CVE Vulnerability Catalog

In the Linux kernel, the drm/virtio (virtio-gpu) driver on Xen PV domains incorrectly decides whether to use the DMA API by looking only at the VIRTIO_F_ACCESS_PLATFORM feature bit. Because QEMU does not set iommu_platform on virtio-vga by default, virtio_gpu_object_shmem_init() describes the framebuffer's backing pages to the host using sg_phys() with guest-physical addresses, which in a PV domain resolve to pages belonging to another domain.

In the Linux kernel, the accel/qaic driver's resp_worker() skips the bounds checking present in decode_message(), which can lead to reading past the end of a slab allocation, infinite loops, or kernel panics. A malformed wire message sent from the device is required for these issues to occur.

In the Linux kernel, the nvme-rdma driver's queue_rq path on -EIO reports a host path error and then still cleans up the command and unmaps the SQE DMA. Because the path error helper completes the request, this results in double cleanup and DMA unmap after the request is already complete.

In the Linux kernel, the BPF subsystem's bpf_map_check_op_flags() compares the CPU ID against num_possible_cpus() instead of nr_cpu_ids and cpu_possible(). With sparse CPU IDs (e.g. mask 0,2-3), invalid CPU 1 is accepted while valid CPU 3 is rejected, leading to a kernel paging fault and panic.

In the Linux kernel, the accel/ethosu driver reads bits 15:14 of NPU_SET_{IFM,OFM}_PRECISION as an activation storage mode, but on U65 the same field holds the rounding mode. This causes valid U65 command streams to fail CMDSTREAM_BO_CREATE with -EINVAL and produces bogus feature map size calculations.

In the Linux kernel, ntfs_attr_find_in_attrdef() in the ntfs driver walks the in-memory $AttrDef table, but the loop condition bounds only the start of each entry, not the whole entry. A volume whose $AttrDef data size is smaller than one entry (e.g. 120 bytes) causes an out-of-bounds read when creating a file.

In the Linux kernel's SCTP_CMD_TIMER_START handling, a TOCTOU race exists: checking timer_pending() before timer_reduce() can allow the timer to expire and detach between these operations. Then timer_reduce() rearms the timer without taking the association reference, leading to an unbalanced reference count and use-after-free during association teardown. The fix uses the return value of timer_reduce() to determine whether the timer was actually armed.

A use-after-free vulnerability exists in the Linux kernel's vxlan_mdb_remote_src_del() function related to VXLAN MDB entry handling. The vxlan_mdb_is_valid_source() function accepts an all-zeros source address, allowing aliasing of (*, G) and (S, G) entry keys, which leads to freeing and then reusing the same memory entry.

A vulnerability was found in the Linux kernel's netfs subsystem related to readahead synchronization. The issue arises from the application thread adding folios to the rolling buffer while the collector thread processes them, potentially causing errors in determining folio order. The fix loads all folios selected by the VM upfront and drops references after I/O starts.

In the Linux kernel cachefiles subsystem, trace_cachefiles_coherency() is passed a pointer to a __be64 overlaid on variable-length coherency data (which may even be 0 bytes), potentially leading to a UAF or KASAN warning. The fix ensures the buffer has room for at least 8 pre-cleared bytes and extracts the data as four 2-byte words.

In the Linux kernel, a race condition exists in the ALSA subsystem between snd_pcm_mmap_data() and PCM buffer reallocation in snd_pcm_hw_params()/snd_pcm_hw_free(). Because mmap takes no lock, it can map pages of the old buffer that are subsequently freed back to the page allocator, leaving a stale, writable mapping of freed memory (a page-level use-after-free).

In the Linux kernel, ksmbd during logoff did not wait for all channels of an SMB3 multichannel session before freeing shared session objects. Added safe draining that wakes blocked byte-range locks, invokes cancellation callbacks for CANCEL requests, and serializes session teardown with channel registration.

In the Linux kernel, the ksmbd listener thread exits when its listening socket is shut down. The netdevice notifier shuts down the socket before calling kthread_stop(), so the task_struct can be freed before kthread_stop() gets its reference. The fix creates the listener in a stopped state and holds an extra task_struct reference until kthread_stop_put() completes.

In the Linux kernel, the Bluetooth btintel driver's btintel_parse_version_tlv() does not ensure the TLV value is long enough for the specific type, potentially causing an out-of-bounds read via get_unaligned_le16(), get_unaligned_le32(), or memcpy(). The fix rejects values shorter than the minimum required by each known TLV type and also rejects responses without the Command Complete Status field.

In the Linux kernel, the Bluetooth btintel driver treats the firmware ID as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf() can read beyond the received response. The fix limits the conversion to the advertised TLV value length.

In the Linux kernel, Bluetooth L2CAP's l2cap_le_connect_req() left the channel mode at the default, causing FLAG_DEFER_SETUP channels to reply to L2CAP_LE_CONN_REQ with L2CAP_ECRED_CONN_RSP, which is incorrect. This can lead to an out-of-bounds write in l2cap_ecred_rsp_defer(). The fix sets chan->mode correctly and adds a channel mode check with WARN_ON_ONCE instead of an OOB write.

In the Linux kernel, a problem in IPv6 Segment Routing where the network header was not properly restored before routing and forwarding was fixed. Previously, when the SRH did not immediately follow the IPv6 header, the network offset could be negative, potentially leading to buffer overflows during forwarding.

In the Linux kernel, the ASoC fsl_micfil driver's hw_params() and hw_free() enabled and disabled the mclk clock without balancing. The PCM core does not guarantee 1:1 pairing, so hw_free() can run without hw_params(), and hw_params() can be called multiple times, causing an "already disabled" warning or an enable reference leak.

In the Linux kernel's btrfs filesystem, there is a use-after-free vulnerability during RAID stripe insertion. If allocation of a RAID stripe extent fails, btrfs_insert_one_raid_extent() aborts and ends the transaction before returning -ENOMEM. The caller still owns the transaction handle and on error handling ends the transaction again, potentially leading to use-after-free.

The Linux kernel has an issue in __dev_change_net_namespace() where conflicting alternative names (altnames) of network devices are not removed when changing network namespaces. This leads to a warning in cfg80211_pernet_exit() when removing a non-root namespace if two devices share the same altname. The vulnerability occurs when a device in init_net has a conflicting altname with a device in the dying namespace.