CVE Vulnerability Catalog

A Linux kernel tracing vulnerability: incomplete event filter expressions (e.g., ending with a logical operator) left unresolved operator state, causing an out-of-bounds read (prog[-1]) or copying an out-of-bounds word into a branch target. This could be reached via PERF_EVENT_IOC_SET_FILTER on a self-targeted perf tracepoint counting event.

A use-after-free in the Linux kernel tracing/histograms subsystem: create_field_var_hist() saved a pointer to a compatible histogram (hist_data) rather than the one it created. Since find_compatible_hist() matches on keys alone, the user could remove that histogram while the target still pointed at it, leading to a use-after-free in event_hist_trigger_free().

In the Linux kernel tracing subsystem, a failed hist command that creates a field variable histogram leaves a registered trigger without a corresponding entry in field_var_hists[]. As a result, the trigger remains active and keeps counting even though the operation failed with -EINVAL, causing a resource leak and inconsistent state.

A use-after-free in the Linux kernel tracing/histograms subsystem: find_synth_event() compared only the event basename, so registering or removing a histogram on a non-synthetic event whose basename matched a synthetic event erroneously modified the synthetic event's refcount. This could free the synthetic event while an active histogram action still held a pointer to it.

In the Linux kernel, syscall_copy_user_array() was fixed to use copy_from_user() instead of __copy_from_user() when copying the buffer argument of faultable syscalls (write, pwrite64, etc.). Skipping access_ok() allowed a non-user address to be accepted.

In the Linux kernel's io_uring waitid implementation, a use-after-free occurs. io_waitid_wait() clears ->head before taking ownership of the request by incrementing ->refs, allowing another thread to complete and free the request while the wake-up handler still touches it.

In the Linux kernel, io_uring_cmd_del_cancelable() was fixed to not leave LIST_POISON in ->hash_node; it used hlist_del(). Requests are recycled without reinitialisation and not every user of ->hash_node sets it up before use, leading to a write through LIST_POISON2 and a general protection fault.

In the Linux kernel, a spin in io_cqring_wait_schedule() was fixed when IO_CHECK_CQ_OVERFLOW_BIT is set and the overflow list cannot be flushed. The task spins in the kernel and cannot be killed, e.g. with IORING_SETUP_CQE_MIXED or when the application moves the CQ head.

A bug was fixed in the Linux kernel's io_uring/io-wq where the signal ending work could be lost. When a thread exits, its io-wq is torn down and workers are signalled, but a worker that had not yet started the work could lose the signal. This caused the thread to hang in do_exit(), e.g. with IORING_OP_OPENAT of a FIFO without a writer and IOSQE_ASYNC.

In the Linux kernel, the io_uring/waitid mechanism has a reference counter bug where repeated failed cancellation attempts can wrap the 31-bit reference field to zero. A later cancellation can then claim ownership and complete the request a second time.

A use-after-free flaw was fixed in the Linux kernel's find_keyring_by_name() during named keyring lookup. The function read keyring->user->uid under keyring_name_lock, which does not protect the separate key_user object, so a concurrent KEYCTL_CHOWN could free the old key_user between the pointer load and the UID read. The fix uses the inline keyring->uid field instead of dereferencing the owner account.

A vulnerability exists in the Linux kernel's search_process_keyrings_rcu() function, which validates the authorization payload and saved credentials. Due to a race condition between a request-key helper's descendant and the requester, request_key_auth_revoke() can clear the payload pointer, leading to a NULL dereference and kernel oops.

A flaw was fixed in the Linux kernel's keyctl_describe_key(), where the key type's name could be freed by a module unload (e.g., AF_RXRPC) while the key description was being formatted. This led to a use-after-free and a page fault in string(). The fix holds key->sem across the kasprintf() call.

In the Linux kernel, keyring indexes contained kernel addresses (hashes of type and domain pointers), allowing an unprivileged user to predict key ordering and recover the kernel image address, defeating KASLR. The fix removes addresses from the entire index, replacing them with lazily allocated 64-bit IDs hashed with a SipHash key.

A use-after-free vulnerability exists in the Linux kernel key management subsystem. keyctl_read_key() checks key->type->read without holding key->sem, so a surviving RxRPC key can be read while the AF_RXRPC module is being unloaded, accessing freed module memory.

In the Linux kernel, trusted_tpm_unseal() proceeded to call pcrlock() after a TPM unseal failure; if pcrlock() succeeded, its return value overwrote the unseal error, causing key instantiation to succeed despite the failure.

In the Linux kernel, the PKCS#8 parser leaves the asym_key_ids slot empty, and key_or_keyring_common() unconditionally dereferences it when a PKCS#8 key is supplied to a key_or_keyring restriction. An unprivileged caller can trigger a NULL pointer dereference via KEYCTL_RESTRICT_KEYRING followed by add_key(), causing a kernel panic.

In the Linux kernel, print_rec() leaves 'modname' and 'offset' uninitialized, and kallsyms_lookup() only sets them on success. When the lookup fails (e.g., during module load or unload), 'modname' holds a garbage value, passes the 'if (modname)' check, and is dereferenced by seq_printf(), causing a general protection fault.

In the Linux kernel, coredump_finish() releases parked threads without holding a reference on the task and outside of RCU. If the coredump client is preempted between the store and wake_up_process(), the thread can be freed and try_to_wake_up() accesses freed memory.

CVE-2026-99217 has been rejected or withdrawn by its CVE Numbering Authority. It does not describe a confirmed vulnerability.