CVE Vulnerability Catalog

The Linux kernel has a namespace mount handling flaw: copy_tree() omits mounts of mount namespace files (e.g. /proc/<pid>/ns/mnt) without checking MNT_LOCKED. This lets a task that is root in its own user namespace bypass a locked cover mount and expose a hidden file without a race and without touching the underlying filesystem. The fix makes such copying fail with EPERM and refuses to move a mount namespace file mount beneath a locked mount.

In the Linux kernel, FUT_OFF_MMSHARED futex handling mishandles MM reuse: a process can wait on a shared futex with a different MM because a FUT_OFF_INODE waiter can be requeued onto a FUT_OFF_MMSHARED futex by another process. This causes waiters on a freed MM to consume wakeups intended for a newly allocated MM at the same address.

In the Linux kernel, mshv_vtl checks the global mshv_has_reg_page flag before selecting the requested CPU's register page. With mixed setup results across CPUs, the check passes even for a CPU with no register page, leading to get_page(NULL) when userspace faults in that mapping.

In the Linux kernel, __tcf_action_put() (net/sched) has a use-after-free: the reference count is decremented before the binding count, so another thread can free the action between these operations, causing the binding-count update to access freed memory.

In the Linux kernel RDS handling (net: rds), an uninitialized trans pointer bug exists in rds_rdma_cm_event_handler_cmn(). The trans pointer is only assigned for InfiniBand CA devices; on other device types (e.g., iWARP RNIC) it remains uninitialized and is dereferenced in the event handler, causing a kernel crash (oops) when a connect request arrives.

A flaw was fixed in the Linux kernel SCTP handling when message interleaving is enabled. The first send waits for association establishment while dropping the socket lock, and handshake processing can reduce the output stream count and free the extensions of removed streams. The sender resumes with the stream checked before the wait, leading to a NULL pointer dereference and a kernel panic.

In the Linux kernel, the SPI imx driver allocates DMA bounce buffers that are too small (kzalloc(dma_len) instead of DMA_CACHE_ALIGNED_LEN(dma_len)), while the DMA API operates on memory beyond the allocation end. This causes slab corruption, leading to refcount_t warnings and kernel oops. The issue is fixed by allocating and syncing buffers with the correct aligned length.

In the Linux kernel, check_synth_field() incorrectly validated synthetic trace event fields of stacktrace type. An 8-byte signed scalar field could pass validation and then be dereferenced as a kernel stacktrace pointer, causing an invalid memory access.

The GPIO shared subsystem has a use-after-free bug when adding shared proxies. The device name (dev_id) references a kobject's name string that may be freed before the GPIO lookup table.

In the i2c viai2c-wmt driver, wmt_i2c_probe() acquires a clock via of_clk_get() but never releases the reference on error paths or module unload. This causes a clock resource leak.

In the ring-buffer, per_cpu/cpuN/buffer_meta files are created for every possible CPU, but the buffer is only allocated once the CPU comes online. Reading the file for a CPU that never came online dereferences a NULL cpu_buffer in rbm_start().

In the ring-buffer, rb_meta_subbuf_idx() can return a sub-buffer index one too high, leaving subbuf_ids[0] NULL which is dereferenced in __rb_map_vma() when userspace maps trace_pipe_raw. Incorrect indices are also written to metadata, causing the previous boot's trace to be rejected.

In the ring-buffer, ring_buffer_map_get_reader() treats a NULL result from rb_get_reader_page() as an error and emits a false warning when the mmap reader catches up with a writer still committing events. This state is normal and should not be reported as an error.

In the scsi bsg subsystem, bsg-lib allocates a 96-byte reply buffer while struct ufs_rpmb_reply is 104 bytes. When an Advanced RPMB command returns an EHS, ufshcd_advanced_rpmb_req_handler() writes 8 bytes past the end of the buffer.

In the Linux kernel, the scsi: st driver has a use-after-free race between st_remove() and st_open(). st_remove() removes the idr entry only after dropping the reference, so a concurrent st_open() can find the freed structure and call kref_get() on it.

In the Linux kernel, the xen/scsifront driver's scsifront_do_response() only bounds-checks rqid from above and does not verify the shadow[] slot is populated. A malicious or buggy backend can return a response with an in-range but not in-flight rqid, causing a NULL pointer dereference.

In the Linux kernel, libiscsi only bounds-checks the task index from parse_pdu_itt from above, so a negative index passes and reads before session->cmds[]. The be2iscsi driver can supply such an index from an unsolicited NOP-In.

A vulnerability in the Linux kernel libiscsi module allows a remote iSCSI target to supply an arbitrary ITT value in a Reject PDU without validation. This can cause a NULL pointer dereference, a refcount underflow, or silent completion of an in-flight SCSI command as successful.

In the Linux kernel, libiscsi's __iscsi_complete_pdu() resolves a task from the ITT index in management responses (Logout, Login, Text, TMFunc, NOP-In) and only validates that the index is in bounds. A malicious or faulty target can name an unused pool slot where task->conn is NULL, causing a NULL pointer dereference and kernel oops after a single unsolicited NOP-In or Text Response.

In the Linux kernel, drm/amd/display functions allocate_usb4_bandwidth_for_stream() and allocate_usb4_bandwidth() use ASSERT(stream->sink) before dereferencing stream->sink->link. Since ASSERT is compiled out in production builds, a NULL stream->sink causes a NULL pointer dereference.