CVE Vulnerability Catalog

In the Linux kernel TCP zerocopy receive path, can_map_frag() could dereference NULL when the next skb contained a net_iov fragment (DMABUF or IOURING). skb_frag_page() returns NULL for a net_iov, and can_map_frag() uses it in PageCompound(). The fix rejects all net_iov fragments before skb_frag_page().

In the Linux kernel, tipc_topsrv_stop() closed subscriber connections while the topology server's send and receive workqueues were still running. This caused races leading to refcount errors, a use-after-free in tipc_conn_close(), queue_work() on a destroyed workqueue, and an RCU stall in tipc_topsrv_exit_net(). The fix clears the flag under idr_lock, destroys workqueues before closing connections, and refuses tipc_conn_lookup() after the flag is cleared.

In the Linux kernel TIPC module, tipc_node_find_by_name() returned a node pointer after dropping the RCU read lock without taking a reference. The LINK_SET, LINK_GET and LINK_RESET_STATS handlers could then use a freed node, leading to a use-after-free (reported by KASAN).

In the Linux kernel, SELinux did not set SECURITY_LSM_NATIVE_LABELS in *set_kern_flags when an NFSv4 filesystem exported with security_label was mounted a second time, because the superblock was already SB_INITIALIZED and selinux_set_mnt_opts() exited early. As a result, nfs_get_root() cleared NFS_CAP_SECURITY_LABEL on the shared nfs_server, disabling per-file labeling for both mounts.

In the Linux kernel, __fsverity_get_info() uses rhashtable_lookup_fast() with rcu_read_lock(), which does not directly synchronize with fsverity_remove_info(). For different inodes, concurrent calls can cause a use-after-free because they rely on fsverity_info::rhash_head and fsverity_info::inode after freeing. The fix RCU-delays freeing of struct fsverity_info after removal from the rhashtable.

In the Linux kernel's gpio-mpsse driver, gpio_mpsse_irq_enable() armed the poll worker before adding it to priv->workers. If gpio_mpsse_disconnect() walked the list in that window, it missed the worker, and after mpsse_priv was freed the orphaned gpio_mpsse_poll() kept accessing it, causing a use-after-free. The fix publishes and arms the worker in one irq_spin critical section and adds a priv->dying flag.

In the Linux kernel's gpio-xilinx driver, xgpio_request() called pm_runtime_get_sync(), which leaves the usage counter incremented on failure. Since gpiolib does not call ->free() after a failed ->request(), xgpio_free() with the matching pm_runtime_put() never ran, leaking the reference and preventing the controller from runtime-suspending. The fix switches to pm_runtime_resume_and_get().

In the Linux kernel's gve driver, disabling XSK pools called the unlocked versions of napi_disable and napi_enable even though the netdev lock was already held before ndo_bpf. This caused a deadlock because the thread tried to re-acquire a lock it already held. The fix switches the NAPI calls to the locked versions.

In the Linux kernel, the gve driver leaks XSK buffers when stopping queues. GVE does not free XSK buffers attached to buf_state when resetting ring state, causing all buffers posted to the NIC to be leaked.

In the Linux kernel, the gve driver leaks an XSK buffer on an error descriptor. When the error bit is set in the RX completion descriptor, buf_state and its attached buffer should be freed, but in the AF_XDP ZC case the XSK buffer is not freed.

In the Linux kernel, the ibmveth driver fails to free the logical LAN on open failure after registration. When RX buffer pool allocation fails, the code skips h_free_logical_lan(), so PHYP still owns the buffer-list page when it is unmapped.

In the Linux kernel, the ice driver has a use-after-free in dynamic port cleanup. ice_dealloc_dynamic_port() frees the VSI before reading the index needed to erase the dynamic port from the xarray, resulting in a use-after-free.

In the Linux kernel, the ice driver mishandles metadata_dst refcount on representor teardown. ice_eswitch_release_repr() uses metadata_dst_free(), which frees memory without checking the dst_entry refcount, while queued packets still hold references.

In the Linux kernel, io_uring/net has a CONNECT filter bypass for 24-byte sockaddr_in6. io_connect_bpf_populate() fills filter fields only when addr_len >= 28 bytes, while IPv6 connect paths accept 24 bytes, so the filter sees zero port and address and can be bypassed.

In the Linux kernel, ip6_gre has a NULL dereference in the obsolete ERSPAN PMTU update. ip6erspan_tunnel_xmit() treats a metadata dst as a route, and since it has no output device, dst_dev(dst)->mtu dereferences NULL.

In the Linux kernel, the KEYS subsystem has an add_key() race with keyring restriction. __key_create_or_update() snapshots restrict_link before taking the semaphore, allowing a writer to observe no restriction, wait for installation, and link a key despite the restriction.

In the Linux kernel memstick subsystem, memstick_alloc_card() and memstick_set_rw_addr() used wait_for_completion_timeout(), which on timeout freed the memstick_dev structure while the host controller was still processing the request asynchronously. The later write into freed memory caused a KASAN slab-use-after-free write. The issue was fixed by replacing wait_for_completion_timeout() with unconditional wait_for_completion().

In the Linux kernel memstick rtsx_usb_ms module, a race during device removal can cause a request to be silently dropped, so nobody completes card->mrq_complete. With the memstick core waiting for request completion without a timeout, this hangs removal: memstick_check() never returns and memstick_remove_host() blocks in flush_workqueue(). The fix ensures requests are never dropped but completed with -ENOMEDIUM once eject is set.

In the Linux kernel, dm-crypt accepted an invalid configuration pairing an AEAD cipher with the lmk IV mode (e.g. "capi:gcm(aes)-lmk"). The lmk mode sets tfms_count to 64, but crypt_alloc_tfms_aead allocates only one transform, causing an out-of-bounds read of the tfms_aead array and a call to crypto_aead_setkey on invalid data, resulting in an oops when the table is loaded.

In the Linux kernel device-mapper (dm) subsystem, do_resume calls dm_table_get_mode(new_map) without holding locks, so a concurrent ioctl on the same device can cause a read of freed memory (use-after-free). The race was found by syzbot; the fix reads the new table's mode before dm_swap_table.