CVE Vulnerability Catalog

In the Linux kernel IPVS, ip_vs_lblcr_new() and ip_vs_lblc_new() created cache entries for every previously unseen destination address, while the table max_size only told the periodic collector to reclaim entries after the limit was exceeded. An attacker could keep using entries, causing unbounded memory growth. The fix rejects new entries once a table reaches max_size * 3 / 2.

In the Linux kernel kprobes on x86, an optkprobe at A replaces five bytes with a jump. If a disabled probe B is at A+2, get_optimized_kprobe() stops at B when arming a new probe C at A+4, leaving A optimized. The INT3 for C overwrites the last byte of A's jump displacement, so execution can jump to the wrong address. The fix skips disarmed and unprepared probes when checking optkprobe overlap.

In the Linux kernel, add_changeset_property() (of/overlay) links a new property of a not-yet-live target node into the node's deadprops list before calling of_changeset_add_property(). If that call fails, the error path frees the property but leaves the freed pointer linked in deadprops, causing a double free when the aborted overlay's node is released.

In the Linux kernel, of_overlay_fdt_apply() stores the idr_alloc() return value in ovcs->id before checking it. On allocation failure the stored id is negative, so free_overlay_changeset()'s "if (ovcs->id)" check passes, idr_remove() is called with a negative id, and list_del() runs on the not-yet-initialized ovcs->ovcs_list, dereferencing NULL.

In the Linux kernel, IP-in-IP GSO can re-enter inet_gso_segment() or ipv6_gso_segment() for each nested IP header. encap_level tracks header bytes, not callback depth, so a deep chain can exhaust the kernel stack. The fix counts IPv4 and IPv6 GSO handler entries in skb_gso_cb and limits them using IP_TUNNEL_RECURSION_LIMIT.

A bug in the Linux kernel's detection of IPv6 extension headers in tunneled packets has been fixed. The skb_gso_has_extension_hdr() function incorrectly handled GSO packets with skb->encapsulation set, leading to false positives and packet drops in IPv6 tunnels (ip6_gre, ip6_tunnel) and incorrect network header length calculation. The fix checks ipv6_ext_hdr() on both outer and inner IPv6 headers using skb_header_pointer() for safe reads.

In the Linux kernel, nft_flow_offload_init() bumps the flowtable use count with nft_use_inc() before calling nf_ct_netns_get(). When the latter fails, the error is returned as-is and the reference is leaked, and upper layers do not balance it either because nf_tables_newexpr() clears expr->ops when the expression init callback fails. Each failed rule addition therefore leaks one flowtable reference.

In the Linux kernel, tpacket_snd() drains every SEND_REQUEST frame in a TX ring and adds each valid packet length to the signed int len_sum. Because userspace can recycle completed frames concurrently, a single blocking send call is not bounded by the ring size, and after enough successful transmissions len_sum wraps into the negative range. sock_sendmsg_nosec() treats the result as an impossible return and triggers a BUG.

In the Linux kernel, pfcp_newlink() creates the UDP socket before registering the netdevice. If registration fails, the socket is released twice, leading to a NULL pointer dereference.

In the Linux kernel, the ac100 RTC driver assigns .num only after storing all clocks in .hws[], which with CONFIG_UBSAN_BOUNDS triggers an array-index-out-of-bounds report during probe.

In the Linux kernel, the spear RTC driver's devm_request_irq() enables the interrupt before device initialization completes, potentially running the handler on not fully initialized hardware.

In the Linux kernel, SCTP's sctp_wait_for_connect() drops the socket lock while sleeping, allowing an ABORT to be processed and the association unlinked. If a concurrent shutdown(fd, SHUT_RD) sets RCV_SHUTDOWN, the function returns without checking asoc->base.dead, leading to a dangling pointer.

A vulnerability was found in the Linux kernel where a null key name mismatch in the TPM subsystem did not disable the TPM chip. The tpm2_load_null() function returned success (rc = 0) despite an integrity check failure, so the chip continued serving commands and an uninitialized stack value could be used as the key handle. The fix sets rc to -ENODEV on mismatch, which disables the chip and returns the correct error code to the caller.

A bug was fixed in the Linux kernel's netfs layer related to extending a file via write. If data previously written through an mmap left stale data in the pagecache beyond the end of file (EOF), a regular extending write did not clear that stale data, potentially exposing incorrect content. The fix zeroes the tail of the folio straddling the EOF before an extending write, while handling concurrent writes and IOCB_NOWAIT safely.

In the Linux kernel, netfs's netfs_read_gaps() leaves gaps around a streaming write's dirty region unread, so a short/EOF response leaves stale folio content that later gets written back.

In the Linux kernel, codetag_load_module() does not set the error code on failure, so load_module() returns 0 after the module has been torn down. Additionally, for livepatch, mod->klp_info leaks on this error path.

The Linux kernel vmgenid driver registers its notification/IRQ handler before assigning driver_data, which the handler dereferences. If an interrupt or ACPI notification arrives in that window (e.g., when a VMM injects a generation-changed notification during snapshot restore in Firecracker), the handler dereferences a still-NULL pointer and panics the kernel. The fix assigns driver_data before registering the handlers.

In the Linux kernel, vc_screen's reload of the 'vc' pointer in vcs_write() is after the 'if (ret)' block, so the copy-failure break path exits without reloading vc. If vc was freed via vc_port_destruct during the unlocked copy_from_user() window, a use-after-free occurs.

In the Linux kernel, paste_selection() contains an unsigned underflow and slab-out-of-bounds read. When the line discipline buffer fills up, the function sleeps and drops the selection mutex, allowing a concurrent TIOCLINUX (TIOCL_SETSEL) ioctl to replace the buffer with a shorter selection. Upon resuming, vc_sel.buf_len - pasted underflows, causing an out-of-bounds read of up to 4094 bytes past the newly allocated buffer.

A slab-out-of-bounds read vulnerability exists in the Linux kernel's fb_pad_aligned_buffer function. It occurs when the font size of an invisible virtual console is changed and then the ESC # 8 (DEC alignment test) sequence is issued, which bypasses the con_should_update() check before updating the screen.