CVE Vulnerability Catalog

In the Linux kernel mtk_eth_soc driver, when register_netdev() failed for one of the MTK_MAX_DEVS devices in mtk_probe(), the error path skipped mtk_unreg_dev(). Previously registered net_devices were then freed by mtk_free_dev() while still in NETREG_REGISTERED state, hitting BUG_ON.

A Linux kernel vulnerability was fixed in the ethtool subsystem where an offline self test (ETHTOOL_TEST) could bring the network interface down and up without holding the required rtnl_lock. This affected drivers fbnic and bnxt that are ops-locked and only hold the netdev instance lock. The missing rtnl_lock triggered lockdep warnings and ASSERT_RTNL() violations.

In the Linux kernel fbnic driver, the standalone channel allocation path excluded FBNIC_MAX_TXQS from the layout, using one NAPI vector per Tx and Rx queue. A 64-Tx/64-Rx configuration recorded 128 vectors but allocated only 64, leaving NULL entries dereferenced during resource setup.

A bug was fixed in the Linux kernel's fbnic Ethernet driver related to selecting the NAPI vector for an Rx queue. The code used an index modulo the number of NAPI vectors, which incorrectly assigned Tx NAPI vectors when standalone Tx vectors existed. The fix uses the NAPI pointer stored in netdev_rx_queue.napi, set by fbnic_set_netif_napi() and cleared by fbnic_reset_netif_napi(), eliminating the modulo division and ensuring correctness even when the datapath is down.

In the Linux kernel, the fbnic Ethernet driver failed to reset num_napi when NAPI vectors were freed. As a result, when the PM path or a failed PCIe error recovery tears down the datapath without rebuilding it, num_napi remains positive while the vectors are freed, leading to a use-after-free and NULL pointer dereference in fbnic_dbg_down().

In the Linux kernel, the eth: fbnic driver's fbnic_mbx_reset_desc_ring() set only AW_FLUSH without AW_FLUSH_MODE when tearing down the FW mailbox Rx ring, so staged writes were not drained from the PUL pipeline and the flush never completed. The fix adds the FLUSH_MODE definition and sets both bits so staged writes drain on their own while BME stays cleared.

In the Linux kernel, the SCTP function sctp_assoc_update_retran_path() could loop forever when every remaining transport, including retran_path, was SCTP_UNCONFIRMED, because the state check ran before the wraparound test. The fix considers a transport only when it is not UNCONFIRMED and checks whether the walk returned to retran_path, also restoring the NULL guard.

A vulnerability in the Linux kernel BPF subsystem related to ownership tracking of local objects through referenced kptrs has been fixed. Self-referential or long acyclic local kptr type chains could cause kernel stack exhaustion when dropping the head object. The fix bounds ownership depth to eight record-bearing types and rejects cycles.

In the Linux kernel, the USB catc driver's catc_rx_done() bounded packet length against the whole transfer (urb->actual_length) instead of the bytes left from pkt_start, so a crafted packet header made skb_copy_to_linear_data() read past the buffer. Lengths below ETH_HLEN, including zero, were also accepted, causing eth_type_trans() to read a MAC header from uninitialised tailroom.

In the Linux kernel, the kfunc bpf_crypto_ctx_create() read params->reserved[0] and params->reserved[1] before comparing params__sz against the size of struct bpf_crypto_params, even though the verifier only guarantees params__sz bytes are valid. A BPF program could pass a shorter buffer and cause the kernel to read past the validated region.

In the Linux kernel, hfsc_classify() (net/sched: sch_hfsc) applies the level check only when the filter result carries no bound class; a filter created with a flowid gets res.class set once at bind time, so the check never runs during classification. When hfsc_adjust_levels() later raises a class's level without revalidating existing bindings, two binds that were each legal at bind time can point at each other, causing the classify walk to bounce between two interior classes forever with the qdisc lock held and BH disabled — a soft lockup from a single packet. The issue is reachable from an unprivileged user via unshare -Urn (CAP_NET_ADMIN).

In the Linux kernel, the drm/virtio driver's virtio_gpu_gem_create() called drm_gem_object_release() on the drm_gem_handle_create() error path instead of dropping the reference, leaving the bo at refcount 1 with no remaining reference. As a result virtio_gpu_free_object() never ran, leaking shmem pages, the sg table, the virtio_gpu_object, and the host-side resource and resource id.

In the Linux kernel, the drm/virtio driver's virtio_gpu_resource_create_ioctl() called drm_gem_object_release() on the drm_gem_handle_create() error path instead of dropping the reference it owns, so obj->funcs->free() never ran. This leaked the virtio_gpu_object, its pages and sg table, the resource id, and the host-side resource.

In the Linux kernel, virtio_gpu_resource_create_blob_ioctl() in the drm/virtio driver leaks objects. The error paths call drm_gem_object_release() instead of dropping the owned reference, so free() never runs and the virtio_gpu_object, resource id and host-side resource are leaked.

In the Linux kernel, virtio_gpu_vram_create() in the drm/virtio driver frees the object with a bare kfree(vram) on error paths after GEM initialization. The freed object remains in the VMA offset manager's interval tree, so later lookups or insertions walk freed memory, and the dma_resv and gpuva locks are never destroyed.

In the Linux kernel, the drm/bridge samsung-dsim driver has an incorrect TE GPIO lifetime for host attach. Switching to devm_gpiod_get_optional() while keeping matching gpiod_put() calls is wrong for a managed descriptor; dropping the puts is also wrong because TE IRQ registration runs from the host attach callback and detach/reattach can occur without destroying the owning device.

In the Linux kernel, the ovpn module publishes struct ovpn_bind through peer->bind with RCU, but local endpoint learning updates bind->local in place under peer->lock while the UDP TX path reads the field without that lock. A concurrent IPv6 update can therefore result in a torn address read.

In the Linux kernel, the ovpn module's UDP output fallback clears bind->local in place when the remembered source address is no longer usable. Because the bind is RCU-published and read locklessly by concurrent TX, an IPv6 reader can observe a torn address.

In the Linux kernel, Bluetooth BNEP frame processing contains multiple out-of-bounds reads. bnep_rx_frame() and bnep_ctrl_frame() do not verify the BNEP header, control type byte, filter count and extension headers exist before reading them, and bnep_net_xmit() reads the 14-byte Ethernet header without checking skb->len >= ETH_HLEN.

In the Linux kernel, the Bluetooth btintel_pcie driver does not validate device-supplied DMA indices. urbd1->frbd_tag is used directly as an array index into rxq->bufs[] (only 64 entries) without bounds checking, and cr_hia read from a DMA-shared index array can cause an infinite loop when it exceeds rxq->count.