CVE Vulnerability Catalog

In the Linux kernel, the aeroflex greth driver calls greth_mdio_init() and attaches the PHY before dev->netdev_ops is assigned. Since netdev_need_ops_lock() was introduced, phy_attach_direct() reads dev->netdev_ops, causing a NULL pointer dereference and a crash during probe when CONFIG_NET_SHAPER is enabled.

In the Linux kernel, the ti icssm-prueth driver calls of_phy_get_and_connect() before ndev->netdev_ops is assigned. Since netdev_need_ops_lock() was introduced, phy_attach_direct() reads dev->netdev_ops, causing a NULL pointer dereference and a crash during probe when CONFIG_NET_SHAPER is enabled.

In the Linux kernel, the bcmgenet driver stores first_cb, last_cb and bytes_sent in the skb control block and reads them back on completion. Because ether_setup() leaves IFF_TX_SKB_SHARING set, the stack can resubmit a shared skb still in the ring, overwriting last_cb so earlier slots complete without crediting their bytes, stalling the BQL queue until the watchdog resets it.

A bug was fixed in the Linux kernel's calipso_skbuff_setattr() function, which incorrectly modified the IPv6 payload_len field for BIG TCP packets (larger than IPV6_MAXPLEN). This broke the fallback to skb->len in ipv6_payload_len(), affecting nf_tables, conntrack and sch_cake. The fix sets payload_len via ipv6_set_payload_len(), matching ipv6_gro_complete() behavior.

In the Linux kernel, gpiod_set_array_value_complex() returns immediately after a failed gpiochip_set_multiple() call, bypassing the freeing of possibly allocated bitmaps. This causes a memory leak on an unlikely but possible error path.

In the Linux kernel, the mxc GPIO driver installs the chained IRQ handler (mxc_update_irq_chained_handler()) before the IRQ domain, generic IRQ chip and port list entry are set up. An interrupt in that window causes a NULL dereference or access to an incomplete list, and failures in later probe steps leave a dangling handler pointing at freed memory.

In the Linux kernel, since SGMII/RGMII/SMII interrupt handling was removed, the stmmac dwmac1000 driver no longer reads GMAC_RGSMIIIS, so the RGMII status stays pending behind GMAC_INT_MASK. During stmmac_resume() the MAC reset clears the mask and the pending status storms the interrupt line, causing a soft lockup, watchdog reset or hang.

In the Linux kernel, __perf_pmu_remove() removes group leaders while iterating with perf_event_groups_for_cpu_pmu(), and perf_remove_from_context() takes the leader out of the rbtree so rb_next() returns NULL and the walk ends prematurely. Remaining groups stay in the source context and are torn down only when the CPU dies, running despite the PMU's interrupts and events being migrated to a new CPU.

In the Linux kernel, get_seg_reg_override_idx() had its local result variable shadowed by the loop counter declared in for_each_insn_prefix(). As a result, FS and GS segment overrides are ignored, and a CS override causes an infinite loop in the kernel during UMIP emulation, allowing any user to tie up CPUs until reboot.

In the Linux kernel firewire subsystem, a race condition exists in split transaction handling. Both the response handler and the timeout callback may process the same transaction entry, leading to a use-after-free on the transaction initiator side.

In the Linux kernel accel/rocket driver, rocket_remove() decrements num_cores before searching for the core slot, so the last core is never found and removed. This leaves stale state and leads to an out-of-bounds write to rdev->cores when cores are rebound on RK3588.

In the Linux kernel accel/rocket driver, sched_to_core() searches only up to rdev->num_cores, which is decremented when a core is unbound. Unbinding a non-last core leaves later cores outside the search, so sched_to_core() returns NULL for a core that is still bound and running jobs. Neither rocket_job_run() nor rocket_job_timedout() checks the result, leading to NULL pointer dereference (KASAN: null-ptr-deref).

In the Linux kernel ASoC SOF component (ipc4-topology), a shift-out-of-bounds occurs for aggregated ALH capture. When ch_count is smaller than device_count, step = ch_count / device_count truncates to 0, and GENMASK(step - 1, 0) underflows, triggering a UBSAN shift-out-of-bounds error.

In the Linux kernel autofs subsystem, a flaw was fixed where a delayed write to a replaced notification pipe returned -EPIPE and re-entered catatonic mode. This closed the replacement pipe and released the new daemon generation's wait queues, causing lookups to fail with ENOENT. The fix ensures catatonic mode is entered only when the failed pipe is still the current pipe.

A use-after-free flaw in the Linux kernel Unicode handling was fixed. generic_ci_d_hash() and generic_ci_d_compare() read sb->s_encoding and dereference the Unicode map during RCU pathwalk, while ext4, f2fs and tmpfs drop the map via utf8_unload() in ->put_super() when the last mount reference goes away. A lookup still inside such a filesystem can then read freed memory.

A race condition exists in the Linux kernel between watch_queue_set_size() and post_one_notification(). An unprivileged user can trigger a NULL pointer dereference in post_one_notification(), leading to a kernel panic.

A race condition exists in the Linux kernel's handling of KVM asynchronous page-not-present (#PF) events. If an NMI interrupts #PF handling and itself takes a kernel-mode #PF, it reads and clears the flags belonging to the interrupted event, causing a kernel panic reporting a host-injected async #PF in an interrupt-disabled region.

In the Linux kernel KVM SEV module, sev_gmem_post_populate() calls set_page_dirty() without holding the required lock, which can race with the page's mapping going away. The fix replaces the call with set_page_dirty_lock().

A flaw was fixed in the Linux kernel KVM (nVMX) where failure to load L2 state in the non-VM-Entry case (RSM emulation or KVM_SET_NESTED_STATE) left the vCPU's MMU pointer pointing at the nested MMU. This caused KVM to try running L1 with a nested MMU, leading to a NULL pointer dereference when the nested state was freed and KVM attempted to get the L1=>L2 EPTP.

A race condition in the Linux kernel fsnotify connector teardown was fixed. A new mark could be inserted before the current one, causing the walk to miss the replacement and detach the entire connector from the object. This led to igrab(NULL) and a null-ptr-deref when an unprivileged user read fdinfo.