CVE Vulnerability Catalog

In the Linux kernel, the RDMA/core subsystem has a potential use-after-free in ib_dealloc_pd_user(). rdma_restrack_del() is invoked too late, leaving the PD accessible through restrack while vendor-specific resources are already being freed.

In the Linux kernel, the thermal intel int3400 driver's evaluate_odvp() creates per-ODVP sysfs files before the thermal zone and later probe resources are registered. The unwind path only calls cleanup_odvp() from the late sysfs failure path, so failures after evaluate_odvp(), including thermal_tripless_zone_device_register() failures, leave the ODVP files and storage behind. The fix moves ODVP cleanup to the common ART/TRT unwind path and clears cached ODVP pointers.

In the Linux kernel, the RDMA/erdma driver's erdma_destroy_qp(), erdma_destroy_cq(), erdma_dereg_mr(), and erdma_destroy_ah() return early when erdma_post_cmd_wait() fails, leaking queue buffers, MTTs, doorbells, and STAG, QPN, CQN, and AHN identifiers.

In the Linux kernel, a WARNING occurs in bpf_tracing_link_release because the verifier blindly sets 'tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX'. This corrupts the trampoline and causes failure to restore the prog's nop insn.

In the Linux kernel, set_user_buf_size() in the RDMA/mlx5 driver computes the QP buffer size by left-shifting user-supplied rq.wqe_cnt and rq.wqe_shift values as signed integers. A sufficiently large rq.wqe_cnt causes signed integer overflow, yielding a small or negative buf_size, causing ib_umem_get() to map a buffer smaller than the hardware will actually write into.

In the Linux kernel, the iommu/tegra241-cmdqv component has a synchronization flaw between the error interrupt handler (ISR) and VINTF initialization/deinitialization. Missing memory ordering and synchronization can lead to a NULL pointer dereference or use-after-free during a concurrent error. The vulnerability is fixed by using smp_store_release/smp_load_acquire barriers and synchronize_irq().

In the Linux kernel, the iommu/tegra241-cmdqv driver's __tegra241_cmdqv_probe() used devm_krealloc() to grow @smmu, which freed the original pointer upon relocation. A failure after that returned NULL, and the caller dereferenced the freed @smmu on its fallback path.

In the Linux kernel, the iommu/tegra241-cmdqv driver's tegra241_vintf_init_vsid() mapped a guest vSID to a single physical Stream ID from master->streams[0], only warning when the device did not have exactly one stream. A device with several streams had only its first mapped, and a device with none made master->streams a ZERO_SIZE_PTR, causing an out-of-bounds read.

In the Linux kernel, the RDMA/rxe module has a use-after-free (UAF) in the ODP init error-handling path. When rxe_odp_init_pages() fails, mr->umem is not reset to NULL, causing a later ib_umem_release() call to read already-freed fields.

In the Linux kernel, the nilfs2 filesystem has an out-of-bounds read when parsing the super-root block. The super-root inode metadata size is trusted before nilfs_read_inode_common() is called, allowing a malformed filesystem image to read past the super-root block.

In the Linux kernel, the ath12k Wi-Fi driver does not enforce a minimum length for the WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT structure, and the firmware-supplied num_vdevs field is used as a loop bound without validation. This can cause an out-of-bounds read. The fix adds a TLV policy entry and a helper to bound num_vdevs.

In the Linux kernel, the ath11k Wi-Fi driver does not enforce a minimum length for the WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT structure, and the firmware-supplied num_vdevs field is used as a loop bound without validation. This can cause an out-of-bounds read. The fix adds a TLV policy entry and a helper to bound num_vdevs.

In the Linux kernel, the last error path in rtl_pci_probe() skips cleanup functions due to a wrong goto label. Additionally, successful calls to rtl_init_rfkill(), ieee80211_register_hw(), and rtl_debug_add_one() are not reverted.

In the Linux kernel, mhi_register_controller() adds the controller device before creating the optional trigger_edl sysfs file. If sysfs_create_file() fails, the error path only drops the device reference and leaves the device registered.

In the Linux kernel, REQ_NOWAIT support in md personalities that can block internally is fundamentally incomplete. For writes, one mirror may succeed while another returns -EAGAIN, so md cannot distinguish queue pressure from a real device failure, potentially leaving mirrors with divergent data.

In the Linux kernel, ath12k_wmi_mac_phy_caps_parse() allocates the mac_phy_caps buffer as tot_phy_id * len, where len is clamped, but memcpy() advances the destination by the full struct size per slot. When firmware sends short TLVs, the second and later slots are written past the end of the allocation.

In the Linux kernel, ath11k_wmi_tlv_mac_phy_caps_parse() allocates the mac_phy_caps buffer as tot_phy_id * len, where len is clamped, but memcpy() advances the destination by the full struct size per slot. When firmware sends short TLVs, the second and later slots are written past the end of the allocation.

In the Linux kernel, bpf_link_show_fdinfo and bpf_link_get_info_by_fd access link->prog without holding any locks. If the prog is concurrently replaced via bpf_link_update, the old prog can be freed, leading to a potential use-after-free (UAF). The fix accesses link->prog under RCU protection.

In the Linux kernel, the iommu/dma non-blocking, non-coherent allocation path uses dma_alloc_from_pool(), which returns the allocated page and fills cpu_addr only on success. The code relies on cpu_addr to detect allocation failure, which is incorrect. The fix checks the returned page directly before using it for IOMMU mapping.

In the Linux kernel, swiotlb_alloc_tlb() can allocate from the DMA atomic pool when a decrypted pool is needed from atomic context. With CONFIG_DMA_DIRECT_REMAP, the atomic pool uses remapped virtual addresses that differ from direct-map addresses. swiotlb_init_io_tlb_pool() reconstructs the virtual address from the physical address, storing the wrong address in pool->vaddr for atomic-pool allocations, causing swiotlb_free_tlb() to fail.