CVE Vulnerability Catalog

In the Linux kernel, the drm/vc4 HDMI driver has an ordering issue with Packet RAM enabling. When audio is triggered by the HPD handler before video is restored, vc4_hdmi_write_infoframe() may attempt to store an infoframe while Packet RAM is disabled, causing a kernel warning (splat). The fix moves Packet RAM enable/disable into the Runtime PM hooks.

In the Linux kernel vsock subsystem, the TCP_ESTABLISHED to TCP_CLOSING transition on OP_RST can race with the connect loop. Resetting a socket still present in connected_table can lead to memory corruption, including a double list add and a kernel BUG.

In the Linux kernel net/rds module, rds_rdma_cm_event_handler_cmn() returns the result of rdma_resolve_route() directly to rdma_cm on RDMA_CM_EVENT_ADDR_RESOLVED. A synchronous failure causes the id ic->i_cm_id to be destroyed while RDS still owns it, leading to use of a freed id during connection shutdown.

In the Linux kernel netlink subsystem, socket filters can use SKF_NET_OFF and SKF_LL_OFF to read relative to an skb's network and MAC headers. Netlink producers may reserve headroom without resetting those headers, allowing a receiving socket's filter to read data before the initialized message and disclose memory contents.

In the Linux kernel accel/rocket driver, rocket_probe() stores the return value of rocket_device_init() in the file-scoped rdev pointer before checking whether it is an error pointer. On failure rdev remains an ERR_PTR, and a later probe can skip initialization and dereference the error pointer when reading rdev->num_cores.

In the Linux kernel drm/xe driver, xe_evict_flags() reads tbo->resource->mem_type, but a BO can reach eviction with no ttm.resource, e.g. an imported dma-buf whose resource was freed during teardown. This causes a NULL pointer dereference and a kernel fault.

In the Linux kernel drm/xe/oa driver, ttm_bo_type_kernel BOs are not guaranteed to be zeroed on allocation and may contain data from previously freed pages. Since the OA buffer is mmap'able by userspace, this can expose stale kernel memory contents.

In the Linux kernel's scsi: target subsystem, target_do_delayed_work() acquired delayed_cmd_lock with a plain spin_lock() without disabling interrupts, while all other acquisition sites use spin_lock_irqsave(). Since commands can now complete in interrupt context (complete_type=1 with direct_compl_supp), this can cause a deadlock when a completion arrives on the same CPU where the work item holds the lock.

In the Linux kernel, the scsi target iscsi subsystem has a race in discovery auth updates. Concurrent configfs opens can free the same value in iscsi_update_param_value(), causing a double-free.

In the Linux kernel, a race exists in sched_change_end() with __sched_setscheduler() for queued but non-running tasks. When a task's scheduling class changes (e.g., from SCHED_OTHER to SCHED_RR), rq->next_class is not updated and the need-resched indicator is not set, causing the CPU to idle despite a runnable task being present.

In the Linux kernel's ocfs2/dlm module, debug_state_print() traverses the recovery participant list without the correct synchronization. The list is protected by dlm_reco_state_lock rather than dlm->spinlock, so a concurrent dlm_destroy_recovery_area() can free records while debugfs is reading them, causing a use-after-free.

In the Linux kernel, pipe fasync handling has a bug in fasync_helper() when two enables of one O_RDWR FIFO race. The error path removes a pre-existing reader entry, leading to a use-after-free in send_sigio() triggerable by an unprivileged user under memory pressure.

In the Linux kernel, the libsas (SCSI) subsystem has a deadlock during HA resume. smp_execute_task_sg() calls pm_runtime_get_sync(), which waits for the ongoing resume, while the resume path is blocked in sas_drain_work() waiting for that same SMP command to complete — the deadlock requires an expander-attached SATA disk. The fix replaces the get_sync()/put_sync() pair with pm_runtime_get_noresume()/pm_runtime_put() and adds pm_runtime_resume_and_get() in the BSG path.

In the Linux kernel, a vulnerability was fixed in the netlink subsystem where the rhashtable key included a raw struct net pointer and a user-controlled port ID. By binding and rebinding chosen NETLINK_USERSOCK port IDs, an unprivileged reader could distinguish equal buckets and recover the low bits of the Jenkins hash, then search offline to recover the address of init_net. The fix uses the namespace's unique, non-address net_cookie in the comparison key.

In the Linux kernel, the hisi_femac network driver (net: hisilicon) assigns netdev_ops only after connecting the PHY. With CONFIG_NET_SHAPER enabled, phy_attach_direct() reads uninitialized netdev_ops, causing a kernel panic from a NULL pointer dereference.

In the Linux kernel, the hip04_eth network driver (net: hisilicon) calls of_phy_connect() before ndev->netdev_ops is assigned. With CONFIG_NET_SHAPER enabled, phy_attach_direct() reads uninitialized netdev_ops, causing a kernel panic from a NULL pointer dereference.

In the Linux kernel, the owl_emac network driver (net: ethernet: actions) calls owl_emac_phy_init(), which connects the PHY, before netdev->netdev_ops is assigned. With CONFIG_NET_SHAPER enabled, phy_attach_direct() reads uninitialized netdev_ops, causing a kernel panic from a NULL pointer dereference.

In the Linux kernel, the mv643xx_eth network driver connects the PHY before dev->netdev_ops is assigned. With CONFIG_NET_SHAPER enabled, phy_attach_direct() reads uninitialized netdev_ops, causing a kernel panic from a NULL pointer dereference.

In the Linux kernel, the au1000 network driver calls au1000_mii_probe() and attaches the PHY before dev->netdev_ops is assigned. Since netdev_need_ops_lock() was introduced, phy_attach_direct() reads dev->netdev_ops, causing a NULL pointer dereference and a crash during probe when CONFIG_NET_SHAPER is enabled.

In the Linux kernel, the ethoc driver calls ethoc_mdio_probe() and attaches the PHY before netdev->netdev_ops is assigned. Since netdev_need_ops_lock() was introduced, phy_attach_direct() reads netdev->netdev_ops, causing a NULL pointer dereference and a crash during probe when CONFIG_NET_SHAPER is enabled.