CVE Vulnerability Catalog

In the Linux kernel, the rust_binder module has a bug in node refcount update on thread exit. When a thread exits via BINDER_THREAD_EXIT, a pending node refcount increment could be dropped because Node::cancel() and NodeWrapper::cancel() were no-ops. This desynchronizes the node's delivery and count state, and userspace may not receive the notification, potentially causing the node to never be freed.

In the Linux kernel IPv4 subsystem, a null-ptr-deref occurs during PMTU update when a nexthop group shrinks. __ip_rt_update_pmtu() iterates over paths, and a concurrent nexthop replacement can cause fib_info_nhc() to return NULL, which is then dereferenced in update_or_create_fnhe(). This requires CAP_NET_ADMIN in the network namespace, but where unprivileged user namespaces are permitted, a local user can obtain it.

In the Linux kernel IPv4 subsystem, a null-ptr-deref occurs during FIB exception dump when a nexthop group shrinks. fib_dump_info_fnhe() uses fib_info_num_path() as the loop bound, then fib_info_nhc() independently reloads nh->nh_grp; if RTM_NEWNEXTHOP replaces the group with fewer paths, fib_info_nhc() returns NULL and the dump dereferences it. The fix stops the walk when the indexed path is absent.

In the Linux kernel IPv4 subsystem, a null-ptr-deref occurs during route notification sizing when a nexthop group shrinks. fib_nlmsg_size() checks fib_info_num_path() before each iteration, then fib_info_nhc() independently reloads nh->nh_grp; if RTM_NEWNEXTHOP replaces the group with fewer paths, fib_info_nhc() returns NULL and fib_nexthop_nlmsg_size() dereferences it. The fix stops sizing when the indexed path is absent.

In the Linux kernel IPv4 subsystem, a false warning about a route notification size race occurs. fib_alias_hw_flags_set() sizes the skb with fib_nlmsg_size() and later fills it with fib_dump_info() while holding only RCU; a concurrent replacement can grow the nexthop group, causing fib_dump_info() to legitimately return -EMSGSIZE. The fix removes the warning as it does not prove a sizing bug.

In the Linux kernel IPv6 subsystem, a false warning about a route notification size race occurs. fib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later fills it with rt6_fill_node(); a concurrent replacement can grow the nexthop group, causing rt6_fill_node() to legitimately return -EMSGSIZE. The fix removes the warning as it does not prove a sizing bug.

In the Linux kernel Input: ati_remote2 driver, a type confusion occurs in device attribute handlers. The channel_mask and mode_mask attributes were moved to usb_interface devices, but the show and store callbacks still invoked to_usb_device() on a struct usb_interface pointer, producing an invalid usb_device pointer. The fix uses to_usb_interface() directly in the attribute handlers.

In the Linux kernel ALSA: ctxfi driver, a memory leak occurs when clearing DAO input mappers. dao_clear_input() removes mapper entries from the list and sets their pointers to NULL without freeing the allocated array, leaking memory on each call. The fix stores the base pointer of the allocation and frees the array after removing entries from the list.

In the Linux kernel, scrub_print_warning_inode() in btrfs leaks a root reference when paths_from_inode() fails. The error path does not drop the reference taken by btrfs_get_fs_root(), leaking a reference every time path resolution fails while printing scrub warnings.

In the Linux kernel, init_can_skb() no longer initializes skb headers (mac_header remains 0xFFFF) after the skb_reset_*_header() calls were removed. When such an skb reaches packet_rcv_spkt() (SOCK_PACKET), the push length calculation overflows and triggers skb_under_panic, causing a full kernel panic.

In the Linux kernel, the cgroup/cpuset subsystem has a race during CPU offline: cpu_active_mask is updated before cpuset_handle_hotplug(), so guarantee_active_cpus() can dereference NULL for the top cpuset. The fix restores the NULL cs check.

In the Linux kernel, cipso_v4_skbuff_delattr() removes CIPSO bytes but does not adjust cached offsets for options that follow them (srr, rr, ts, router_alert). Consumers such as ip_forward_options() and __ip_options_echo() then access the wrong bytes, and the latter may interpret packet data as the option length and copy it into fixed-size option storage.

In the Linux kernel, get_result_buffer() sets data_start to sizeof(struct dm_ioctl) without checking the actual buffer size, so with the minimum buffer data_start ends up past the end. This causes a slab-out-of-bounds read in ctl_ioctl() and leaks seven bytes adjacent to the allocation.

In the Linux kernel, virtio_transport_read_skb() in vsock/virtio subtracts the full packet length from rx_bytes instead of only the unread bytes, underflowing the counter. This causes incorrect SIOCINQ reports (e.g. -40), wrong recv/poll behavior, and hiding of queued data.

In the Linux kernel, the brcmfmac driver has a race condition when removing a P2P device during driver detach. If the driver is removed while the userspace process that created the P2P device (e.g., wpa_supplicant) is still exiting, the P2P interface is removed twice, causing a kernel crash (oops).

In the Linux kernel, the mt76 Wi-Fi driver for mt7603 publishes a driver-private global station WCID without first calling mt76_wcid_init(). The first frame injected through a monitor interface reaches __skb_queue_tail() with an uninitialized sk_buff_head and dereferences a NULL prev pointer, causing an oops.

In the Linux kernel, the WireGuard noise subsystem has a race condition when two threads process the same response message, potentially reusing handshake state and creating a new session from stale state. The issue is considered very difficult to trigger in practice and was fixed by comparing the ephemeral private key with the peer's latest handshake state.

In the Linux kernel, is_chained_work() can be reached by a kworker that is not currently executing a work item, so worker->current_pwq is NULL and the chained-work test faults before emitting the intended warning. The fix guards the test with worker->current_pwq.

In the Linux kernel's xen/netfront driver, xennet_fill_frags() returns an error when a response chain has more slots than fit in the skb's frags. The error path in xennet_poll() moves what remains on tmpq to errq, but the skb being filled was already dequeued from tmpq and is never freed, leaking the skb and its attached pages.

In the Linux kernel, strparser did not guarantee that in-flight __strp_recv calls completed before the parser was torn down in strp_done(). A dummy lock_sock/release_sock pair was added to ensure completion of in-flight strp_recv calls, and state bits were switched to u8 to avoid races between strp_stop() and strp_pause/unpause().