CVE Vulnerability Catalog

In the Linux kernel NFC LLCP subsystem, a race condition exists in the accept queue lifecycle. nfc_llcp_socket_release() uses bh_lock_sock(), which does not synchronize with process-context lock_sock() held by nfc_llcp_accept_dequeue() during accept(), leading to use-after-free or NULL pointer dereference in nfc_llcp_accept_unlink(). The fix changes synchronization and defers final release to a workqueue.

In the Linux kernel, the NFC llcp nfc_genl_llc_sdreq() function builds a list of TLV nodes, but three error paths (nested-attr parse failure, TLV alloc ENOMEM, nfc_llcp_send_snl_sdreq() failure) skip freeing already queued items. The fix routes them through a new free_list label, mirroring the SDRES path.

In the Linux kernel, the NFC st21nfca driver's ISO15693 inventory helper removes a two-byte prefix without checking that it exists, then accepts a one-byte remainder before reading data[1] as the DSFID. The fix requires the prefix and at least two remaining bytes before copying UID data and reading the DSFID.

In the Linux kernel, nfc_llcp_wks_sap() compared only service_name_len bytes, so a short service_name like "u" matched longer WKS strings such as "urn:nfc:sn:snep". The fix requires an exact length match before strncmp().

In the Linux kernel, nfc_llcp_wks_sap() and nfc_llcp_build_sdreq_tlv() passed non-null-terminated strings to pr_debug() using the %s format specifier. Buffers allocated via kmemdup() or coming from netlink attributes are not guaranteed to be null-terminated, causing reads beyond the allocated region (slab-out-of-bounds).

In the Linux kernel, the nfc pn533 driver in pn533_acr122_is_rx_frame_valid() read frame->ccid.datalen directly from the USB response frame and used it unchecked as an index into frame->data[]. A malicious or malfunctioning device can set this field to an arbitrary value, causing reads far outside the received buffer.

In the Linux kernel, bcmgenet_netif_stop() and the Wake-on-LAN branch of bcmgenet_suspend() disabled Tx queues before stopping Tx NAPI. An in-flight completion called netif_tx_wake_queue() in between, allowing a transmit to reach the rings after they had been freed, causing a use-after-free.

In the Linux kernel, skb_maybe_pull_tail() subtracted skb_headlen(skb) from the unsigned max argument and passed the result to __pskb_pull_tail() as a signed int. When an skb had a linear area larger than MAX_IPV6_HDR_LEN, the difference wrapped to a negative value, potentially causing a very large copy length in skb_copy_bits().

In the Linux kernel, the BPF JIT for MIPS32 emitted an addu instruction instead of addiu, causing the immediate value 1 to be interpreted as register $at. This made the comparison result invalid when the immediate operand was negative.

In the Linux kernel, in stmmac_rx(), when napi_build_skb() fails, the descriptor page is recycled back to the page pool via page_pool_recycle_direct(), but buf->page is left pointing at the recycled page. As a result, stmmac_rx_refill() skips the replacement allocation and programs the already-recycled page back into the RX descriptor.

In the Linux kernel, the seg6, ioam6 and rpl lwtunnels sized their skb_cow_head() request as the length of new headers plus dst_dev_overhead(), then rebuilt the MAC header via skb_mac_header_rebuild(). When the MAC header was longer than the reserved space (e.g., on ingress through a VLAN device with reorder_hdr off), the rebuild computed a negative offset and wrote about 64 KB past skb->head.

In the Linux kernel, ipgre_netlink_parms() can enable collect_md on an existing GRE, GRETAP or ERSPAN device. Unlike newlink, changelink does not enforce metadata tunnel uniqueness, so converting a non-metadata device can replace the metadata receive entry for another device in the same netns, and deleting either device clears the shared entry.

In the Linux kernel, vxlan_na_create() sampled LL_RESERVED_SPACE() to size the reply skb and then sampled it again to reserve headroom. A concurrent vxlan_changelink() could update needed_headroom between the two reads, creating a TOCTOU race where the second value could exceed the allocation and cause an out-of-bounds Ethernet header write.

A vulnerability was found in the Linux kernel's XPS (Transmit Packet Steering) networking code. When the number of traffic classes (num_tc) is lowered, e.g. via mqprio, stale entries remain in tc_to_txq[] and prio_tc_map[]. __netif_set_xps_queue() fails to reject a class outside the num_tc range, causing an out-of-bounds write past the XPS map and kernel memory corruption (slab-out-of-bounds).

In the Linux kernel, the drm/imagination driver did not bound the firmware reconstruction count to the size of the protocol arrays. An oversized count led to out-of-bounds access to the request's fixed freelist ID array and the copy into the fixed response array. The fix clamps the count to the request capacity and uses it consistently for reconstruction and response publication.

In the Linux kernel, the net: dsa: mt7530 driver's mt7530_remove() unconditionally disables the core and io regulators, even though they are only requested for the ID_MT7530 chip. On MT7621 and MT7531 the pointers remain NULL, so rmmod or a sysfs unbind calls regulator_disable() on NULL.

In the Linux kernel, the net: dsa: mt7530 driver's mt7530_remove_common() disposes per-PHY interrupt mappings from .remove, but the regmap-irq chip owning the domain is devm-registered, so its parent interrupt is freed only after .remove returns. The switch's regmap-irq thread can therefore dispatch on an already-removed mapping, leading to a NULL dereference in handle_nested_irq().

In the Linux kernel, phylink_bringup_phy() stored the PHY pointer (pl->phydev) before its last fallible step (phy_eee_rx_clock_stop()). On an MDIO error, the pointer remained set to a PHY that was no longer attached, leading to a permanent -EBUSY, use of a freed phy_device, or double reference release.

In the Linux kernel, the libwx network driver (WangXun NIC) has a race condition in Tx timestamp handling. The wx->ptp_tx_skb pointer is shared between the Tx path, the PTP auxiliary worker, and cleanup paths, which can lead to a use-after-free of the skb and a reference leak. The fix adds a dedicated spinlock protecting publication and consumption of the Tx timestamp skb.

In the Linux kernel, the nfp driver dropped the XArray lock before taking a reference to the IPsec xfrm_state, allowing the delete path to erase the entry and drop the last reference. RX could then increment a zero refcount after the state was queued for destruction. The fix takes the reference before releasing the XArray lock.