CVE Vulnerability Catalog

In the Linux kernel, ext4_get_link() in RCU pathwalk mode reads data through sb->s_fs_info. ext4_put_super() frees the sbi and destroys extent status counters without waiting for a grace period, which can lead to a NULL dereference or use-after-free when the last mount reference disappears during a pathwalk.

A use-after-free vulnerability exists in the Linux kernel's eventfs mechanism. tracefs_d_revalidate() reads the ->is_freed field of an eventfs_inode during RCU pathwalk with only rcu_read_lock() held, while the object is freed after an SRCU grace period that does not wait for rcu_read_lock() sections. As a result, a walker can read already freed memory.

In the Linux kernel, create_ipc_ns() leaks resources: when mqueue/ipc sysctl setup or msg_init_ns() fails, the mqueue mount is dropped with a plain mntput() instead of kern_unmount(). Because the mount is long-term (MNT_NS_INTERNAL), the count drops to zero but the mount and mqueue superblock are never freed.

A use-after-free vulnerability exists in the Linux kernel's ntfs3 module. When the "nocase" mount option is used, dentry compare and hash functions access superblock private data in the RCU pathwalk, while ntfs_put_super() and ntfs3_kill_sb() free that data without an RCU delay. A lookup still inside the filesystem when the last mount reference is dropped causes a UAF.

The Linux kernel has a namespace mount handling flaw: copy_tree() omits mounts of mount namespace files (e.g. /proc/<pid>/ns/mnt) without checking MNT_LOCKED. This lets a task that is root in its own user namespace bypass a locked cover mount and expose a hidden file without a race and without touching the underlying filesystem. The fix makes such copying fail with EPERM and refuses to move a mount namespace file mount beneath a locked mount.

In the Linux kernel, FUT_OFF_MMSHARED futex handling mishandles MM reuse: a process can wait on a shared futex with a different MM because a FUT_OFF_INODE waiter can be requeued onto a FUT_OFF_MMSHARED futex by another process. This causes waiters on a freed MM to consume wakeups intended for a newly allocated MM at the same address.

In the Linux kernel, mshv_vtl checks the global mshv_has_reg_page flag before selecting the requested CPU's register page. With mixed setup results across CPUs, the check passes even for a CPU with no register page, leading to get_page(NULL) when userspace faults in that mapping.

In the Linux kernel, __tcf_action_put() (net/sched) has a use-after-free: the reference count is decremented before the binding count, so another thread can free the action between these operations, causing the binding-count update to access freed memory.

In the Linux kernel RDS handling (net: rds), an uninitialized trans pointer bug exists in rds_rdma_cm_event_handler_cmn(). The trans pointer is only assigned for InfiniBand CA devices; on other device types (e.g., iWARP RNIC) it remains uninitialized and is dereferenced in the event handler, causing a kernel crash (oops) when a connect request arrives.

A flaw was fixed in the Linux kernel SCTP handling when message interleaving is enabled. The first send waits for association establishment while dropping the socket lock, and handshake processing can reduce the output stream count and free the extensions of removed streams. The sender resumes with the stream checked before the wait, leading to a NULL pointer dereference and a kernel panic.

In the Linux kernel, the SPI imx driver allocates DMA bounce buffers that are too small (kzalloc(dma_len) instead of DMA_CACHE_ALIGNED_LEN(dma_len)), while the DMA API operates on memory beyond the allocation end. This causes slab corruption, leading to refcount_t warnings and kernel oops. The issue is fixed by allocating and syncing buffers with the correct aligned length.

In the Linux kernel, check_synth_field() incorrectly validated synthetic trace event fields of stacktrace type. An 8-byte signed scalar field could pass validation and then be dereferenced as a kernel stacktrace pointer, causing an invalid memory access.

The GPIO shared subsystem has a use-after-free bug when adding shared proxies. The device name (dev_id) references a kobject's name string that may be freed before the GPIO lookup table.

In the i2c viai2c-wmt driver, wmt_i2c_probe() acquires a clock via of_clk_get() but never releases the reference on error paths or module unload. This causes a clock resource leak.

In the ring-buffer, per_cpu/cpuN/buffer_meta files are created for every possible CPU, but the buffer is only allocated once the CPU comes online. Reading the file for a CPU that never came online dereferences a NULL cpu_buffer in rbm_start().

In the ring-buffer, rb_meta_subbuf_idx() can return a sub-buffer index one too high, leaving subbuf_ids[0] NULL which is dereferenced in __rb_map_vma() when userspace maps trace_pipe_raw. Incorrect indices are also written to metadata, causing the previous boot's trace to be rejected.

In the ring-buffer, ring_buffer_map_get_reader() treats a NULL result from rb_get_reader_page() as an error and emits a false warning when the mmap reader catches up with a writer still committing events. This state is normal and should not be reported as an error.

In the scsi bsg subsystem, bsg-lib allocates a 96-byte reply buffer while struct ufs_rpmb_reply is 104 bytes. When an Advanced RPMB command returns an EHS, ufshcd_advanced_rpmb_req_handler() writes 8 bytes past the end of the buffer.

In the Linux kernel, the scsi: st driver has a use-after-free race between st_remove() and st_open(). st_remove() removes the idr entry only after dropping the reference, so a concurrent st_open() can find the freed structure and call kref_get() on it.

In the Linux kernel, the xen/scsifront driver's scsifront_do_response() only bounds-checks rqid from above and does not verify the shadow[] slot is populated. A malicious or buggy backend can return a response with an in-range but not in-flight rqid, causing a NULL pointer dereference.