CVE Vulnerability Catalog

In the Linux kernel, do_tcp_getsockopt() for TCP_CONGESTION suffers a use-after-free. The icsk_ca_ops pointer is read without holding rcu_read_lock(), and with BPF struct_ops it may point to memory freed concurrently via setsockopt(TCP_CONGESTION).

In the Linux kernel, do_tcp_getsockopt() for TCP_CC_INFO suffers a use-after-free. The icsk_ca_ops pointer and get_info function pointer are dereferenced without rcu_read_lock(), and with BPF struct_ops they may point to freed memory.

In the Linux kernel cifs subsystem, cifs_do_truncate updates i_size without a valid file handle. When find_writable_file() returns null, the inode size is set to 0 even though the server file is unchanged, causing inconsistency.

In the Linux kernel dm-crypt, crypt_dec_pending reads io->error before atomic_dec_and_test, creating a race condition. As a result, a failed read or write may be incorrectly reported as successful.

In the Linux kernel dm-integrity, integrity_metadata can enter an infinite loop on discard when the tag size exceeds HASH_MAX_DIGESTSIZE and kmalloc fails. In that case max_blocks is zero and bi_size is never decremented.

In the Linux kernel, the mac802154 subsystem had a data race and NULL pointer dereference on local->assoc_dev. The pointer shared between the association path and the association-response worker was not synchronized, which could lead to use-after-free or NULL dereference. The fix replaces the pointer with a cached address protected by a dedicated spinlock.

In the Linux kernel net/iucv, iucv_sock_recvmsg() sends the AF_IUCV_FLAG_WIN flag without testing the transport, causing a NULL dereference and spurious disconnect on classic z/VM sockets. Sending under spin_lock_bh also causes a race and double use of window credit.

In the Linux kernel XFS, xfs_sync_sb_buf() holds sb/rtsb buffer locks across a synchronous xfs_trans_commit(), causing a deadlock if shutdown occurs during CIL push. The fix removes xfs_trans_bhold() calls and re-acquires buffers after commit.

In the Linux kernel XFS, the capability check uses has_capability_noaudit(), which tests real credentials instead of effective ones. This allows bypassing group quota limits by changing a file's gid to another group the user belongs to, e.g. via an NFS client.

In the Linux kernel, a flaw was fixed in io_uring/cancel where io_uring_cancel_generic() refused to sleep while local work remained pending on a ring of the exiting task. For a ring created as disabled (IORING_SETUP_R_DISABLED) and later enabled by another task, the exiting task could spin in do_exit() and trigger WARN_ON_ONCE(), potentially panicking the kernel if panic_on_warn is set. The fix skips sleeping only when io_allowed_defer_tw_run() allows the task to run the work and drops the WARN_ON_ONCE().

In the Linux kernel, a flaw in SELinux BPF token permission checks was fixed. Multiple lookups of the bpffs creator SID using the token's file descriptor could lead to TOCTOU issues if the user changed the token file descriptor passed into the kernel.

The Linux kernel fixed a vulnerability in the SCTP inqueue parser (sctp_inq_pop) that accepted chunks with declared lengths shorter than the four-byte generic header. When ASCONF is covered by the association's SCTP-AUTH policy, a remote peer can repeatedly return the same malformed chunk and lock up the receive softirq (soft-lockup).

In the Linux kernel, page_pool_alloc_frag_netmem() does not align the requested fragment size on architectures without ARCH_DMA_MINALIGN (e.g., x86), causing frag_offset to advance by an odd, unaligned value. Subsequent users of the shared page pool receive misaligned buffers, and in the worst case an atomic_inc() in __skb_clone() straddles a cache line, triggering a kernel panic (Oops: Split lock detected) when split lock detection is enabled.

In the Linux kernel, a NULL dereference in the s390/ctcm driver's mpc_validate_xid() was fixed. When the peer XID is NULL or an r/w channel pairing mismatch occurs, grp->saved_xid2 is never initialized, and setting the flag leads to a NULL dereference.

In the Linux kernel, handling of multiple PMU stop callback invocations in s390/pai was fixed. The kernel throttles high sampling load, which can result in two back-to-back PMU->stop() calls; the fix checks the PERF_HES_STOPPED bit and prohibits the unsupported ioctl PERF_EVENT_IOC_PERIOD call.

In the Linux kernel, a leak of uninitialized kernel data in the s390/pci SCLP report was fixed. report_error_write() did not verify that the buffer was large enough for the report length claimed in report->length, so a short user buffer caused an out-of-bounds read and leaked up to about 4K of kernel data.

In the Linux kernel, missing packet source validation for connected sockets in vsock/virtio was fixed. virtio_transport_recv_pkt() could select a non-listening socket via destination-only lookup without checking the source, allowing an unrelated source to transition the victim socket to TCP_ESTABLISHED and deliver RW packets.

In the Linux kernel, missing packet source validation for connected sockets in vsock/vmci was fixed. vmci_transport_recv_stream_cb() could select a non-listening socket via destination-only lookup without checking whether the packet came from its stored peer; a RST from another context could reset a TCP_SYN_SENT socket.

In the Linux kernel, a divide-by-zero in fib_rebalance() was fixed. A concurrent change to ignore_routes_with_linkdown could make the first pass return a zero total weight while the second pass saw an eligible nexthop, resulting in division by zero.

A Linux kernel vulnerability was fixed in KVM (x86/mmu) where an unexpected SS bit in #NPF exit codes caused out-of-bounds accesses in permission_fault(), resulting in WARNs or UBSAN reports. The issue occurred when running Hyper-V from Windows 11 and was resolved by dropping unknown bits and preserving the SS bit when reflecting the fault to L1.