CVE Vulnerability Catalog

In the Linux kernel, XFS exchange-range operations incorrectly moved the reflink flag between files even though a file can still own shared blocks beyond i_disk_size. This caused in-place writes instead of CoW, corrupting the other file sharing those blocks. The fix stops moving the flags and sets them on both inodes, including for XFS_IOC_SWAPEXT.

A bug was fixed in the Linux kernel's XFS involving the XFS_IOC_EXCHANGE_RANGE operation with the TO_EOF flag. Incorrect swapping of file sizes at nonzero offsets caused a file to have shared blocks beyond EOF, and subsequently the reflink flag was incorrectly cleared, allowing a shared block to be overwritten.

In the Linux kernel drm/bridge subsystem, drm_bridge_add() removes a previously removed bridge from bridge_lingering_list without holding bridge_lock. Both bridge_list and bridge_lingering_list are protected by bridge_lock and concurrently modified by drm_bridge_remove() and __drm_bridge_free(), and walked by the debugfs 'bridges' file. Running the list_empty() test and list_del_init() outside the lock may corrupt either list.

In the Linux kernel cgroup/cpuset subsystem, is_in_v2_mode() may be called in a context where a new cgroup filesystem is being rebound with a stale cpuset_cgrp_subsys.root pointer. To avoid a potential use-after-free, a new cpuset_v2_mode flag is set when the cpuset_v2_mode mount option is used and written only when cpuset_bind() runs with a stable cpuset_cgrp_subsys.root value. is_in_v2_mode() now reads this flag instead of accessing cpuset_cgrp_subsys.root directly.

In the Linux kernel GPIO exar driver, an initialization ordering bug exists: the allocated ID is stored in exar_gpio only after registering the devm_add_action_or_reset() cleanup action. If registration fails, the cleanup action releases ID 0 instead of the allocated ID, leaking the resource or freeing an ID belonging to another device.

In the Linux kernel drm/vc4 driver, vc4_bo_cache_destroy() purges cached BOs but never frees the size list, leaking memory on every unbind.

In the Linux kernel net/sched em_text, em_text_change() passes an algo array without an enforced NUL terminator to textsearch_prepare(). On the TS_AUTOLOAD retry, request_module() with %s reads past the array, disclosing kernel memory into the modprobe command line. Requires CAP_NET_ADMIN in the target network namespace.

A use-after-free vulnerability was fixed in the Linux kernel AMT driver. IGMP/MLD queries were queued through a qdisc, and a raw tunnel pointer stored in skb->cb could reference a freed tunnel, causing a use-after-free in amt_dev_xmit(). The fix sends the query directly from the receive path, bypassing the qdisc.

In the Linux kernel cxgb4/ch_ktls, the tid_list array is inserted via xa_insert_bh() with softirqs disabled, but chcr_ktls_dev_del() and the chcr_ktls_dev_add() error path use xa_erase() without disabling softirqs. A receive softirq can interrupt the erase and spin on the held lock.

In the Linux kernel bonding module, replacing an XDP program does not release the reference on the old BPF program, whether going to no-prog or replacing with another program, causing BPF program leaks.

In the Linux kernel, a bug was fixed in the ice driver where using writel_relaxed() for Tx doorbell updates did not provide proper write ordering on arm64. This introduced a race where the NIC could start transmitting before the dql->num_queued update was visible, triggering BUG_ON in dql_completed() and a kernel crash.

In the Linux kernel nvmet, nvmet_req_alloc_p2pmem_sgls() assigns req->p2p_dev only after both data and metadata SGL allocations succeed. If data allocation succeeds but metadata allocation fails, out_free_sg passes an unassigned req->p2p_dev to pci_p2pmem_free_sgl().

In the Linux kernel btrfs, btrfs_encoded_read_regular_fill_pages() may call btrfs_uring_read_extent_endio() and return the I/O status if all bios finish before it returns. A negative errno causes btrfs_uring_read_extent() and btrfs_uring_read_finished() to both unlock and free resources.

In the Linux kernel btrfs, after btrfs_uring_read_extent() the caller always jumps to out_acct, skipping kfree(data->iov). This is only correct for -EIOCBQUEUED where the deferred path owns the iov; on failure it causes a memory leak.

In the Linux kernel, btrfs_uring_read_extent() failed to release the inode and extent locks on a pages-array allocation failure, returning -ENOMEM without unlocking. This could lead to lock leaks.

In the Linux kernel, btrfs io_uring code left encoded data in the cmd PDU when returning -EAGAIN, causing a memory leak if the request was cancelled or the ring exited. The fix frees data on every exit path.

In the Linux kernel, a bug in btrfs occurs when replacing the value of an extended attribute (xattr) if multiple xattrs are packed into the same btrfs_dir_item. The new btrfs_dir_item is not fully initialized, leading to tree corruption detected by the tree checker during extent buffer writeback.

In the Linux kernel, the mt76 Wi-Fi driver incremented non_aql_packets on the link wcid where the frame was queued but decremented on the link reported in completion. For MLO peers this mismatch caused the counter to drift and block the station.

In the Linux kernel, the mt7915 driver did not disable rx napi before destroying it when removing the device, causing warnings and system instability on MT7916. The fix disables napi in mt7915_stop_hardware().

In the Linux kernel, the ASoC adau1372 driver used gpiod_set_value() for the powerdown GPIO, triggering a warning when the GPIO provider can sleep (e.g., I2C expanders). The fix uses the _cansleep variant.