CVE Vulnerability Catalog

In the Linux kernel scheduler (sched/core), core scheduling's pick_next_task() breaks when a ->pick_task() implementation can release the rq lock. The selection state derived on entry is only valid while the lock is held continuously; once a pick can drop the lock, an interleaving selection can invalidate it, leading to an incorrect committed pick or skewed forceidle accounting.

In the Linux kernel scheduler (sched/core), core scheduling's pick_next_task() operates on all sibling rqs under one acquisition of the shared core-wide lock. When a ->pick_task() releases the rq lock, every sibling __lock is momentarily free, letting __sched_core_flip(false) complete mid-selection and rebind rq_lockp() under it. The selection resumes on split locks, touching sibling state it no longer protects, and __schedule() finally releases a lock that was never taken while leaking the one that was.

In the Linux kernel, the RISC-V KVM implementation has an integer overflow in the PMU event info array size calculation. The guest-controlled num_events value is multiplied by sizeof(*einfo) and stored in a 32-bit integer, causing truncation for large values and allocation of an undersized buffer. The subsequent loop iterates over the original num_events, resulting in out-of-bounds reads and writes.

In the Linux kernel, the qede driver (QLogic FastLinQ NIC) has a bug where memory pressure causes a NULL pointer dereference while processing TPA continuation fragments. Because tpa_info->buffer.data is not assigned in qede_tpa_start(), a "ghost" buffer with a valid DMA mapping but a NULL data pointer is pushed back into the Rx ring, causing a kernel panic in qede_fill_frag_skb().

In the Linux kernel, the RDMA/cxgb4 driver's c4iw_remove() can free ctx->dev while the queued reg_work (which registers the RDMA device) is still pending or running. This leaves c4iw_register_device() accessing the freed device.

In the Linux kernel, ucma_set_ib_path() called ucma_event_handler() from the write() path without the handler lock that keeps ctx->file stable while a uevent is queued. A concurrent ucma_migrate_id() could reassign ctx->file, causing list operations on another file's event_list without the correct mutex, leading to a use-after-free (detected by KASAN).

A vulnerability in the Linux kernel RDMA/ucma module: ucma_write_cm_event() does not take the handler lock. While ucma_migrate_id() moves a context to another file, ctx->file can be swapped mid-sequence, causing list corruption, a permanently held mutex, and a process stuck in D state. The flaw is reachable by an unprivileged user via /dev/infiniband/rdma_cm.

In the Linux kernel's as3722_get_regulator_dt_data(), of_get_child_by_name() acquires a reference on np which is assigned to pdev->dev.of_node, but of_node_put(np) is then called immediately, releasing the reference and leaving a dangling pointer. Removing the of_node_put(np) call lets the device hold the reference.

In the Linux kernel ring-buffer subsystem, ring_buffer_alloc_read_page() races with ring_buffer_subbuf_order_set, potentially allocating a reader page with an outdated order. If subbuf_order changes mid-allocation, bpage->order may not match the actual allocated memory.

In the Linux kernel ring-buffer subsystem, ring_buffer_subbuf_order_set() can clear cpu_buffer->free_page, causing races with ring_buffer_alloc_read_page() and ring_buffer_free_read_page(). The fix holds cpu_buffer->lock while resizing a subbuf.

In the Linux kernel ring-buffer subsystem, discarding a cached reader page after a concurrent ring buffer resize uses the new global subbuf_order for free_pages(), potentially crashing the kernel or leaking memory. The fix stores the actual page order alongside the page address by making free_page a buffer_data_read_page.

In the Linux kernel ring-buffer subsystem, __rb_get_reader_page_from_remote() continues despite a failed swap_reader_page callback (returning -EBUSY), potentially mishandling the page list. The fix treats the callback failure as recoverable, logs it with pr_warn_ratelimited(), and returns NULL.

In the Linux kernel orangefs filesystem, orangefs_prepare_cdm_array() sizes each client debug keyword buffer with strcspn(cds_head, " ") but parses it with %s, which skips leading whitespace. If a client debug entry starts with a space, the allocation can be too small and sscanf() writes past the buffer.

The Linux kernel ocfs2 module lacked validation of the rl_used and rl_count fields in the refcount block. A crafted or corrupted ocfs2 image with rl_used set to 0xffff causes an out-of-bounds read past the metadata block and a subsequent out-of-bounds memmove during a reflink (FICLONE) operation. Exploitation requires local access (CAP_SYS_ADMIN mounting a crafted image or raw write to the backing block device).

In the Linux kernel on the OpenRISC architecture, the sys_or1k_atomic syscall (number 244) did not check user pointers with access_ok() before performing an atomic swap in hand-written assembly. This allowed an unprivileged process to pass a kernel address and directly read from or write to kernel memory.

In the Linux kernel, the openvswitch module has a use-after-free in CT limit teardown. The CT limit pointer was not removed from readers nor protected by an RCU grace period, so packet processing could dereference freed state when the network namespace is torn down. An unprivileged user can trigger this from a user and network namespace.

In the Linux kernel, openvswitch's queue_userspace_packet() calls skb_tx_error() on a packet it does not own and that is still being forwarded. This strips SKBFL_SHARED_FRAG from the live skb, causing a later local ESP-in-UDP delivery to decrypt in place over pages the sender does not own, enabling an unprivileged page-cache write (the "Fragnesia" primitive).

In the Linux kernel, the IPMI subsystem has a use-after-free in _ipmi_destroy_user(). Removing the synchronize_rcu() between unlinking command receivers from intf->cmd_rcvrs and freeing them allows a reader to still hold a pointer to a freed cmd_rcvr. The cmd_rcvrs list is still traversed under plain RCU, so the missing grace period causes a use-after-free.

A vulnerability was fixed in the Linux kernel NVMe driver where nvme_setup_discard() fell back to the per-controller ctrl->discard_page on allocation failure, which was never zeroed. As a result, up to 4080 bytes of uninitialized memory from the page's previous contents were sent to the NVMe controller.

In the Linux kernel, the nvme-tcp driver's nvme_tcp_handle_r2t() does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it, sending the READ destination buffer (containing stale kernel data) to the controller. This leaks host memory, including struct page pointers.