CVE Vulnerability Catalog

In the Linux kernel, the RDMA/efa completion IRQ handler accesses the EQ state and DMA buffer. Its IRQ was registered before that state was initialized, while teardown released the buffer before free_irq() synchronized the handler. The fix initializes the EQ without arming it, registers the IRQ, then arms it, and reverses the resource order during teardown by freeing the IRQ before destroying the EQ.

In the Linux kernel, the USB 6fire driver uses URBs embedded in different structs for PCM, MIDI and communication, which is a buggy implementation nowadays; since a URB is managed with a refcount, this may lead to a UAF when the URB is released asynchronously. The fix converts those embedded URBs to ones properly allocated via usb_alloc_urb(), changing each embedded struct urb to a pointer and updating callers; resources are released in common destructors called at both the init error path and disconnect.

In the Linux kernel, the CoDel scheduler's dropping loop in codel_dequeue() could fail to advance with very small interval values, draining the entire backlog under the qdisc lock in a single call. An unprivileged user could trigger a soft lockup this way. The fix ensures the control-law step is at least 1 tick and caps the dropping loop at 256 drops per codel_dequeue() call.

In the Linux kernel, the mwifiex wifi driver's mwifiex_pcie_request_irq() registers each MSI-X vector with a per-index dev_id (&card->msix_ctx[i]). On a request_irq() failure the cleanup loop "for (j = 0; j < i; j++)" frees msix_entries[j].vector but passes the failed index's &card->msix_ctx[i] as the dev_id. Since free_irq() matches on (irq, dev_id), it fails to find the action registered with &card->msix_ctx[j]: the already-requested IRQ j is not freed (leaked) and free_irq() warns about freeing a non-existent IRQ. The fix uses &card->msix_ctx[j].

In the Linux kernel, ieee80211_request_ibss_scan() in mac80211 warns when the regulatory domain leaves no allowed channel to scan. This can happen because the regdomain can change while IBSS is operating, and IBSS can continue to operate briefly during the 60s grace period until it is shut down. The fix removes the warning in this case.

In the Linux kernel, cfg80211_switch_netns() in cfg80211 moves all interfaces, then moves the wiphy itself by setting its network namespace and renaming it, which makes sysfs move it. The rename can fail (only on allocation failures), leaving things mixed up and hitting a warning. The fix undoes the move and lets the change fail, and if undo fails it WARNs.

In the Linux kernel, mac80211_hwsim checks ->started for frames coming from wmediumd, but the radio can be stopped after the check and before frame delivery, causing mac80211 to hit WARN_ON(!local->started). The fix expands the mutex for this case and synchronizes against it when the radio is stopped, and drops an error print that complicated the error path.

In the Linux kernel, mac80211 AP_VLAN interfaces get crypto_tx_tailroom_needed_cnt from the AP interface on ifup, but it is never decremented unless the AP is also brought down. Bringing the same AP_VLAN up again increments the counter again and eventually hits the WARN_ON_ONCE sanity check. The fix resets it on ifdown.

In the Linux kernel, mac80211 requires that a TDLS setup confirm (WLAN_TDLS_SETUP_CONFIRM) be sent to an existing TDLS station. Otherwise, building the frame hits WARN_ON_ONCE(!sta || !ap_sta). The fix only accepts WLAN_TDLS_SETUP_CONFIRM when the station already exists as a TDLS station.

In the Linux kernel, the ksmbd (SMB server) module mishandles SMB2 session expiration. The ksmbd_session_register() function destroyed valid sessions after ten seconds of inactivity whenever a client started another SessionSetup exchange, confusing Session.IdleTime with Session.ExpirationTime. This invalidated tree connects and caused mapped drives to fail with STATUS_NETWORK_NAME_DELETED.

In the Linux kernel, reset_per_cpu_data() in drop_monitor computes al including sizeof(struct nlattr) (the 4-byte attribute header). It then calls memset(msg, 0, al), where msg points to nla_data(nla), which is sizeof(struct nlattr) bytes past nla, writing 4 bytes beyond the allocated buffer and corrupting skb_shared_info. The fix makes al represent only the payload length and uses genlmsg_new(nla_total_size(al), ...).

In the Linux kernel, the scheduler (sched/core) can move a blocked donor's scheduling context to the lock owner's CPU even when the donor is migration-disabled. set_task_cpu() warns unconditionally for migration-disabled tasks, causing a false positive. The fix excludes blocked proxy donors from the warning.

In the Linux kernel, ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates that offset and triggers the skb warning path. The fix uses the careful transport-header helper and drops the skb through the existing XFRM error path when the offset cannot be represented.

In the Linux kernel, the dmaengine ti k3-udma-glue driver has a bug in k3_udma_glue_release_rx_chn(). If devm_kcalloc() for rx_chn->flows fails in a channel request function, the error path calls k3_udma_glue_release_rx_chn(), which dereferences the NULL rx_chn->flows pointer in k3_udma_glue_release_rx_flow(). The fix skips the flow release loop when rx_chn->flows is not allocated.

In the Linux kernel, the soc: samsung: exynos-pmu driver has a use-after-free of the interrupt generator device tree node. setup_cpuhp_and_cpuidle() releases the node reference (of_node_put()) too early and then passes the intr_gen_node pointer to of_syscon_register_regmap().

In the Linux kernel, a bug in memcg causes obj_cgroup_charge_pages() to not short-circuit the root memcg, leading to a warning in refill_stock() and asymmetric page accounting. This can be triggered via zswap and cgroup operations, resulting in a page counter leak in the root memcg.

In the Linux kernel, the SELinux avc_has_perm_noaudit() function returns early for an empty requested permission set without filling the access decision buffer (@avd). All callers pass an uninitialized stack variable that is then fed to avc_audit(), and the inode hook even stores it in the per-task decision cache.

In the Linux kernel, the power: sequencing subsystem's pwrseq_unit_new() can dereference a NULL pointer. If memory allocation fails in pwrseq_unit_setup_deps(), pwrseq_unit_put() is called to release the partially initialized unit, but unit->list was never initialized and pwrseq_unit_release() unconditionally calls list_del() on it.

In the Linux kernel, the power: sequencing subsystem's pwrseq_device_register() can dereference a NULL pointer. If dev_set_name() fails, the code jumps to the err_put_pwrseq label before initializing pwrseq->targets, and pwrseq_release() unconditionally iterates over targets and dereferences an invalid pointer.

In the Linux kernel, the watchdog: da9063 driver's da9063_wdt_suspend() and da9063_wdt_resume() only check watchdog_active(). When the driver sets WDOG_HW_RUNNING in da9063_wdt_probe() but userspace never opens the device, WDOG_ACTIVE remains cleared and wdt_disable() is not executed during suspend, so the watchdog keeps counting and may reset the system.