CVE Vulnerability Catalog

In the Linux kernel, the amd_sfh driver maps PCI BAR 2 and accesses MMIO registers at offsets up to 0x10958 without first validating that the BAR size is large enough. If the driver is bound to a device with a smaller BAR 2, this leads to an out-of-bounds memory access and a page fault during the probe function.

In the Linux kernel, KVM for RISC-V has an incorrect NACL hfence entry update order. __kvm_riscv_nacl_hfence() writes the Config word before the Page_Number and Page_Count words, violating SBI v3.0 specification requirements and potentially allowing a pending entry to be observed with stale pnum/pcount values, resulting in incorrect TLB flush ranges.

In the Linux kernel, KVM for arm64, pkvm_vcpu_init_sve() clamps only the upper bound of the host-provided sve_max_vl, so an invalid vector length reaches sve_state_size_from_vl() and triggers the WARN_ON() there, which is fatal at EL2. The existing !sve_state_size test rejects such a length, but only after the macro has run.

In the Linux kernel, pkvm_vcpu_init_sve() clears KVM_ARM_VCPU_SVE on failure but leaves KVM_ARCH_FLAG_GUEST_HAS_SVE set. Subsequent vCPUs on that VM then skip SVE setup and register with a NULL sve_state, causing a fault on the guest's first FP access.

In the Linux kernel's squashfs, a missing dictionary size range check allows a shift-out-of-bounds when mounting an abnormal image (COMP_OPTS flag set but dictionary size 0). The bug occurs in squashfs_xz_comp_opts() where the shift exponent is -1.

In the Linux kernel block subsystem, blk_revalidate_disk_zones() sizes the zones_cond array from disk capacity and zone size, but the index used by blk_revalidate_zone_cond() comes from the device-driven report_zones() walk and is never checked against the array size. A device reporting more zones than fit the array causes an out-of-bounds write in blk_zone_set_cond().

In the Linux kernel SCSI subsystem, sd_zbc_read_zones() computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nr_zones field of struct zoned_disk_info, silently truncating counts exceeding 32 bits. Additionally, sd_zbc_report_zones() counts zones with a signed int zone_idx, which overflows past INT_MAX.

In the Linux kernel Bluetooth btnxpuart driver, when CONFIG_DEV_COREDUMP=n, hci_devcd_append() returns -EOPNOTSUPP without freeing its skb argument, leaking the cloned skb and preventing nxp_set_ind_reset() from performing recovery.

In the Linux kernel Bluetooth mgmt subsystem, send_cancel() removes pending mesh_tx objects from hdev->mesh_pending and frees them via mesh_send_complete(), but if a mesh transmission was already queued via mesh_next(), the queued entry retains a raw pointer to mesh_tx. Later processing by hci_cmd_sync_work causes a use-after-free.

In the Linux kernel XDP socket subsystem, xsk_map_gen_lookup() loads a u32 key and compares it with max_entries using BPF_JMP_IMM. BPF immediates are sign-extended to 64 bits, so a max_entries value of 0x80000000 or higher becomes a threshold larger than every zero-extended 32-bit key, allowing an out-of-range index to skip the bounds check and read past xsk_map[].

In the Linux kernel Ethernet fbnic driver, the payload page pool pointer contains an error pointer when its allocation fails. The cleanup path passes that error pointer to page_pool_destroy() instead of destroying the header page pool, which can dereference the error pointer and leave the header page pool allocated.

In the Linux kernel, a bug in net/sched: cls_u32 was fixed regarding manual hash table handle IDR aliasing. A u32 hash table created with an explicit handle in the 0x800..0xFFF range keyed its IDR entry on the raw handle, while destroy paths freed it under handle2id(handle), causing a permanent IDR leak and allowing deletion of an unrelated live auto table's entry. Consequently, a later auto allocation could hand out a handle aliasing a live manual table, misrouting lookups and TCA_U32_LINK to the wrong table.

In the Linux kernel BPF verifier, after do_check() returns, instruction rewrite passes patch or remove one instruction at a time, making the work quadratic in program length. A privileged loader can submit 131072 unconditional jumps by zero, causing bpf_opt_remove_nops() to spend a long time, and since this work neither checks for signals nor reschedules, a pending SIGKILL cannot terminate the task.

In the Linux kernel, regsafe() in the BPF subsystem did not preserve the displacement between registers sharing the same packet pointer ID. Because packet range is shared by ID, a bounds check on one class member updates every member, which can license an out-of-bounds packet access on the pruned path.

In the Linux kernel, bpf_core_patch_insn() poisoned the CO-RE relocation target before checking whether the instruction was a valid relocation target. Malformed metadata could therefore replace jumps, calls, exits, register-source arithmetic, or non-immediate loads instead of failing at the relocation step.

In the Linux kernel netfilter flowtable, flow_offload_work_del() set NF_FLOW_HW_DEAD before the work handler cleared NF_FLOW_HW_PENDING. A concurrent garbage collection pass could free the flow via RCU before the worker finished, resulting in a use-after-free.

In the Linux kernel nfnetlink_queue module, the release notifier and the config netlink function were not serialized. A concurrent close() could call the release function while another thread processed an UNBIND request for the same portid, causing a general protection fault in __instance_destroy.

In the Linux kernel drm/nouveau/clk driver, nvkm_clk_ustate_update() used the pstate pointer after list_for_each_entry() exited without a break, making it invalid. The flaw is reachable from userspace via the 'pstate' debugfs file and causes an out-of-bounds read.

In the Linux kernel net/sched act_ct module, flow_offload_alloc() returns NULL when the conntrack entry is dying or when GFP_ATOMIC allocation fails, both expected under load. This path issued a WARN, so with panic_on_warn=1 an unprivileged user could panic the box by racing a conntrack flush against a 'tc ... action ct commit' classifier.

In the Linux kernel GUE handling, gue_remcsum() passed absolute checksum start and field offsets to skb_remcsum_process(), where offset < start underflowed the u16 skb->csum_offset variable. A forwarded packet could retain CHECKSUM_PARTIAL and reach a NETIF_F_HW_CSUM driver, causing skb_copy_and_csum_dev() to write two bytes about 64 KiB beyond the destination buffer.