CVE Vulnerability Catalog

In the Linux kernel, __rds_conn_create() computed npaths from the caller's transport before deciding whether a connection to a local address would use the loopback transport. This caused seven workqueues to leak on every connection teardown, netns teardown, or module unload. The fix recomputes npaths once the final transport is determined.

In the Linux kernel, smcr_port_err() traversed smc_lgr_list.list without holding smc_lgr_list.lock, allowing a concurrent smc_lgr_terminate_sched() to free an lgr while it was still being dereferenced. The fix holds the lock across the traversal and calls smcr_port_err() after releasing the lock in smc_ib_gid_check().

In the Linux kernel, dev_cpu_dead() drained softnet queues on CPU offline but left net_hotdata.skb_defer_nodes untouched, stranding deferred skbs until the CPU came back online. This could stall page_pool_destroy() waiting for inflight pages and block future IPI kicks. The fix drains defer nodes, resets defer_ipi_scheduled, and re-checks CPU state in skb_attempt_defer_free().

In the Linux kernel, gve_can_send_tso() unconditionally used skb_tcp_all_headers() to compute header length, which for SKB_GSO_UDP_L4 packets (no TCP header) yielded an incorrect value. This misestimated buffers per segment, causing unnecessary GSO disabling or handing the device packets exceeding buffer limits. The fix uses the UDP header length for SKB_GSO_UDP_L4 packets.

In the Linux kernel, gve_prep_tso() did not enforce the device-required MSS <= 9728 limit, assuming the 9K MTU and 64KB TSO limit were sufficient. Packets not generated locally (e.g., from a guest behind a tap or a packet socket user) can carry arbitrary gso_size, and the 14-bit MSS field silently turns gso_size 16384 into MSS zero. The fix drops such packets and leaves their GSO bits alone.

In the Linux kernel, llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr() called kfree_skb(skb) instead of kfree_skb(nskb) on llc_mac_hdr_init() failure, leaking the newly allocated nskb, reading from freed skb, and double-freeing skb. Similar nskb leaks occurred in llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(). The fix frees nskb in all three error paths.

In the Linux kernel, vlan_dev_hard_header() could be reached with insufficient headroom by callers reserving only ETH_HLEN or less, or by skbs allocated before dynamic device/headroom changes, triggering skb_under_panic(). The fix uses skb_cow_head() when VLAN_FLAG_REORDER_HDR is not set and READ_ONCE() for dev->hard_header_len and dev->needed_headroom.

In the Linux kernel, when autofs_fill_super() failed before clearing AUTOFS_SBI_CATATONIC, deactivate_locked_super() invoked autofs_kill_sb() -> autofs_catatonic_mode(sbi), which returned early without calling fput(sbi->pipe), permanently leaking the pipe file reference. The fix explicitly releases sbi->pipe in autofs_kill_sb() if still non-NULL after autofs_catatonic_mode().

In the Linux kernel, attach_perf_ctx_data() can race between global and !global cases, missing the global field assignment and leaking a reference count. Consequently, a later detach_global_ctx_data() sees the data but does not mark it as global, so it does not call detach_task_ctx_data(). The fix eliminates the race and reference leak.

In the Linux kernel, perf_clear_branch_entry_bitfields() cleared the perf_branch_entry bitfields one by one and did not cover the new_type and priv fields that were added later. As a result, on arm64, perf branch records can reach userspace with uninitialised kmalloc() data or values from the previous record.

A vulnerability in the Linux kernel's TIPC module was fixed where invalid or unexpected GRP_ACK_MSG messages could cause an underflow of the bc_ackers counter. Because the counter is a u16, it could wrap to 65535, permanently blocking group broadcasts on the socket.

A vulnerability in the Linux kernel TCP stack related to collapsing skbs in the retransmit queue has been fixed. The tcp_write_collapse_fence() function was a no-op when the write queue was empty, allowing skbs queued after a device encryption switch to be merged with earlier skbs. As a result, data could be retransmitted in cleartext (psp) or the connection could stall (tls device offload).

A use-after-free vulnerability exists in the Linux kernel's SCTP implementation. When an association is in COOKIE-ECHOED state and a peer sends a bundled [ERROR(Stale Cookie)][DATA] packet from a non-primary address, processing removes the transport the packet arrived on, but the subsequent DATA chunk re-registers a pointer to that freed transport. Later use of this dangling pointer (e.g., via FWD-TSN or delayed SACK timer) leads to a write to freed memory.

The Linux kernel has an integer overflow in prb_calc_retire_blk_tmo() in the af_packet subsystem (TPACKET_V3). A user with CAP_NET_RAW can set tp_block_size to around 256 MiB, causing 32-bit arithmetic to overflow and return a negative value. As a result, the hrtimer is started with a negative interval, causing it to fire immediately and restart continuously, spinning a CPU in softirq.

In the Linux kernel, __init_el2_fgt2() wrote the same mask to both HDFGRTR2_EL2 and HDFGWTR2_EL2, so the nPMZR_EL0 trap bit for PMZR_EL0 writes was never set. With kernel.perf_user_access=1, a PMZR_EL0 write from EL0 traps to EL2, where the nVHE hypervisor has no handler and BUG()s, taking the host down without a panic message.

In the libata subsystem, ata_scsi_set_passthru_sense_fields() trusted the additional length byte sb[7] from a faulty or malicious ATAPI device's REQUEST SENSE reply. This causes reads and writes past the 96-byte sense buffer in three ways, confirmed by KASAN slab-out-of-bounds reports.

In the bna driver, bnad_pci_remove() and the probe disable_ioceth path called timer_delete_sync() for ioc_timer, sem_timer and hb_timer, but not for iocpf_timer. After free_netdev() frees the bnad struct, bnad_iocpf_timeout() accesses freed memory, because sem_timer and iocpf_timer rearm each other.

In the Linux kernel, bpf_lsm_has_d_inode_locked() caused the verifier to rewrite bpf_[set|remove]_dentry_xattr() to the _locked variants that assume the inode's i_rwsem is held. However, the path_unlink and path_rmdir hooks run before vfs_unlink()/vfs_rmdir() take that lock, so a BPF LSM program attached to these hooks mutates xattrs without holding the lock.

In the Linux kernel, remote_partition_enable() had its cpumask_intersects() conflict check replaced by WARN_ON_ONCE(). As a result, a remote cpuset partition can be enabled on CPUs already owned by an ancestor local partition, emitting a kernel warning and leaving two partitions claiming exclusive use of the same CPU.

A vulnerability was found in the Linux kernel's FOU (Foo-over-UDP) implementation. When a user creates a FOU_ENCAP_DIRECT tunnel via netlink while omitting the optional FOU_ATTR_IPPROTO attribute, the protocol field remains zero, causing an sk_buff memory leak on every received packet. The flaw was fixed by rejecting such requests with -EINVAL.