CVE Vulnerability Catalog

In the Linux kernel, the ocfs2 filesystem's ocfs2_validate_xattr_block() checks the xattr block header but does not verify that a non-indexed block's xh_count and entry offsets fit inside the block. Indexed buckets likewise reach list/get consumers without an entry-bounds check, leading to use-after-free in ocfs2_xattr_list_entries().

In the Linux kernel, in sleepable BPF programs a spin lock can be the only RCU protection for a kptr. After the final bpf_spin_unlock() the verifier leaves the pointer valid, allowing another CPU to free the object before use, causing a use-after-free (e.g. in __bpf_get_task_stack()).

In the Linux kernel, the drm/omap DSI driver copied the ISR table to allow unregistering interrupt handlers. Since stack-allocated objects are passed to these ISRs, there is a use-after-free risk if IRQs are unregistered while being handled.

A vulnerability was found in the Linux kernel's BPF verifier. When handling load-acquire operations where source and destination registers are the same, the verifier does not properly check the pointer type, allowing access to unconverted kernel objects, potentially leading to data leaks or type confusion.

In the Linux kernel, the RDMA/erdma driver's EQ handlers look up CQs from dev->cq_xa and invoke callbacks outside the xarray lock. erdma_destroy_cq() can erase the CQ and free its queue buffer and doorbell record while a previously scheduled EQ handler is still using it, causing a use-after-free.

A use-after-free vulnerability exists in the Linux kernel RDMA/erdma driver. The AE QP fatal event and iWARP CM paths load QP pointers from dev->qp_xa and use them outside the xarray lock, so erdma_destroy_qp() can free QP resources while such a lookup is in flight. The fix adds erdma_qp_get_by_qpn() to acquire a kref under the xarray lock and removes the QP from the xarray before dropping the destroy-path reference.

In the Linux kernel, the ocfs2 (o2hb) subsystem has a use-after-free bug in the heartbeat region lifecycle. The region is published to the o2net handler table before its delayed works are initialized, and teardown does not fully drain in-flight o2net callbacks. This causes a race and use of freed memory (KASAN slab-use-after-free in __run_timers).

In the Linux kernel's IB/isert subsystem, a vulnerability exists where the final Login Response is sent before the session is registered. An initiator that issues a SCSI command immediately after receiving the response can cause it to be executed against a session with a NULL se_tpg pointer, leading to a NULL dereference and system crash.

In the Linux kernel, a vulnerability in IB/isert was resolved where full-feature receive buffers were posted before session registration. An initiator that did not wait for the final Login Response could cause a SCSI command to be executed against a session with a NULL se_tpg, leading to a kernel oops at target_submit. The fix moves buffer posting into isert_get_rx_pdu() and performs it before sending the response.

In the Linux kernel, the RDMA/siw module's siw_accept() looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP. The cleanup assumes the current call installed the association, but qp->cep can point to the CEP of an existing connection, leading to freeing the incoming CEP and a use-after-free.

In the Linux kernel, the kmod dups code uses RCU to ensure a kmod_dup_req instance is freed only after it is no longer referenced. However, parallel users in kmod_dup_request_exists_wait() do not enter an RCU read-side critical section, which can result in a use-after-free.

In the Linux kernel, the drm/amd/display driver's AMDGPU_DM_MAX_DISPLAY_INDEX constant is 31, suggesting a maximum of 32 connectors, but it is used like MAX_DISPLAY_COUNT. This causes an off-by-one relative to the DRM core, which supports a maximum of 32 connectors. The fix renames the constant and increases the HDCP per-connector array size to 32.

In the Linux kernel, the Renesas R-Car Gen2 PHY driver has a double of_node_put() in the error path during PHY creation. The for_each_child_of_node_scoped() macro automatically releases the node reference, and the explicit of_node_put() drops it twice. The fix removes the redundant call, letting the scoped cleanup handle it.

In the Linux kernel, the AMDGPU DRM driver for GFX6 lacks PFP (pre-fetch parser) usage on compute queues. On GFX6, compute queues use the same CP path as graphics but without draw command support. The fix adds PFP usage for register writes, pipeline sync, and after VM flush to prevent execution issues.

In the Linux kernel, the scsi: sd driver has incorrect error handling in sd_probe() when sd_large_pool_create() fails after a successful device_add(&sdkp->disk_dev). The out_free_index path calls kfree() on an already registered device and leaks the sysfs entry.

In the Linux kernel, in the btrfs filesystem on zoned disks, btree_csum_one_bio() zeroed the extent buffer's folios before submission, destroying the in-memory buffer while it might still be referenced, leading to extent tree corruption. The fix writes zeros from a shared zero page, leaving the buffer content untouched.

In the Linux kernel, in Bluetooth L2CAP, the hci_conn::l2cap_data field is accessed without locks in l2cap_disconn_ind, potentially leading to use-after-free if l2cap_conn is deleted concurrently. The fix uses proto_lock to guard l2cap_data.

In the Linux kernel, in Bluetooth hci_conn, the SCO setup context is allocated with a NULL destroy callback, leading to memory leaks when an entry is cancelled. Additionally, the context stores a bare hci_conn pointer, potentially leading to use-after-free. The fix holds the connection and releases it from a destroy callback.

In the Linux kernel, a vulnerability in AppArmor's verify_tags() function allows an integer overflow in the bounds check, enabling an out-of-bounds read when loading a crafted policy. The issue is reachable by an unprivileged user in a nested user namespace if unprivileged_userns_apparmor_policy=1 is enabled.

A locking issue exists in the Linux kernel's iommu/dma subsystem around the msi_page_list. When multiple devices assigned to a VM via the legacy VFIO type1 container share the same IOMMU domain (e.g. ARM SMMU with IOMMU_RESV_SW_MSI), concurrent calls to iommu_dma_get_msi_page() can corrupt that list. The fix restores the static msi_prepare_lock.