CVE Vulnerability Catalog

In the Linux kernel perf/core subsystem, perf_event_open() gates perf_allow_kernel() only on !attr.exclude_kernel. Users can still request kernel callchain collection with attr.exclude_callchain_kernel == 0 even when attr.exclude_kernel == 1, and this is not enforced.

In the Linux kernel ath11k Wi-Fi driver, ar->num_stations is not reset in ath11k_mac_op_start() during hardware restart. This prevents accepting new stations or mesh peers because the counter remains inflated.

In the Linux kernel, struct rtc_wkalrm has padding holes after the 'pending' member. When returned to userspace via the RTC_WKALRM_RD ioctl, uninitialized kernel stack data may be leaked.

A vulnerability was fixed in the Linux kernel's seg6_make_flowlabel() (IPv6 Segment Routing), which called skb_get_hash() without the required net pointer. When a packet had neither skb->dev nor skb->sk set (e.g., a TIPC UDP bearer discovery message using seg6 encapsulation with net.ipv6.seg6_flowlabel enabled), a warning and failure occurred in __skb_flow_dissect(). The fix uses skb_get_hash_net() with the already available net pointer.

In the Linux kernel, a fix addresses an AMD platform issue triggered by holding a USB3 hub PM runtime reference for 200ms during resume. The hold time for USB3 root hubs is reduced to 120ms, while external hubs keep the 200ms hold.

In the Linux kernel, a use-after-free in the EDAC/altera driver's error paths was fixed. The dci structure was freed before releasing the devres group, allowing an IRQ to dereference freed memory.

In the Linux kernel, a NULL pointer dereference in the MTD/spinand subsystem was fixed. When 'nand-no-ecc-engine' is set in DT, nand->ecc.engine remains NULL, but SPI-NAND code dereferenced it unconditionally, causing an oops during probe.

In the Linux kernel, KVM on s390 fixed IRQ injection with SIGP Stop and Store Status. Storing status to userspace could fault while holding a spinlock, which is problematic.

In the Linux kernel, the MACsec driver fixed initialization ordering: SecY was initialized after netdevice registration, causing warnings and reporting uninitialized attributes (including SCI) in notifications. The fix initializes SecY and link attributes before registration.

In the Linux kernel, KVM on arm64 fixed an inconsistency between KVM_ARCH_FLAG_GUEST_HAS_SVE and KVM_ARM_VCPU_SVE. A host setting the flag without the bit caused a vCPU with NULL sve_state, leading to issues during world switch.

In the Linux kernel, KVM on arm64 (nv) fixed the life cycle of the nested_mmus array. The array holding shadow page tables could be relocated during VCPU_INIT while another vCPU was running, leaving a dangling pointer to freed memory.

In the Linux kernel, the drm/amd/display driver fixed usage of stream->sink in DPMS sequences without NULL checks. Since stream->sink is optional, this could lead to NULL dereference; it was replaced with stream->link and assertions were added.

A bug was fixed in the Linux kernel's BPF sockmap mechanism where redirecting an skb back to the same socket (self-redirect with BPF_F_INGRESS) caused double-counting of copied_seq. This led to kernel warnings and incorrect recvmsg behavior. The fix converts the self-redirect verdict to __SK_PASS to avoid double advancement of copied_seq.

A Linux kernel issue causing hung tasks during filesystem unmount after disk removal has been fixed. evict_inodes() repeatedly rescanned the same inodes because it restarted the list walk after dropping the lock, keeping s_umount held for a long time and blocking concurrent unmounts. The fix keeps the current inode out of the disposal batch until the lock is reacquired and resumes the walk from it.

In the Linux kernel on arm64, ioremap_prot() did not reject mappings lacking the PTE_USER flag, causing a spurious WARN when accessing PROT_NONE or execute-only pages via /dev/mem and /proc/<pid>/cmdline. The fix makes such protection values fail cleanly without warning.

A bug was fixed in the Linux kernel emac driver that caused a kernel panic (NULL pointer dereference) during driver initialization on PowerPC 44x platforms. The issue occurred because of_phy_connect() was called before netdev_ops were set, leading to a netdev_need_ops_lock() check on an uninitialized pointer. The fix moves the initialization of netdev_ops, commac.ops, and ethtool_ops before emac_init_config().

In the overlayfs filesystem, ovl_do_mkdir() printed the input dentry with %pd after calling vfs_mkdir(), which may free or replace the dentry, leading to a use-after-free when CONFIG_OVERLAY_FS_DEBUG is enabled. The fix prints the dentry before the call and only the result afterward.

In the Linux kernel, a bug was fixed in the netfs subsystem where direct mempool allocation calls bypassed the alloc_hooks() wrapper, causing warnings about current->alloc_tag not being set during allocation and free when CONFIG_MEM_ALLOC_PROFILING_DEBUG is enabled. The issue occurred e.g. when reading files on a CIFS mount, and allocations were missing from /proc/allocinfo.

In the Linux kernel, a vulnerability was fixed in the drm/xe component's adjust_idledly() function, which failed to handle corner cases. When xe_gt_clock_init() fails to recognize the crystal clock, timestamp_base is 0, leading to a divide-by-zero and kernel panic. Additionally, u32 tick-to-ns conversions can overflow, and incorrect rounding can program a delay value greater than or equal to maxcnt, triggering warnings on every initialization.

In the Linux kernel, DAMON's damon_ptep_mkold() passed an unaligned sampling address to the young-flag clearing path. On arm64 this caused the contpte walk to overrun the block and write into the page following the page table, leading to kernel crashes or silent memory corruption.