CVE Vulnerability Catalog

In the Linux kernel, rfcomm_recv_frame() accepts too-short RFCOMM frames with an extended length field (EA=0). The length check passes a 4-byte frame, and after FCS trimming skb_pull() fails with its return value ignored, so the un-pulled 3-byte header is processed as application payload or a multiplexer command.

In the Linux kernel, stack_slot_obj_get_spi() does not reject non-negative offsets. For off == 0 the computed spi equals that of the valid stack slot at fp-8, so a PTR_TO_STACK register holding fp+0 can be validated against an iterator stored at fp-8, and an effectful iterator kfunc can interpret memory outside the BPF stack as iterator state.

A vulnerability exists in the Linux kernel's IPv6 routing exception handling. When a route (fib6_info) is being removed, rt6_insert_exception() can still create a new exception because the FIB6_EXCEPTION_BUCKET_FLUSHED flag is no longer set at the right time. This creates a reference cycle, leaks memory, and stalls network device unregistration.

In the Linux kernel, the sr9700 USB driver checked the packet payload length against the whole remaining receive buffer without accounting for the header and CRC overhead. This can lead to incorrect length calculations and improper data copying.

In the Linux kernel, a race condition in IPv6 route handling causes list_empty() to return true when list_del_init() runs concurrently, leading to a leak of dst structures and associated devices. The issue affects uncached routes.

A flaw was fixed in the Linux kernel's UDP socket handling where a disconnected socket remained in the 4-tuple hash table. This keeps hash4_cnt raised and forces packets for that address and port through the 4-tuple lookup first; on IPv6 it can also allow matching datagrams from the former peer with a zero source port. The fix removes the socket from the table before __udp_disconnect() runs.

In the Linux kernel, the tg3 driver fails to release PHYLIB resources (MDIO bus and PHY) when tg3_init_one() fails. This leads to resource leaks on initialization failure.

In the Linux kernel, the debug_info_copy() function in the s390/debug subsystem can dereference NULL pointers when debug_register_static() fails and leaves area bounds unchanged while clearing pointers. The issue occurs when copying such an area.

In the Linux kernel, the spacemit network driver fails to clear the TX descriptor on fragment mapping failure, leaving the TX_DESC_0_OWN flag and stale DMA addresses. This can lead to the DMA engine using freed memory.

In the Linux kernel, the skb_pointer_if_linear() function uses unsigned subtraction that can underflow, causing the bounds check to spuriously pass and generate an invalid pointer in skb-backed BPF dynptrs.

In the Linux kernel, the bpf_sock context access code generates incorrect register values when reading the rx_queue_mapping field, using sign-extending MOV64 instead of MOV32. This creates a mismatch between runtime values and verifier assumptions.

In the Linux kernel, the BPF verifier does not reject passing PTR_TO_PACKET pointers to subprograms that may mutate the packet. Since these pointers are passed as PTR_TO_MEM, invalid memory may be used.

In the Linux kernel, sock_map_alloc() did not validate the upper bound of max_entries, accepting values up to UINT_MAX. When a SOCKMAP is created with max_entries = 0xffffffff, the signed int iterator in sock_map_free() overflows to a negative value, causing an out-of-bounds write that can crash the kernel or corrupt memory.

In the Linux kernel, the firewire cdev driver has a back-transition bug in the iso_resource_auto client resource state. Concurrent access from the work item and the file descriptor release function can cause the state to transition backwards from ISO_RES_AUTO_DEALLOC to ISO_RES_AUTO_REALLOC. The fix checks the current state before updating it in the work item.

In the Linux kernel, the SCTP stack has a timer handling race. The code calls mod_timer() before taking the reference needed by the rearmed timer without holding the sock lock, which can lead to use-after-free and refcount underflow. The fix takes the reference before mod_timer() and drops it if the timer was already pending.

In the Linux kernel, the eth fbnic driver has an issue with rounding zero ring sizes. roundup_pow_of_two() is undefined for zero, and ethtool permits a zero ring size to reach the driver. The fix leaves zero unchanged so the minimum-size check rejects it deterministically.

In the Linux kernel, the net/sched em_text_dump() function allocates struct tcf_em_text on the stack without zeroing it. strscpy() writes the algorithm name and NUL terminator, leaving remaining bytes uninitialized, which are then copied to the netlink response. The fix zero-initialises the struct, closing the leak.

In the Linux kernel, the NFC nfcmrvl driver's firmware download receive path removes the NCI header and reads the helper command before validating the remaining packet length. A short frame can reach the data access before the malformed packet is rejected. The fix validates the complete helper command length before stripping the NCI header.

In the Linux kernel, the NFC st21nfca driver's st21nfca_hci_i2c_repack() trims a received frame at its EOF marker before removing byte stuffing, assuming the truncated frame contains the LLC header and two CRC bytes. A malformed frame can leave too few bytes for check_crc() or cause the unstuffing loop to read past the skb length. The fix requires minimum framing bytes before and after unstuffing and rejects an escape marker without its encoded byte.

A flaw exists in the Linux kernel's nfc_llcp_recv_dm() function handling NFC LLCP sockets. The function fails to take the socket lock and unlink the socket from the connecting_sockets list before setting its state to LLCP_CLOSED, causing list corruption and refcount desync. An unprivileged local process can trigger unbounded kernel socket leaks leading to memory exhaustion and DoS.