CVE Vulnerability Catalog

A vulnerability in the Linux kernel's vhost-net allows zerocopy ubufs to be completed multiple times. Cloning skbs by the network stack (e.g., batman-adv) increments the ubuf_info refcount, but vhost_zerocopy_complete() treats every callback as a completed descriptor, leading to use-after-free.

In the Linux kernel, the vdpa/octeon_ep driver's interrupt handler looks up the IRQ index in oct_hw->irqs instead of assuming irq - irqs[0]. The fix supports non-contiguous IRQ numbers and avoids incorrect ring indexing.

In the Linux kernel, the SCTP functions sctp_verify_asconf() and sctp_verify_param() do not validate that the embedded address parameter length fits within the outer parameter bounds. This can lead to out-of-bounds reads when processing malformed INIT or ASCONF packets.

In the Linux kernel Marvell OcteonTX crypto driver, the DMA cleanup path used the wrong loop index, leaking mapped entries and repeatedly unmapping the failed one.

In the Linux kernel Cavium CPT crypto driver, the DMA cleanup error path used the wrong loop index, leaking mapped entries and repeatedly unmapping the failed one.

A vulnerability in the Linux kernel's bnxt driver causes an underflow when building the skb head during XDP head-grow operations. This leads to corrupted page reference counts, potentially causing premature recycling and double-free of memory.

In the Linux kernel, the TCP subsystem clears sock_ops cb flags before force-closing a child socket. A child socket inherits the listener's bpf_sock_ops_cb_flags, and if its setup fails, it may be closed without holding the lock, leading to a warning in tcp_set_state(). The fix clears these flags at a common point to avoid BPF callbacks on an unestablished socket.

In the Linux kernel, the net/sched/sch_codel module has a vulnerability where qdisc_tree_reduce_backlog is called during peek before qlen is restored. This can lead to incorrect deactivation of the parent class, causing a system crash (e.g., wild memory access) when qfq is used with codel as a child.

In the Linux kernel, the tipc_l2_send_msg() function has a use-after-free (UAF) vulnerability. The issue arises because tipc_disable_l2_media() calls synchronize_net() while the media_ptr pointer is still valid, allowing concurrent RCU readers to obtain the device pointer after synchronization, and then the device can be freed while still in use.

In the Linux kernel, in the RDMA/bnxt_re driver, the function bnxt_qplib_alloc_dpi returns success even when ioremap fails. Proper rollback is added for ioremap failure and -ENOMEM status is returned.

In the Linux kernel, in the RDMA/bnxt_re driver, applications can request multiple WC pages for the same ucontext, but only one WC page per ucontext is currently supported. A lock is added to avoid concurrent access and a check to fail repeated requests. Also, if the mmap entry insert fails for the WC, the Doorbell page index mapped for the WC page is freed.

In the Linux kernel, in the RDMA/irdma driver, the waitqueue and request_done flag are replaced with a completion. The previous use of the flag without proper memory barriers could lead to concurrency issues. Using a completion solves this problem in a purpose-built way.

In the Linux kernel, in enqueue_to_backlog(), there is a TOCTOU race related to the lockless netif_running() check. The check is moved inside the backlog lock, serializing it with the flush operation and preventing the use-after-free reported by syzbot.

A race condition was found in the Linux kernel's 9p/RDMA driver (trans_rdma.c) affecting the rdma->state field. The field is modified without req_lock in recv_done() and p9_cm_event_handler(), while rdma_request() uses the lock. This can lead to lost state transitions, corrupted connection state machine, and use-after-free of RDMA request objects during teardown.

In the Linux kernel, the NTFS3 filesystem has an issue with error handling during file rename. Instead of calling _ntfs_bad_inode() when rename fails, the driver uses WARN_ON, which does not prevent further operations on the inconsistent inode. The fix replaces WARN_ON with a call to _ntfs_bad_inode() to prevent further operations on the corrupted inode.

In the Linux kernel, a vulnerability was found in the xprtrdma subsystem related to improper lifecycle management of RPC requests. The issue was that a single reference counter (rl_kref) served two distinct lifetimes, which could lead to freeing a send buffer while the HCA might still be DMA-reading from it. The fix decouples these lifetimes by adding separate references for the RPC layer and the send side, ensuring the request returns to the free pool only after both owners have released it.

A vulnerability was found in the Linux kernel's NFS subsystem regarding protection of the file lock list. The issue involves improper use of flc_lock during iteration over the lock list, which may lead to use-after-free (UAF). The fix switches to using nfsi->rwsem for protection and moves the locks_lock_inode_wait call to avoid deadlocks.

In the Linux kernel's xprtrdma module, a vulnerability causes receive buffer leaks and Receive queue exhaustion. Improper decoding of short or malformed replies can misclassify frames as backchannel calls, leading to orphaned buffers and failure to repost receive slots.

In the Linux kernel's xfrm subsystem, a use-after-free vulnerability exists during async resumption. xfrm_rcv_cb may change skb->dev to a tunnel device without taking a reference, and subsequent resumption decrements the tunnel device's refcount, leading to use-after-free and refcount leak.

In the Linux kernel's xfrm module, there is a race during state cache insertion. The state validity check occurs before acquiring the global xfrm_state_lock, allowing a dead state to be inserted into the cache.