CVE Vulnerability Catalog

The Linux kernel mishandles skb->queue_mapping when a packet is redirected between devices with different TX queue counts. The skip_txqueue flag set by skbedit was not confined to the current transmit, so a nested xmit could leave a stale mapping that causes taprio_enqueue() to index past its qdiscs[] array. A local user with CAP_NET_ADMIN in a network namespace can trigger the bug, producing a slab-out-of-bounds under KASAN.

In the Linux kernel, the mtk_eth_soc driver registers MAC netdevs before allocating the internal dummy netdev and shared NAPI. If an interface is brought up during that window (e.g., by netifd immediately after registration), the first-open path dereferences NULL (eth->dummy_dev or napi->dev), causing a warning in net/core/xdp.c and failing with -ENODEV. The fix allocates the dummy netdev and adds the NAPI before the register_netdev() loop and improves error unwinding.

In the Linux kernel, the sparx5 driver returns early from PTP initialization on base lan969x variants lacking the SPX5_FEATURE_PTP flag and when no "ptp" interrupt is described. Unbinding the driver then causes a NULL pointer dereference while cleaning up uninitialized tx_skbs queues.

In the Linux kernel, the IPVS module now filters certain connection flags received by the backup server in the SYNC protocol. The NO_CPORT+TEMPLATE combination and the ONE_PACKET flag are dropped, and IP_VS_CONN_F_BACKUP_MASK is also applied to flags from v0 protocol messages.

In the Linux kernel, bpf_ct_set_nat_info() does not validate the NAT manipulation type, so a wrong value is passed directly to nf_nat_setup_info(), triggering WARN_ON(). If panic_on_warn is not set, IPS_SRC_NAT_DONE is set without adding nat_bysource, and conntrack cleanup tries to unlink an uninitialized hlist node.

In the Linux kernel, the NF_FLOW_HW_PENDING bit was renamed to NF_FLOW_PENDING and used to inhibit the flowtable GC worker until pending hardware offload work completes. The reordering from commit d644b23afe1e was reverted to prevent a race between GC and the hardware offload handler.

In the Linux kernel, the mlx5e driver completes outstanding descriptors without a CQE during XSK TX queue teardown. If a descriptor requested a TX timestamp, the completion path passes a NULL CQE to mlx5e_xsk_fill_timestamp(), which dereferences it.

In the Linux kernel, a race condition exists between perf_event_exit_task() and perf_pending_task() during begin_new_exec(). When perf_event_exit_task() is called and the PF_EXITING flag is not set, perf_sigtrap() continues and triggers WARN_ON_ONCE(event->ctx->task != current).

In the Linux kernel BPF subsystem, a flaw exists in the RCU tasks trace memory freeing mechanism. Objects added to free_by_rcu_ttrace while an RCU grace period is in flight can remain there indefinitely because the call_rcu_ttrace_in_progress flag is cleared too early, and the number of such objects is unbounded.

In the Linux kernel futex subsystem, a use-after-free flaw exists related to private hash resizing. The __futex_pivot_hash() function sets mmph->batches before assigning mmph->hash, allowing futex_ref_drop() to move forward while a reader still holds a pointer to the old hash.

In the Linux kernel BPF subsystem, migration protection is missing in __rhtab_map_lookup_and_delete_batch(). The bpf_mem_cache_free_rcu() call uses this_cpu_ptr() without migration disabled, which under CONFIG_PREEMPT_RCU can trigger a "using smp_processor_id() in preemptible code" bug.

In the Linux kernel drm/amd/display driver, NULL checks are missing when dereferencing dc_sink in dm_dp_mst_is_port_support_mode() and get_conv_frl_bw(). The dc_sink pointer is cleared asynchronously on MST unplug, which can lead to a NULL dereference during a race with teardown.

In the Linux kernel drm/amd/display driver, dm_suspend() does not check whether dc_state_create_copy() returned NULL on allocation failure. As a result, dm_resume() dereferences a NULL cached_dc_state, crashing during GPU reset recovery.

In the Linux kernel drm/amdgpu/gfx6 driver, firmware requested in gfx_v6_0_init_microcode() is not released when the GFX block is torn down, leaking firmware resources (PFP, ME, CE, RLC).

In the Linux kernel drm/mediatek driver, an IS_ERR() check is missing for the ovl_adaptor platform device returned by platform_device_register_data(). An invalid pointer is stored in ddp_comp[].dev and passed further, potentially causing a kernel crash.

In the Linux kernel drm/mediatek driver, the OVL adaptor platform device created by platform_device_register_data() is not unregistered when a later initialization step fails or during normal driver removal, causing a device leak.

In the Linux kernel drm/mediatek driver, mtk_drm_bind() takes a reference on the disp-mutex device via of_find_device_by_node(), but in the non-mmsys-master path it returns early without dropping that reference. mtk_drm_unbind() only puts mutex_dev for the master.

In the Linux kernel drm/amdgpu driver, amdgpu_discovery_sysfs_ips() allocates ip_hw_instance and initializes its embedded kobject before calling kobject_add(). If kobject_add() fails, the return value is ignored, the reference is not dropped, and ip_hw_instance_release() is never called, leaking memory.

In the Linux kernel, acp_hw_init() in the drm/amdgpu driver registers ACP child devices via mfd_add_devices() before attaching them to the ACP power domain and initializing the hardware. If attaching a child to the power domain fails, or if the ACP reset or clock enable times out, the failure path frees only the source cell, resource, and platform-data allocations, leaving the already-registered MFD child platform devices registered and never released.

In the Linux kernel binder, when a TF_UPDATE_TXN transaction supersedes a pending async transaction, binder_release_entire_buffer() is called with is_failure=false. Since the superseded transaction was never delivered, no fds were installed, and the BINDER_TYPE_FDA cleanup handler interprets stale buffer contents as installed fd numbers and passes them to binder_deferred_fd_close(), closing unrelated file descriptors.