CVE Vulnerability Catalog

In the Linux kernel accel/rocket driver, rocket_probe() stores the return value of rocket_device_init() in the file-scoped rdev pointer before checking whether it is an error pointer. On failure rdev remains an ERR_PTR, and a later probe can skip initialization and dereference the error pointer when reading rdev->num_cores.

In the Linux kernel drm/xe driver, xe_evict_flags() reads tbo->resource->mem_type, but a BO can reach eviction with no ttm.resource, e.g. an imported dma-buf whose resource was freed during teardown. This causes a NULL pointer dereference and a kernel fault.

In the Linux kernel drm/xe/oa driver, ttm_bo_type_kernel BOs are not guaranteed to be zeroed on allocation and may contain data from previously freed pages. Since the OA buffer is mmap'able by userspace, this can expose stale kernel memory contents.

In the Linux kernel's scsi: target subsystem, target_do_delayed_work() acquired delayed_cmd_lock with a plain spin_lock() without disabling interrupts, while all other acquisition sites use spin_lock_irqsave(). Since commands can now complete in interrupt context (complete_type=1 with direct_compl_supp), this can cause a deadlock when a completion arrives on the same CPU where the work item holds the lock.

In the Linux kernel, the scsi target iscsi subsystem has a race in discovery auth updates. Concurrent configfs opens can free the same value in iscsi_update_param_value(), causing a double-free.

In the Linux kernel, a race exists in sched_change_end() with __sched_setscheduler() for queued but non-running tasks. When a task's scheduling class changes (e.g., from SCHED_OTHER to SCHED_RR), rq->next_class is not updated and the need-resched indicator is not set, causing the CPU to idle despite a runnable task being present.

In the Linux kernel's ocfs2/dlm module, debug_state_print() traverses the recovery participant list without the correct synchronization. The list is protected by dlm_reco_state_lock rather than dlm->spinlock, so a concurrent dlm_destroy_recovery_area() can free records while debugfs is reading them, causing a use-after-free.

In the Linux kernel, pipe fasync handling has a bug in fasync_helper() when two enables of one O_RDWR FIFO race. The error path removes a pre-existing reader entry, leading to a use-after-free in send_sigio() triggerable by an unprivileged user under memory pressure.

In the Linux kernel, the libsas (SCSI) subsystem has a deadlock during HA resume. smp_execute_task_sg() calls pm_runtime_get_sync(), which waits for the ongoing resume, while the resume path is blocked in sas_drain_work() waiting for that same SMP command to complete — the deadlock requires an expander-attached SATA disk. The fix replaces the get_sync()/put_sync() pair with pm_runtime_get_noresume()/pm_runtime_put() and adds pm_runtime_resume_and_get() in the BSG path.

In the Linux kernel, a vulnerability was fixed in the netlink subsystem where the rhashtable key included a raw struct net pointer and a user-controlled port ID. By binding and rebinding chosen NETLINK_USERSOCK port IDs, an unprivileged reader could distinguish equal buckets and recover the low bits of the Jenkins hash, then search offline to recover the address of init_net. The fix uses the namespace's unique, non-address net_cookie in the comparison key.

In the Linux kernel, the hisi_femac network driver (net: hisilicon) assigns netdev_ops only after connecting the PHY. With CONFIG_NET_SHAPER enabled, phy_attach_direct() reads uninitialized netdev_ops, causing a kernel panic from a NULL pointer dereference.

In the Linux kernel, the hip04_eth network driver (net: hisilicon) calls of_phy_connect() before ndev->netdev_ops is assigned. With CONFIG_NET_SHAPER enabled, phy_attach_direct() reads uninitialized netdev_ops, causing a kernel panic from a NULL pointer dereference.

In the Linux kernel, the owl_emac network driver (net: ethernet: actions) calls owl_emac_phy_init(), which connects the PHY, before netdev->netdev_ops is assigned. With CONFIG_NET_SHAPER enabled, phy_attach_direct() reads uninitialized netdev_ops, causing a kernel panic from a NULL pointer dereference.

In the Linux kernel, the mv643xx_eth network driver connects the PHY before dev->netdev_ops is assigned. With CONFIG_NET_SHAPER enabled, phy_attach_direct() reads uninitialized netdev_ops, causing a kernel panic from a NULL pointer dereference.

In the Linux kernel, the au1000 network driver calls au1000_mii_probe() and attaches the PHY before dev->netdev_ops is assigned. Since netdev_need_ops_lock() was introduced, phy_attach_direct() reads dev->netdev_ops, causing a NULL pointer dereference and a crash during probe when CONFIG_NET_SHAPER is enabled.

In the Linux kernel, the ethoc driver calls ethoc_mdio_probe() and attaches the PHY before netdev->netdev_ops is assigned. Since netdev_need_ops_lock() was introduced, phy_attach_direct() reads netdev->netdev_ops, causing a NULL pointer dereference and a crash during probe when CONFIG_NET_SHAPER is enabled.

In the Linux kernel, the aeroflex greth driver calls greth_mdio_init() and attaches the PHY before dev->netdev_ops is assigned. Since netdev_need_ops_lock() was introduced, phy_attach_direct() reads dev->netdev_ops, causing a NULL pointer dereference and a crash during probe when CONFIG_NET_SHAPER is enabled.

In the Linux kernel, the ti icssm-prueth driver calls of_phy_get_and_connect() before ndev->netdev_ops is assigned. Since netdev_need_ops_lock() was introduced, phy_attach_direct() reads dev->netdev_ops, causing a NULL pointer dereference and a crash during probe when CONFIG_NET_SHAPER is enabled.

In the Linux kernel, the bcmgenet driver stores first_cb, last_cb and bytes_sent in the skb control block and reads them back on completion. Because ether_setup() leaves IFF_TX_SKB_SHARING set, the stack can resubmit a shared skb still in the ring, overwriting last_cb so earlier slots complete without crediting their bytes, stalling the BQL queue until the watchdog resets it.

A bug was fixed in the Linux kernel's calipso_skbuff_setattr() function, which incorrectly modified the IPv6 payload_len field for BIG TCP packets (larger than IPV6_MAXPLEN). This broke the fallback to skb->len in ipv6_payload_len(), affecting nf_tables, conntrack and sch_cake. The fix sets payload_len via ipv6_set_payload_len(), matching ipv6_gro_complete() behavior.