CVE Vulnerability Catalog

In the Linux kernel mac80211 module, ieee80211_8023_xmit() does not set info->band from the channel context on non-MLD interfaces, leaving it at 0. This causes ieee80211_get_tx_rates() to use the wrong band for these frames.

In the Linux kernel mac80211 module, mesh_fast_tx_cache() stores raw mesh_path pointers. Path deletion flushes the cache and frees the path with kfree_rcu(), but a lookup already holding the path can insert a new cache entry after the flush, pointing at freed memory (use-after-free).

In the Linux kernel mac80211 module, fils_encrypt_assoc_req() accepts a (Re)Association Request frame whose last element is the FILS Session element, making crypt_len zero and calling aes_siv_encrypt() with empty plaintext. kmemdup() returns ZERO_SIZE_PTR, so the unconditional sg_init_one() puts an invalid page into the scatterlist, triggering a kernel BUG with CONFIG_DEBUG_SG.

In the Linux kernel USB serial subsystem, there is a race in dynamic id driver deregistration. Dynamic ids are freed before the driver is deregistered and the "new_id" attribute removed, which can leak an id added by a racing write.

In the Linux kernel USB serial subsystem, there is an incorrect driver deregistration order. When unloading a driver module, the USB driver must be deregistered before the USB serial bus drivers so that I/O is stopped before unbinding the ports, avoiding use-after-free in completion handlers.

In the Linux kernel USB serial subsystem, tty ioctls can race with hangup and call into a tty driver for a device that is already gone or powered down. The lack of serialization and checks can lead to a NULL-pointer dereference, especially if a device is disconnected during lengthy break signalling.

In the Linux kernel, a use-after-free vulnerability exists in the Thunderbolt subsystem during control channel request cancellation. When tb_cfg_request_work() completes just before tb_cfg_request_cancel(), the same work is requeued and accesses already freed memory. The fix ensures that a cancelled request is not handed out or scheduled, and the request is released in tb_cfg_request_cancel().

In the Linux kernel, the Thunderbolt driver's tb_stop() drops references to DP tunnels without deactivating them, so dprx_work can still run after the router is removed. This leads to operations on freed IDA structures and warnings such as "ida_free called for id=8 which is not allocated". It can be triggered by unbinding the driver while a DP tunnel is still waiting for the DPRX capabilities read to finish.

In the Linux kernel, the Thunderbolt driver's tb_tunnel_alloc_dp() takes an optional callback run from dprx_work after the DPRX capabilities read completes. Without that callback, a tunnel reference is leaked because it is never dropped. This affects tunnels from tb_tunnel_discover_dp(), which are activated when restoring from hibernation.

In the Linux kernel, the Thunderbolt driver's tb_stop() only tears down DMA tunnels, so a DP tunnel still waiting for dprx_work keeps that work queued while routers are removed and the control channel is stopped. The flush_workqueue() in tb_domain_remove() does not wait for its final run, and the callback runs against an already torn-down domain, blocking unbind until the timeout is reached.

In the Linux kernel, the Thunderbolt driver's tb_tunnel_one_dp() takes a domain reference that is only dropped once tb_dp_tunnel_active() has run on the work queue. If that work is cancelled, the reference is leaked, and since commit f5cc545f5969 this also blocks forever in the completion wait when unbinding the driver.

In the Linux kernel, the Thunderbolt driver's tb_dp_dprx_work() checks the ->dprx_canceled flag before taking tb->lock, so it can miss a tb_dp_dprx_stop() that could not cancel already running work. As a result, it polls DPRX capabilities and runs the callback for a tunnel that has already been torn down while the domain is suspending or going away.

In the Linux kernel Thunderbolt subsystem, a race between tb_remove_work() and tb_domain_remove() leads to a NULL pointer dereference of tb->root_switch inside tb_free_unplugged_xdomains(). The issue stems from incorrectly moving the tb_free_unplugged_xdomains() call outside the tb->lock section without checking whether tb->root_switch is NULL.

In the Linux kernel, the Thunderbolt driver's tb_xdp_properties_request() allocates room for 45 data dwords in its 252-byte response buffer, but the six-bit XDomain length field can be set to 63 by a malicious peer, which is treated as 48 data dwords. This causes a 12-byte heap out-of-bounds read from the res->data array.

In the Linux kernel, the SMB client's smb3_zero_range() removed the pagecache only for the range being zeroed, so when extending a file the folio straddling the old EOF — which may hold data dirtied past EOF through an mmap — was never dropped and became visible as file content once the file was extended.

In the Linux kernel, the SMB client's cifs_remap_file_range() discarded the pagecache only for folios overlapping the destination region, so when a clone extends the file the folio straddling the old EOF — which may hold data dirtied past EOF through an mmap — was never dropped and became visible as file content once the file was extended.

In the Linux kernel SMB client, the fallocate emulation for small interior ranges (mode 0 / FALLOC_FL_KEEP_SIZE) issued FSCTL_QUERY_ALLOCATED_RANGES without first flushing data. Contrary to Win32 documentation, this query is not coherent with recently written data, so the server could report a written range as unallocated and the emulation overwrote live data with zeroes. The issue affects Windows servers; Samba does not exhibit this behavior.

In the Linux kernel SMB client, smb3_zero_range() zeroed a range without first flushing dirty data when the range did not reach EOF. Dirty folios could be written back to the server after FSCTL_SET_ZERO_DATA, refilling the just-zeroed range with stale data.

In the Linux kernel SMB client, the server-side copy path (cifs_file_copychunk_range) and the clone (FICLONE) path of cifs_remap_file_range did not serialise the destination page cache the way other server-side range operations do. As a result, an asynchronous destination writeback could complete after the server-side copy/clone and reinstate stale data over the region just written, corrupting the file.

In the Linux kernel SMB client's cifsFileInfo structure, several flags (invalidHandle, swapfile, oplock_break_cancelled, offload, status_file_deleted) shared the same bitfield byte and were updated in different code paths under different locks. Byte-level read-modify-write operations could overwrite concurrent modifications of other flags.