CVE Vulnerability Catalog

In the Linux kernel, a bug was fixed in flow_dissector where computing key_control->thoff used min_t(u16, ...), truncating skb->len to 16 bits. For packets larger than 64 KB (e.g., GSO, BIG TCP), this caused a bogus small transport header offset even when dissection succeeded.

A vulnerability was fixed in the Linux kernel's __virtio_net_hdr_to_skb() function, which skipped flow dissection for GSO packets without the VIRTIO_NET_HDR_F_NEEDS_CSUM flag. This led to an out-of-bounds read in skb_gso_transport_seglen() for packets with malformed network headers or IP options/IPv6 extension headers.

In the Linux kernel, devlink_rel_nested_in_notify_work_schedule() took a reference on devlink_rel and queued work while ignoring schedule_delayed_work()'s return value. If the work was already pending, the extra reference was leaked along with the devlink_rel object.

In the Linux kernel, pfcp_session_recv() read the 8-byte SEID without ensuring it was in the linear area. A short PFCP packet with the S flag set, or one with the session header in a fragment, caused an out-of-bounds read of packet data.

In the Linux kernel RISC-V ptrace handling, register set buffers were not zero-initialized before copying data from userspace. A PTRACE_SETREGSET request with a short iov_len left uninitialized stack data that was then validated and copied into the target's state.

In the Linux kernel, bpf_flow_dissect() clamped offsets returned by the BPF program using clamp_t(u16, ..., hlen). When hlen exceeded 65535, the upper bound was truncated before comparison, potentially forcing nhoff and thoff to zero despite sane values returned by the program.

In the Linux kernel drm/imagination driver, pvr_vm_gpuva_remap() unnecessarily took a GEM reference for each split part (memory leak) and incorrectly linked the parts to the new object's vm_bo instead of the original, triggering a drm_gpuva_link() warning.

In the Linux kernel mlxsw spectrum_flower driver, mlxsw_sp_flower_tmplt_create() could acquire port range registers while parsing a template that were never released, because the local rulei struct never went through mlxsw_sp_acl_rulei_destroy().

A memory leak exists in the Linux kernel's vmci_transport_recv_dgram_cb() function during datagram socket closure. Packets are added to the socket's backlog, and after the receive queue is cleared, __release_sock() moves them back to the receive queue, causing a memory leak. The issue is fixed by adding receive queue cleanup in the socket destructor.

In the Linux kernel, the drm/vc4 driver has a race during runtime suspend. vc4_irq_disable() masks V3D interrupt sources and calls synchronize_irq(), but on the ARMCTRL interrupt controller (RPi 0-3) this does not fully quiesce the handler — an interrupt may run after the V3D power domain is off, where register reads return 0xdeadbeef. This can schedule vc4_overflow_mem_work() after it was cancelled. The fix disables the interrupt line across the PM transition and balances IRQ installation/request.

In the Linux kernel HID steam driver, a narrow window existed during teardown where callbacks could still be scheduled and then reference the freed steam struct (dangling pointer). The fix rearranges the teardown sequence and moves rumble and mode switch work cancellation into steam_unregister.

In the Linux kernel HID steam driver, the registration/unregistration flow was simplified, replacing the serial number assumption with a boolean flag. A bug was also fixed where a battery was not unregistered if later registration steps failed, leaving a power_supply object after the steam object was torn down.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No further vulnerability details are available.

In the Linux kernel, a race condition in sched_ext cid table publication was fixed. The cid tables were visible to cid kfuncs while being modified, allowing concurrent TRACING or SYSCALL programs to read uninitialized memory or torn topology updates.

In the Linux kernel, ext4 fails to disable large folios on encrypted inodes when the encrypt feature is enabled on a mounted filesystem, bypassing the mount-time check. Writing encrypted data then triggers a kernel NULL pointer dereference crash. This affects kernels between v6.19 and v7.2.

In the Linux kernel, the ASoC qcom lpass-cpu driver uses the DAI ID to index variant->dai_driver when configuring a DAI with LPAIF_I2SCTL_MODE_QUAD01. On platforms where DAI IDs are sparse (e.g., IPQ806x MI2S with ID 4), this writes beyond the table entry instead of updating the correct DAI.

In the Linux kernel, a possible deadlock reported by lockdep was fixed when kswapd shrinks the TTM page pool. The immediate cause was an unnecessary GFP_KERNEL allocation in a page table free path, performed while holding mmap_read_lock. The PMD page copy was removed, eliminating the allocation and resolving the locking issue.

In the Linux kernel Rust irq layer, RegistrationInner is passed as the IRQ cookie to request_irq before its fields are initialized. This can lead to reading uninitialized memory in the IRQ callback.

In the Linux kernel perf/core subsystem, perf_event_open() gates perf_allow_kernel() only on !attr.exclude_kernel. Users can still request kernel callchain collection with attr.exclude_callchain_kernel == 0 even when attr.exclude_kernel == 1, and this is not enforced.

In the Linux kernel ath11k Wi-Fi driver, ar->num_stations is not reset in ath11k_mac_op_start() during hardware restart. This prevents accepting new stations or mesh peers because the counter remains inflated.