the Linux kernel, the md/raid10 driver has been fixed to reset read_slot when reusing r10bio for discard. If the r10bio was previously used for a read, read_slot could be non-negative, causing the cleanup to skip bio_put() on repl_bio.

In the Linux kernel, a vulnerability in the NVMe driver has been fixed regarding an incorrect bounds check for the fdpcidx index in the FDP (Flexible Data Placement) mechanism. The bug used > instead of >=, incorrectly accepting an index equal to NUMFDPC + 1.

In the Linux kernel, a vulnerability in the OCFS2 filesystem was found due to missing validation of fast symlinks during inode read. A corrupted inode with a zero-cluster symlink can cause an out-of-bounds read beyond the inode block buffer, leading to a use-after-free error.

In the Linux kernel, a vulnerability in the RDMA/siw driver was fixed that caused a use-after-free when disassociating a socket from an endpoint. The issue occurred during processing of a malformed MPA request, potentially leading to closure of the new endpoint and access to freed memory.

In the Linux kernel, the lockd service's nlm4svc_lookup_file() function uses uninitialized bytes in file_hash() when the file handle length is less than LOCKD_FH_HASH_SIZE. This causes the same handle to hash to different buckets, leading to lookup failures. The fix zeroes only the tail bytes that file_hash() would otherwise consume.

A vulnerability in the Linux kernel's vhost-net allows zerocopy ubufs to be completed multiple times. Cloning skbs by the network stack (e.g., batman-adv) increments the ubuf_info refcount, but vhost_zerocopy_complete() treats every callback as a completed descriptor, leading to use-after-free.

In the Linux kernel, the vdpa/octeon_ep driver's interrupt handler looks up the IRQ index in oct_hw->irqs instead of assuming irq - irqs[0]. The fix supports non-contiguous IRQ numbers and avoids incorrect ring indexing.

In the Linux kernel, the SCTP functions sctp_verify_asconf() and sctp_verify_param() do not validate that the embedded address parameter length fits within the outer parameter bounds. This can lead to out-of-bounds reads when processing malformed INIT or ASCONF packets.

In the Linux kernel Marvell OcteonTX crypto driver, the DMA cleanup path used the wrong loop index, leaking mapped entries and repeatedly unmapping the failed one.

In the Linux kernel Cavium CPT crypto driver, the DMA cleanup error path used the wrong loop index, leaking mapped entries and repeatedly unmapping the failed one.

A vulnerability in the Linux kernel's bnxt driver causes an underflow when building the skb head during XDP head-grow operations. This leads to corrupted page reference counts, potentially causing premature recycling and double-free of memory.

In the Linux kernel, the TCP subsystem clears sock_ops cb flags before force-closing a child socket. A child socket inherits the listener's bpf_sock_ops_cb_flags, and if its setup fails, it may be closed without holding the lock, leading to a warning in tcp_set_state(). The fix clears these flags at a common point to avoid BPF callbacks on an unestablished socket.

In the Linux kernel, the net/sched/sch_codel module has a vulnerability where qdisc_tree_reduce_backlog is called during peek before qlen is restored. This can lead to incorrect deactivation of the parent class, causing a system crash (e.g., wild memory access) when qfq is used with codel as a child.

In the Linux kernel, the tipc_l2_send_msg() function has a use-after-free (UAF) vulnerability. The issue arises because tipc_disable_l2_media() calls synchronize_net() while the media_ptr pointer is still valid, allowing concurrent RCU readers to obtain the device pointer after synchronization, and then the device can be freed while still in use.

In the Linux kernel, in the RDMA/bnxt_re driver, the function bnxt_qplib_alloc_dpi returns success even when ioremap fails. Proper rollback is added for ioremap failure and -ENOMEM status is returned.

In the Linux kernel, in the RDMA/bnxt_re driver, applications can request multiple WC pages for the same ucontext, but only one WC page per ucontext is currently supported. A lock is added to avoid concurrent access and a check to fail repeated requests. Also, if the mmap entry insert fails for the WC, the Doorbell page index mapped for the WC page is freed.

In the Linux kernel, in the RDMA/irdma driver, the waitqueue and request_done flag are replaced with a completion. The previous use of the flag without proper memory barriers could lead to concurrency issues. Using a completion solves this problem in a purpose-built way.