CVE Vulnerability Catalog

In the Linux kernel, bpf_arena_free_pages() accepted arena addresses below the arena base, which after masking to the low 32 bits and reconstructing the user address led to freeing a range outside the arena mapping. The fix rejects such frees before computing the clipped range.

In the Linux kernel, the dmaengine dw-edma driver called vchan_cookie_complete() on a deferred STOP, scheduling a callback for the active descriptor and leaving other descriptors queued. A late callback after dmaengine_terminate_sync() could dereference freed client state, and leftover descriptors could restart into reused buffers. The fix moves all issued and submitted descriptors to the terminated list without scheduling callbacks.

In the Linux kernel, the ASoC meson driver's meson_card_reallocate_links() grows the DAI link and private data arrays with two consecutive krealloc() calls, updating owner pointers only after both succeed. If the first krealloc() moves the data and the second fails, card->dai_link points to an already freed block, leading to a use-after-free and double free.

In the Linux kernel, the RDMA hfi1 driver's set_txreq_header_ahg() ignores the return value of sdma_txinit_ahg(). When initialization fails, tx->txreq is not initialized, yet the caller continues processing the request as though it had succeeded.

HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, intended solely for data portability, to deploy and execute malicious code on the underlying application server host.

In the Linux kernel, the RDMA rxe driver's rxe_requester() does not validate num_sge/cur_sge for WQEs from a user queue. A local unprivileged user can post a WQE with an out-of-range cur_sge or oversized num_sge, forcing an out-of-bounds read of the per-WQE sge array in copy_data() (vmalloc OOB read).

In the Linux kernel, the ACPI processor module's IOAPIC hotplug lookup parses both MADT and _MAT records without full bounds validation. The MADT walk used a subtable's declared length to advance the cursor after only locating a generic header, and the _MAT path likewise passed a generic header to the IOAPIC helper.

In the Linux kernel on RISC-V with CONFIG_CFI_CLANG enabled, tailcalls in BPF cause kernel stack corruption. Due to double counting the kcfi instruction, the jump skips an extra 4 bytes and misses stack pointer adjustment. The fix removes this double inclusion.

In the Linux kernel, the RDMA/core subsystem has a potential use-after-free in ib_destroy_cq_user(). rdma_restrack_del() is invoked too late, leaving the CQ accessible through restrack while vendor-specific resources are already being freed.

In the Linux kernel, the RDMA/core subsystem has a potential use-after-free in ib_destroy_srq_user(). rdma_restrack_del() is invoked too late, leaving the SRQ accessible through restrack while vendor-specific resources are already being freed.

In the Linux kernel, the RDMA/core subsystem has a potential use-after-free in ib_free_cq(). rdma_restrack_del() is invoked too late, leaving the CQ accessible through restrack while vendor-specific resources are already being freed.

In the Linux kernel, the RDMA/core subsystem has a potential use-after-free in ib_dealloc_pd_user(). rdma_restrack_del() is invoked too late, leaving the PD accessible through restrack while vendor-specific resources are already being freed.

In the Linux kernel, the thermal intel int3400 driver's evaluate_odvp() creates per-ODVP sysfs files before the thermal zone and later probe resources are registered. The unwind path only calls cleanup_odvp() from the late sysfs failure path, so failures after evaluate_odvp(), including thermal_tripless_zone_device_register() failures, leave the ODVP files and storage behind. The fix moves ODVP cleanup to the common ART/TRT unwind path and clears cached ODVP pointers.

In the Linux kernel, the RDMA/erdma driver's erdma_destroy_qp(), erdma_destroy_cq(), erdma_dereg_mr(), and erdma_destroy_ah() return early when erdma_post_cmd_wait() fails, leaking queue buffers, MTTs, doorbells, and STAG, QPN, CQN, and AHN identifiers.

In the Linux kernel, a WARNING occurs in bpf_tracing_link_release because the verifier blindly sets 'tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX'. This corrupts the trampoline and causes failure to restore the prog's nop insn.

In the Linux kernel, set_user_buf_size() in the RDMA/mlx5 driver computes the QP buffer size by left-shifting user-supplied rq.wqe_cnt and rq.wqe_shift values as signed integers. A sufficiently large rq.wqe_cnt causes signed integer overflow, yielding a small or negative buf_size, causing ib_umem_get() to map a buffer smaller than the hardware will actually write into.

In the Linux kernel, the iommu/tegra241-cmdqv component has a synchronization flaw between the error interrupt handler (ISR) and VINTF initialization/deinitialization. Missing memory ordering and synchronization can lead to a NULL pointer dereference or use-after-free during a concurrent error. The vulnerability is fixed by using smp_store_release/smp_load_acquire barriers and synchronize_irq().

In the Linux kernel, the iommu/tegra241-cmdqv driver's __tegra241_cmdqv_probe() used devm_krealloc() to grow @smmu, which freed the original pointer upon relocation. A failure after that returned NULL, and the caller dereferenced the freed @smmu on its fallback path.

In the Linux kernel, the iommu/tegra241-cmdqv driver's tegra241_vintf_init_vsid() mapped a guest vSID to a single physical Stream ID from master->streams[0], only warning when the device did not have exactly one stream. A device with several streams had only its first mapped, and a device with none made master->streams a ZERO_SIZE_PTR, causing an out-of-bounds read.

In the Linux kernel, the RDMA/rxe module has a use-after-free (UAF) in the ODP init error-handling path. When rxe_odp_init_pages() fails, mr->umem is not reset to NULL, causing a later ib_umem_release() call to read already-freed fields.