CVE Vulnerability Catalog

In the Linux kernel, in enqueue_to_backlog(), there is a TOCTOU race related to the lockless netif_running() check. The check is moved inside the backlog lock, serializing it with the flush operation and preventing the use-after-free reported by syzbot.

A race condition was found in the Linux kernel's 9p/RDMA driver (trans_rdma.c) affecting the rdma->state field. The field is modified without req_lock in recv_done() and p9_cm_event_handler(), while rdma_request() uses the lock. This can lead to lost state transitions, corrupted connection state machine, and use-after-free of RDMA request objects during teardown.

In the Linux kernel, the NTFS3 filesystem has an issue with error handling during file rename. Instead of calling _ntfs_bad_inode() when rename fails, the driver uses WARN_ON, which does not prevent further operations on the inconsistent inode. The fix replaces WARN_ON with a call to _ntfs_bad_inode() to prevent further operations on the corrupted inode.

In the Linux kernel, a vulnerability was found in the xprtrdma subsystem related to improper lifecycle management of RPC requests. The issue was that a single reference counter (rl_kref) served two distinct lifetimes, which could lead to freeing a send buffer while the HCA might still be DMA-reading from it. The fix decouples these lifetimes by adding separate references for the RPC layer and the send side, ensuring the request returns to the free pool only after both owners have released it.

A vulnerability was found in the Linux kernel's NFS subsystem regarding protection of the file lock list. The issue involves improper use of flc_lock during iteration over the lock list, which may lead to use-after-free (UAF). The fix switches to using nfsi->rwsem for protection and moves the locks_lock_inode_wait call to avoid deadlocks.

In the Linux kernel's xprtrdma module, a vulnerability causes receive buffer leaks and Receive queue exhaustion. Improper decoding of short or malformed replies can misclassify frames as backchannel calls, leading to orphaned buffers and failure to repost receive slots.

In the Linux kernel's xfrm subsystem, a use-after-free vulnerability exists during async resumption. xfrm_rcv_cb may change skb->dev to a tunnel device without taking a reference, and subsequent resumption decrements the tunnel device's refcount, leading to use-after-free and refcount leak.

In the Linux kernel's xfrm module, there is a race during state cache insertion. The state validity check occurs before acquiring the global xfrm_state_lock, allowing a dead state to be inserted into the cache.

In the Linux kernel, the netfilter flowtable module has a vulnerability related to IP6IP6 tunnel handling. The function nf_flow_ip6_tunnel_proto() uses skb_header_pointer() instead of pskb_may_pull(), which may lead to incorrect packet processing. Additionally, the handling of extension headers was simplified, which may affect correctness.

In the Linux kernel, the netfilter/ipset module used test_bit() in lockless RCU readers in hash types, which is a relaxed atomic operation without memory barrier guarantees. It was replaced with test_bit_acquire() where the operation may run concurrently with add/del/gc.

In the Linux kernel, in ipv6: ioam, there is a type confusion of dst_entry. IOAM uses a dummy dst_entry (null_dst) to mark that the destination should not be changed, but this dst is stored in the IOAM lwt state and may be passed to dst_cache_set_ip6(), leading to invalid cast and potential invalid memory access.

In the Linux kernel, the ksmbd (SMB server) module has a use-after-free vulnerability in the conn->preauth_info structure during concurrent SMB2 NEGOTIATE requests. One thread can free the memory while another thread in the response send path still uses it, leading to a use-after-free read (confirmed by KASAN).

In the Linux kernel IPv4 FIB, when CONFIG_IP_MULTIPLE_TABLES is enabled but no rule is added, fib_lookup() performs route lookup directly on two tables. Since the first lookup does not properly bail out, the result of an error route in the merged local/main table could be overwritten by another route in the default table. The fix corrects this inconsistent behavior so that the error route is respected.

In the Linux kernel netfilter flowtable, the function nf_flow_ip4_tunnel_proto() does not validate the iph->ihl field before using it to compute the header size, which can lead to out-of-bounds access with malformed IP headers. The fix adds a sanity check for the ihl field and uses iph->protocol instead of the hardcoded IPPROTO_IPIP constant when setting ctx->tun.proto, and references ctx->tun.hdr_size when updating ctx->offset.

In the Linux kernel, on s390/mm there is an issue with the _PAGE_UNUSED bit. This bit is not cleared in some pte-setting paths, which may lead to guest memory corruption.

In the Linux kernel, in the geneve subsystem, a vulnerability was fixed where geneve_gro_complete() did not check the gs->gro_hint flag, allowing an attacker to supply a crafted packet with a hint option, leading to an out-of-bounds read (KASAN: slab-out-of-bounds). The fix involves honoring the gs->gro_hint flag in the complete path as well.

In the Linux kernel, in the geneve subsystem, a vulnerability was fixed where geneve_gro_complete() did not validate the inner network offset, which could lead to an out-of-bounds read. The fix adds a check that the computed offset does not exceed the recorded inner network header.

In the Linux kernel's enetc driver, the number of BDs needed for xdp_frame is not checked. The xdp_redirect_arr array has size ENETC_MAX_SKB_FRAGS, but the number of fragments in xdp_frame can be greater or equal, leading to an out-of-bounds array access.

In the Linux kernel's SCTP protocol, when cookie authentication is disabled, the INIT after cookie unpacking is not re-verified. This could allow processing of tampered data. Added INIT verification after unpacking and chunk type check in cookie.

In the Linux kernel's fbnic driver, fbnic_tx_lso() calls skb_cow_head() which may reallocate the skb including shared info. The pointer calculated before the call becomes stale, leading to a use-after-free.