CVE Vulnerability Catalog

In the Linux kernel firewire subsystem, a race condition exists in split transaction handling. Both the response handler and the timeout callback may process the same transaction entry, leading to a use-after-free on the transaction initiator side.

A use-after-free flaw in the Linux kernel Unicode handling was fixed. generic_ci_d_hash() and generic_ci_d_compare() read sb->s_encoding and dereference the Unicode map during RCU pathwalk, while ext4, f2fs and tmpfs drop the map via utf8_unload() in ->put_super() when the last mount reference goes away. A lookup still inside such a filesystem can then read freed memory.

In the Linux kernel KVM SEV module, sev_gmem_post_populate() calls set_page_dirty() without holding the required lock, which can race with the page's mapping going away. The fix replaces the call with set_page_dirty_lock().

A use-after-free vulnerability exists in the Linux kernel's eventfs mechanism. tracefs_d_revalidate() reads the ->is_freed field of an eventfs_inode during RCU pathwalk with only rcu_read_lock() held, while the object is freed after an SRCU grace period that does not wait for rcu_read_lock() sections. As a result, a walker can read already freed memory.

The Linux kernel has a namespace mount handling flaw: copy_tree() omits mounts of mount namespace files (e.g. /proc/<pid>/ns/mnt) without checking MNT_LOCKED. This lets a task that is root in its own user namespace bypass a locked cover mount and expose a hidden file without a race and without touching the underlying filesystem. The fix makes such copying fail with EPERM and refuses to move a mount namespace file mount beneath a locked mount.

In the Linux kernel, __tcf_action_put() (net/sched) has a use-after-free: the reference count is decremented before the binding count, so another thread can free the action between these operations, causing the binding-count update to access freed memory.

In the Linux kernel, the SPI imx driver allocates DMA bounce buffers that are too small (kzalloc(dma_len) instead of DMA_CACHE_ALIGNED_LEN(dma_len)), while the DMA API operates on memory beyond the allocation end. This causes slab corruption, leading to refcount_t warnings and kernel oops. The issue is fixed by allocating and syncing buffers with the correct aligned length.

In the Linux kernel, check_synth_field() incorrectly validated synthetic trace event fields of stacktrace type. An 8-byte signed scalar field could pass validation and then be dereferenced as a kernel stacktrace pointer, causing an invalid memory access.

In the Linux kernel, the scsi: st driver has a use-after-free race between st_remove() and st_open(). st_remove() removes the idr entry only after dropping the reference, so a concurrent st_open() can find the freed structure and call kref_get() on it.

In the Linux kernel, libiscsi's __iscsi_complete_pdu() resolves a task from the ITT index in management responses (Logout, Login, Text, TMFunc, NOP-In) and only validates that the index is in bounds. A malicious or faulty target can name an unused pool slot where task->conn is NULL, causing a NULL pointer dereference and kernel oops after a single unsolicited NOP-In or Text Response.

In the Linux kernel's drm/amdgpu driver, amdgpu_gem_object_close() detaches the user queue eviction fence from the BO before checking bo_va->ref_count. Closing any handle of a BO removes the fence even when the file still has another handle and GPU mappings, allowing the BO to be evicted without suspending the user queues.

In the Linux kernel's tracing module, predicate_parse() adds two to nr_preds to reserve terminal TRUE and FALSE entries and uses that increased value as the limit for parsed predicates. If the initial count is smaller than the number actually parsed, the program can fill the allocation and subsequent accesses can go past its end.

In the Linux kernel's tracing module, predicate_parse() uses the first operator stack entry before processing any opening parentheses. A push increments top before writing, and the existing check still permits the write when top already points to the last allocated entry, potentially accessing beyond the operator stack.

In the Linux kernel dm-crypt, crypt_dec_pending reads io->error before atomic_dec_and_test, creating a race condition. As a result, a failed read or write may be incorrectly reported as successful.

In the Linux kernel XFS, the capability check uses has_capability_noaudit(), which tests real credentials instead of effective ones. This allows bypassing group quota limits by changing a file's gid to another group the user belongs to, e.g. via an NFS client.

In the Linux kernel, missing packet source validation for connected sockets in vsock/virtio was fixed. virtio_transport_recv_pkt() could select a non-listening socket via destination-only lookup without checking the source, allowing an unrelated source to transition the victim socket to TCP_ESTABLISHED and deliver RW packets.

In the Linux kernel, missing packet source validation for connected sockets in vsock/vmci was fixed. vmci_transport_recv_stream_cb() could select a non-listening socket via destination-only lookup without checking whether the packet came from its stored peer; a RST from another context could reset a TCP_SYN_SENT socket.

In the Linux kernel bridge multicast subsystem, the port group walk during teardown is truncated because hlist_del_init() clears the ->next pointer of a deleted node, terminating the iteration early. This leaves port groups in the bridge mdb with a dangling ->key.port after the port is freed, causing a slab-use-after-free detected by KASAN in __mdb_fill_info.

In the Linux kernel, the net/psp subsystem fixed an issue where the Rx association was inherited on socket clone. Because sk->psp_assoc sits past sk_dontcopy_end, sock_copy() copied it into every accepted socket without taking a reference, leading to a use-after-free in psp_twsk_assoc_free. The fix clears the association on clone.

In the Linux kernel, net/sched: cls_flower has a mask pointer validation flaw after nla_next(). fl_set_enc_opt() iterates the key's nested tunnel-option attributes while advancing a single mask pointer via nla_next() based on the number of key attributes rather than the mask's own attributes; the pointer produced by nla_next() is used in the next iteration without validation, leading to an out-of-bounds read (slab-out-of-bounds) in __nla_validate_parse called from fl_change().