CVE Vulnerability Catalog

In the Linux kernel, the ASoC (SDCA) subsystem's probe function mishandles pm_runtime errors. The lack of a common error path leaves the runtime PM reference unbalanced.

In the Linux kernel, the BPF subsystem's bpf_jit_blind_insn() can overflow the jump offset (off is s16) when rewriting jump instructions. Values -32767 and -32768 wrap, causing a jump past the end of the program and a kernel crash when bpf_jit_harden=2.

A use-after-free vulnerability exists in the Linux kernel NVMe driver related to the character device (cdev) lifetime. In multipath mode, when the NS head is torn down, already-open file descriptors remain active, allowing access to freed memory after the nvme_ns_head reference count drops to zero.

In the Linux kernel, the NVMe driver has a use-after-free in the command effects log for multipath heads. Sending an I/O passthrough command through a multipath namespace head after the controller path that created the head is removed triggers a KASAN slab-use-after-free read.

A use-after-free vulnerability exists in the Linux kernel BPF subsystem. bpf_ma_set_dtor() duplicates the map record but does not hold a reference to the map BTF, so the BTF can be freed when the program that loaded it exits while a worker still uses the duplicated record. This leads to a slab-use-after-free read in btf_is_kernel() and btf_find_struct_meta().

In the Linux kernel's MCTP subsystem (net/mctp), mctp_add_dev() links the new mctp_dev into dev->mctp_ptr before mdev->dev is assigned. A reader that picks up the device in that window dereferences a net_device pointer that is still NULL, causing a null-ptr-deref (detected by KASAN). The fix publishes the object only after it is fully initialised.

In the Linux kernel net/sched (cls_api), a resource leak occurs when two racing tc filter add requests on the same chain/prio both fail. The loser's error path drops only its own reference without reclaiming the empty proto, which stays linked in the chain and holds references to the chain, block, and classifier module. The fix reclaims the proto on the error path, gated on emptiness.

In the Linux kernel, the mac80211 subsystem's ieee80211_monitor_select_queue() validates skb length using skb->len, which includes non-linear fragments. When AF_PACKET sends a large packet, the 802.11 header may extend past the linear buffer, causing a slab-out-of-bounds read.

In the Linux kernel, hci_unregister_dev() disables cmd_work and cmd_timer and then calls hci_cmd_sync_clear(), which waits for the worker draining cmd_sync_work_list. With cmd_work disabled nothing reaches the controller, so each queued HCI command waits the full HCI_CMD_TIMEOUT (2s), and the backlog is unbounded. Closing /dev/vhci can block for backlog * 2s (over 5000 entries reproduced, i.e. hours of hang).

In the Linux kernel, bcm_sysport_get_stats() on SYSTEMPORT Lite skips unsupported statistics, with 'j' tracking the compacted index into the destination buffer while 'i' iterates all elements of bcm_sysport_gstrings_stats. Because the ethtool buffer is sized only by bcm_sysport_get_sset_count(), writing to data[i] instead of data[j] goes past the allocated array bounds, causing memory corruption.

In the Linux kernel, mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event() check for LAG masters (bonding and team) but only call bonding-specific APIs. When processing team device events, calling bond_slave_get_rcu() and bond_is_slave_inactive() on team_port structures causes KASAN to detect an out-of-bounds access since team_port is smaller than bond slave.

In the Linux kernel, the octeontx2-pf driver's BPID assignment under CONFIG_DCB assumed queue_to_pfc_map was always initialized. For SDP VFs this leads to an invalid memory access because the map was not initialized. The patch adds a NULL check for queue_to_pfc_map before dereferencing it.

A vulnerability was found in the Linux kernel's TIPC module involving AES-GCM nonce reuse. When a peer reports a change in its receive key, the nonce counter is reset even though the sender may still use the same TX key and salt, causing nonce reuse. This breaks confidentiality and exposes the GCM authentication key, making packet forgeries trivial.

In the Linux kernel with CONFIG_PAGE_POOL_STATS=y, page_pool_recycle_ring_bulk() updates recycle stats after dropping the producer lock. If it just recycled the last inflight netmems of a pool being destroyed, page_pool_release() can pass its producer-lock barrier and free the pool before recycle_stat_add() runs, causing a use-after-free.

In the Linux kernel, a bug in the stmmac network driver related to RX Scatter-Gather support was fixed. When a received frame was larger than dma_buf_sz, the DMA wrote the overflow to an unmapped secondary buffer address, triggering an SMMU translation fault on IOMMU-based platforms. The fix enables scatter-gather for non-SPH frames on GMAC4/XGMAC cores and corrects buffer length computation and FCS stripping.

A vulnerability was found in the Linux kernel's IPv6 segment routing (seg6) handling. The functions advance_nextseg() and seg6_next_csid_advance_arg() modify the SRH Segments Left field and the IPv6 destination address without first ensuring the packet data is writable. When the skb is cloned (e.g., by an AF_PACKET socket), the write occurs into data shared with the clone, potentially causing a read from that socket to return the modified packet instead of the received one.

A vulnerability in the Linux kernel's handling of the SO_RESERVE_MEM socket option has been fixed. The option was accepted on both TCP and UDP sockets even though the memory reservation mechanism is only supported by TCP, which could corrupt sk_forward_alloc and memcg accounting on UDP sockets. Additionally, the lack of an upper bound allowed values near INT_MAX to overflow 32-bit signed counters.

A use-after-free vulnerability exists in the Linux kernel's BPF trampoline mechanism. When a BPF program is detached from a trampoline, it may be freed while a task preempted in the trampoline just before calling the program can still invoke it, leading to access to freed memory. This affects preemptible kernels.

A vulnerability was fixed in the Linux kernel's BPF trampoline mechanism, where a detached BPF program could be freed while a task was still executing in it. This led to use-after-free and kernel oops on x86, manifesting as an int3 in poisoned bpf_prog_pack memory. The issue occurred when programs attached via trampolines were detached while their hooks were busy.

In the Linux kernel, the bcmgenet driver sets the Rx ring private data and index only when the interface is opened. Setting Rx coalescing parameters on an interface that was never opened (e.g. ethtool -C eth0 rx-usecs 50) dereferences a NULL pointer and causes a kernel oops with RTNL held, leaving networking stuck until reboot.