CVE Vulnerability Catalog

In the Linux kernel, fprobe_fgraph_entry() reserves shadow stack space for every fprobe with an exit handler, but only fills it for those whose entry handler returns 0. Because fgraph_reserve_data() does not clear the area, fprobe_return() parses the unused tail as headers left over from an earlier call, which can cause an exit handler to run twice or despite its entry handler asking to skip it.

In the Linux kernel's ntfs3 filesystem, ntfs_create_inode() called d_instantiate() before unlock_new_inode(), causing a race between directory creation and mounting a filesystem on the same path. This reset the i_rwsem lock state (count and owner) while another thread already held it, triggering warnings in do_new_mount and potentially causing inode_lock() to hang indefinitely. The fix switches to d_instantiate_new() and removes the trailing unlock_new_inode().

In the Linux kernel, cleanup_offline_cgwb() walks wb->b_attached and wb->b_dirty_time from the same end on every call, rescanning a growing run of inodes that cannot be switched. With roughly 17 million inodes attached to one dying cgwb, this makes a full drain quadratic and results in soft lockups with CPUs stuck for 21-48 seconds.

A vulnerability was fixed in the Linux kernel workqueue subsystem where check_flush_dependency() could dereference a NULL pointer (worker->current_pwq). This occurs when a kworker thread with PF_WQ_WORKER set is not currently executing a work item, such as during an allocation path invoking the OOM notifier. It can lead to a kernel crash (kernel panic).

In the Linux kernel, cleanup_offline_cgwbs_workfn() draining dying cgwbs used cond_resched(), which is a no-op on CONFIG_PREEMPTION kernels (full and lazy modes). As a result, the drain loop never reported a Tasks-RCU quiescent state, causing multi-minute stalls of synchronize_rcu_tasks() when cgroups had millions of attached inodes.

In the Linux kernel, read_dts_node() calls of_clk_get(), which returns a clock with its reference count incremented, but only uses it to read the rate and never calls clk_put(). The clock is not stored anywhere, so the reference cannot be released later either.

In the Linux kernel, new_policy() audits the policy after ipe_new_policyfs_node() publishes it and drops the new directory's inode lock. A concurrent delete can free the policy while ipe_audit_policy_load() is still using it, resulting in a use-after-free.

In the Linux kernel, ipe_bdev_setintegrity() frees the old root hash when dm-verity publishes a new one on ->preresume, while policy evaluation can still be dereferencing it. This results in a potential use-after-free.

In the Linux kernel, ipv6_find_hdr() walked the IPv6 extension header chain without verifying that the computed offset stayed within the packet bounds. openvswitch then installed that offset as the transport header, and update_ipv6_checksum() read and wrote the transport checksum field out of bounds, causing a KASAN-reported use-after-free. The fix rejects any header whose declared length does not fit within the packet.

In the Linux kernel, the seg6 (IPv6 Segment Routing) SEG6_ATTR_DST attribute used NLA_BINARY with only a maximum length limit. A shorter attribute (e.g., 0 bytes) caused a 16-byte out-of-bounds read past the skb buffer and leaked uninitialized kernel heap memory to userspace via SEG6_CMD_GET_TUNSRC.

A flaw in the Linux kernel kprobes subsystem causes a permanent hang when disabling kprobe optimization. Writing 0 to /proc/sys/debug/kprobes-optimization while a kprobe is jump-optimized leaves the writer sleeping forever in D state with kprobe_sysctl_mutex held, blocking any subsequent access to that sysctl. The issue stems from improper completion synchronization between the optimizer thread and flush callers.

In the Linux kernel, the gpio: arizona driver's arizona_gpio_direction_out() acquires a runtime PM reference when switching a GPIO line from input to output, but if the subsequent regmap_update_bits() fails, the reference is never dropped. This leads to a runtime PM reference leak.

In the Linux kernel, the gpio: cdev subsystem's gpio_desc_to_lineinfo() returns early if it fails to acquire the GPIO chip guard, before zeroing the info struct that is later passed to userspace. This may leak kernel stack contents.

In the Linux kernel, the gpio: zynq driver's zynq_gpio_request() calls pm_runtime_get_sync(), which increments the usage counter even on failure, and the error is returned without dropping the reference. Since gpiolib does not call ->free() when ->request() fails, the runtime PM reference is leaked.

In the Linux kernel, the llc subsystem's llc_alloc_frame() reserves link-layer headroom based on the device type, which is insufficient for stacked Ethernet devices such as VLAN devices. An LLC response on such a device can underflow skb headroom in eth_header().

In the Linux kernel, the mctp subsystem's mctp_lookup_prealloc_tag() iterates over the namespace-wide &mns->keys list instead of the socket's own list, without checking whether tmp->sk == &msk->sk. This allows any MCTP socket in the same network namespace to use and consume another socket's preallocated tag.

In the Linux kernel, the rds: ib subsystem's rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA mapping succeeds. On failure, __rds_rdma_map() unpins pages and frees the scatterlist, but rds_ib_free_frmr() can return the MR to the pool with a stale pointer, leading to use-after-free and local privilege escalation.

A null-ptr-deref bug exists in the Linux kernel DRM subsystem when closing a DRM file descriptor. It occurs when an fbdev client is registered but its initialization fails, leaving a partially initialized state. The restore callback then attempts to restore a non-existent framebuffer, causing a warning and NULL pointer dereference.

In the Linux kernel, the drm/imagination (PowerVR) driver failed to correctly propagate the error returned by pvr_mmu_map_sgl() to pvr_mmu_map(). As a result, pvr_mmu_map() continued execution instead of returning an error to the caller, leading to a NULL pointer dereference and kernel oops in pvr_mmu_op_context_unmap_curr_page.

In the Linux kernel, the i915_gem_busy_ioctl function in the drm/i915 driver has an incorrect RCU teardown order. If a GEM object is destroyed during fence iteration, the loop never terminates, causing an endless loop.