CVE Vulnerability Catalog

In the Linux kernel, ip6_tnl_xmit() uses skb_realloc_headroom(), which replaces the caller-owned skb and keeps the replacement only in a local variable. If an error occurs after reallocation (e.g., non-NONE encap rejection in collect_md tunnels or ip6_tnl_encap() failure), the caller still holds the original skb pointer, leading to a double free of the skb.

In the Linux kernel, ip6gre_tnl_link_config_route() incorrectly accumulates the lower device's hardware header length into dev->hard_header_len for NBMA ip6gre tunnels. This results in an incorrect hardware header length for the tunnel, potentially causing packet transmission issues.

A NULL pointer dereference vulnerability exists in the Linux kernel's ipv6_rpl_srh_rcv() function, which reads idev->cnf.rpl_seg_enabled without checking whether idev from __in6_dev_get() is NULL. When the device MTU drops below IPV6_MIN_MTU, addrconf_ifdown() clears dev->ip6_ptr, and a packet that passed the earlier idev check can reach ipv6_rpl_srh_rcv() with a NULL pointer.

A vulnerability in the Linux kernel's Landlock mechanism related to whiteout object creation used by OverlayFS has been fixed. Creating whiteouts via mknod(2) with S_IFCHR and makedev(0,0), and via renameat2(2) with RENAME_WHITEOUT, was not properly restricted by Landlock permissions, allowing bypass of restrictions. The fix requires LANDLOCK_ACCESS_FS_MAKE_REG for both cases.

In the Linux kernel, __nd_label_validate() in libnvdimm/labels has an integer overflow. The nslot field (u32) is multiplied by the label size in 32-bit arithmetic, which can wrap around and bypass the bounds check, leading to an out-of-bounds write in nd_label_data_init().

In the Linux kernel, the super_1_load() function in the md module did not validate the range of sb->bblog_shift loaded from the on-disk superblock. This value (0-255) is used as a bit shift when computing sector and block counts, which with an invalid value can overflow a 64-bit variable and cause an error in badblocks_set() in block/badblocks.c.

In the Linux kernel, mptcp_token_join_cookie_init_state() fails to restore the local_id field from the saved cookie entry when rebuilding the request socket for an MP_JOIN handled under SYN cookies. The uninitialized field is then read by subflow_ulp_clone() and stored as the joined subflow's address-ID, which an off-path peer can influence by sending concurrent MP_JOIN SYNs.

In the Linux kernel, the nouveau/gem driver has a race in the non-uvmm path between the info lookup finding the vma and the gem close path closing the vma, leading to a use-after-free.

In the Linux kernel, svc_pool_for_cpu() can select a pool with no threads when a service runs fewer threads than it has pools (e.g., nfsd in pernode/percpu mode with fewer threads than NUMA nodes). A transport enqueued on such a pool is never picked up, causing the connection to hang indefinitely.

In the Linux kernel, sunrpc_destroy_cache_detail() only cancels the global cache_cleaner delayed_work when cache_list is empty, which never happens during per-netns teardown. This leads to a use-after-free where cache_clean() may still hold a dangling pointer to the freed cache_detail.

In the Linux kernel, __svc_create() ignored the return values of percpu_counter_init() when initializing three per-pool RPC statistics counters. When a per-CPU allocation fails (e.g., under memory pressure), the RPC service (nfsd, lockd, or NFS callback service) is started with uninitialized counters whose per-CPU pointer is NULL. This silently corrupts data in the current CPU's per-CPU area and causes /proc/fs/nfsd/pool_stats to return garbage.

In the Linux kernel, svc_rqst_free() frees rq_argp and rq_resp synchronously while deferring the rqstp struct free via kfree_rcu(). This creates a window where RCU readers can access already freed fields, leading to a use-after-free.

The Linux kernel fixed four coupled defects in the SUNRPC gssx XDR option-array decoder. The bugs caused a NULL dereference in the caller, a refcount leak on the decoded group_info, and a latent use-after-free.

A race condition exists in the Linux kernel sunrpc module. The /proc/net/rpc/use-gss-proxy entry is published by proc_create_data() before the sn->gssp_lock mutex is initialized via mutex_init(), allowing a writer to lock an uninitialized mutex.

In the Linux kernel, svc_rdma_free() in the svcrdma subsystem has a use-after-free due to operation ordering. rpcrdma_rn_unregister() is called after rdma_destroy_id(), leaving the sc_rn entry in the device's rd_xa after the cm_id is freed. A concurrent ib_unregister_device walk can dispatch svc_rdma_xprt_done() against the freed sc_cm_id. Additionally, the sc_cm_id dereference lacks a NULL check.

In the Linux kernel svcrdma module, when handling an ADDR_CHANGE event the replacement connection ID (cm_id) allocation fails, sc_cm_id still points to the old cm_id that the CM core is about to destroy. Any later dereference of sc_cm_id, such as the rdma_disconnect() call in svc_rdma_detach(), results in a use-after-free.

In the Linux kernel svcrdma module, individual Read segment lengths are validated at decode time, but nothing prevents a requester from sending multiple segments whose cumulative length exceeds the rq_pages array budget. When one segment fills the page array exactly, the runtime guard in svc_rdma_build_read_segment() is bypassed because len reaches zero, and a subsequent segment accesses the NULL sentinel slot at rq_pages[rq_maxpages], resulting in a NULL pointer dereference during DMA mapping.

In the Linux kernel's ath6kl wifi driver, ath6kl_cfg80211_connect_event() subtracts fixed IE offsets from assoc_req_len and assoc_resp_len (both u8) without a lower bound. When the length is smaller than the offset, the u8 wraps to about 250, and cfg80211_connect_result()/cfg80211_roamed() treat that wrapped value as the IE length and copy that many bytes from the small assoc_info buffer to user space via nl80211, disclosing adjacent slab memory.

In the Linux kernel's mt76 wifi driver (mt7925), the pending mlo_pm_work is not cancelled in reset, suspend, and unregister paths. If the device is reset, suspended, or unregistered within that window, the pending work can still run and access already freed vif/bss data or send MCU commands while the firmware is unavailable.

In the Linux kernel's media staging/ipu7 driver, isys_register_devices() registers the V4L2 async notifier, but the probe error path (isys_probe()) only calls isys_unregister_devices(), which does not unregister or clean up the notifier. As a result, the notifier stays on the global notifier_list while the enclosing struct ipu7_isys is freed by devres, leading to list corruption and a use-after-free the next time the list is walked.