CVE Vulnerability Catalog

In the Linux kernel, the NTFS ntfs_non_resident_attr_shrink() function called runlist helpers requiring the runlist write lock without holding it while freeing clusters and truncating the runlist, creating a race. Additionally, ntfs_attr_map_cluster() could leave inconsistent state if a mapping update failed. The fix serializes these operations with the runlist lock and adds rollback handling.

In the Linux kernel virt_wifi driver, virt_wifi_newlink() transferred operstate before registering the network device. If registration failed (e.g. due to an invalid name), free_netdev() freed the object while it remained on lweventlist, causing a use-after-free in a later linkwatch_fire_event(). The fix moves the transfer after netdev_upper_dev_link().

In the Linux kernel DSA driver mxl862xx, there is an issue with stats polling during teardown. The poll may run on freed port memory, and a re-arm after cancellation can queue work after sync has completed.

In the Linux kernel, a potential socket lock inversion in the Bluetooth RFCOMM listener cleanup can lead to a deadlock.

In the Linux kernel, KVM for PowerPC (Book3S HV) has a use-after-free vulnerability in kvmhv_emulate_tlbie_all_lpid(). The function iterates nested-guest IDs without holding a reference, allowing a race with a concurrent vCPU that can free the memory. The fix increments the reference count before dropping the lock and releases it after the work.

In the Linux kernel, the powerpc/iommu module has an overflow validation bug in iommu_tce_check_ioba. The unified IOBA checking ignored the npages argument, using a constant value of 1, potentially allowing overflow when npages > 1. The fix accounts for npages, checks arithmetic overflow, and verifies the entire range does not exceed table capacity.

In the Linux kernel, the futex mechanism lacks private hash allocation on vfork(). Since accessing mm via vfork() is feasible, a private hash must be allocated for vfork() and other CLONE_VM users. The fix ensures the private hash is allocated before any private futex waiters exist.

A vulnerability in the Linux kernel's sock_gettstamp() function changes socket sk_flags without holding the socket lock. This leads to a race condition between bind() and SIOCGSTAMPNS_NEW ioctl, potentially causing a use-after-free on UDP sockets. The fix locks the socket only when SOCK_TIMESTAMP needs to be set, keeping the common case lockless.

In the Linux kernel's CIFS filesystem, the cifs_chan_skip_or_disable() function uses a server pointer after dropping the channel reference, leading to use-after-free. The fix signals the channel and primary server and captures the primary server pointer before dropping the channel reference.

A use-after-free vulnerability was found in the Linux kernel's POSIX timer cleanup mechanism during exec() by a non-leader thread. The bug occurs when operations after de_thread() (such as exec_mmap()) fail, leading to freeing a timer that is still queued, followed by a subsequent removal from the rbtree.

In the Linux kernel, a race condition in POSIX CPU timers can lead to use-after-free (UAF). The issue stems from losing the distinction between 'timer on expiry list' and 'delivery canceled' after changing the 'firing' flag to boolean. The fix checks whether the timer is on the expiry list instead of relying on the flag.

In the Linux kernel, in RDS IB code, rds_ib_cm_connect_complete() calls rds_conn_destroy() on protocol version mismatch, leading to a deadlock in workqueue. The fix changes it to rds_conn_drop(), which schedules connection shutdown asynchronously.

A use-after-free vulnerability exists in the Linux kernel signal handling mechanism, caused by a race condition during exec() by a non-leader thread. A SIGEV_THREAD_ID timer created against the leader's tid may point to the thread calling execve() after tid exchange, leading to incorrect signal queueing and use of freed memory. The issue is fixed by flushing task pending signals earlier in exit_signals() and preventing signal queueing for tasks with PF_EXITING set.

In the Linux kernel, in swiotlb code, swiotlb_bounce() uses an incorrect address for highmem page lookup, which can lead to read/write from the wrong memory page. The fix uses the adjusted orig_addr for both operations.

In the Linux kernel, in RDMA/ucma code, there is a race between multicast join and leave operations that can lead to use-after-free (UAF). The fix holds the mutex throughout from join to copy_to_user to prevent leave from missing the join.

In the Linux kernel, in RDMA/core code, iwpm_get_nlmsg_request() initializes the refcount after adding to the global list, which can lead to a refcount bug. The fix initializes kref before list_add_tail() and initializes all fields before adding to the list.

In the Linux kernel, in openvswitch code, ovs_ct_get_conn_labels() may add a labels extension to a confirmed conntrack entry, which can lead to reallocation and freeing of the extension block during concurrent access. The fix adds the extension only for unconfirmed conntracks.

In the Linux kernel dma-buf/dma-fence module, a previous fix changed the signaling check to an ops pointer check, causing loss of RCU protection after signaling for many dma_fence implementations, leading to use-after-free. The fix adds an additional signaling check alongside the ops pointer check.

In the Linux kernel IPv6 XFRM, xfrm6_local_rxpmtu() and xfrm6_local_error() assume skb->sk always points to a full IPv6 socket, but it can be a request_sock, leading to out-of-bounds reads. The fix uses skb_to_full_sk() and bails out when no full socket is attached.

In the Linux kernel lan743x driver, lan743x_rx_process_buffer() adds each non-first receive buffer to the head skb's frag_list, and lan743x_rx_trim_skb() then linearizes the head and frees the fragment skb metadata. The checksum-success path still writes ip_summed through the local skb pointer that points to the freed fragment, causing a use-after-free write when a packet spans more than one receive buffer.