CVE Vulnerability Catalog

In the Linux kernel, the bcmgenet driver has a flawed timeout handler: it stops all transmit queues when a single queue times out, causing race conditions with queues that are still functioning. The fix restarts only the timed-out queue.

In the Linux kernel, the open-coded task_vma BPF iterator has a use-after-free (UAF) vulnerability. The iterator reads task->mm locklessly and does not call mmget(), allowing the mm_struct to be freed during concurrent process exit.

In the Linux kernel task_vma iterator, there is a lock ordering issue. Holding the VMA lock during BPF program execution can lead to deadlocks. The fix takes a VMA snapshot and releases the lock before returning.

In the Linux kernel, the bpf_fd_array_map_clear() function is missing a cond_resched() call in its loop, which can cause RCU stalls and system crashes when clearing PROG_ARRAY maps with many entries.

In the 6pack (hamradio) driver in the Linux kernel, the sixpack_receive_buf() function does not skip bytes with TTY error flags, leading to processing of uninitialized data and KMSAN reporting an uninit-value read.

In the Linux kernel's BPF subsystem, a vulnerability was found due to inconsistent ID mapping for scalar registers with the BPF_ADD_CONST flag. The regsafe() function fails to verify that underlying base IDs are consistent with existing mappings, potentially leading to incorrect verifier state pruning.

In the Linux kernel, a vulnerability in the cls_fw classifier allows a filter to be published to the datapath before the change() function is called, leading to a NULL pointer dereference when an invalid filter is processed.

A memory leak was found in the Linux kernel in the deferred packet drop mechanism of qdiscs. When the root qdisc does not implement the TCQ_F_DEQUEUE_DROPS flag, packets to be freed are not released and remain on a local list.

In the Linux kernel, in BPF sock_ops programs, when the destination register is the same as the source, the SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() macros fail to zero the destination register in the !fullsock / !locked_tcp_sock path. This leads to stack out-of-bounds read and kernel pointer leak.

In the Linux kernel, the use of RDS/IB is now restricted to the initial network namespace. The RDS/IB code does not work correctly in other namespaces, which could lead to errors or unexpected behavior.

In the Linux kernel, an out-of-bounds read occurs in pcpu_init_value when copying data from a CGROUP_STORAGE map to a pcpu map with the same value size not rounded up to 8 bytes. The issue arises when the source has less than 8 bytes and the copy is rounded up.

In the Linux kernel, the ppp driver lacks a requirement for CAP_NET_ADMIN in the target network namespace for unattached ioctls. A local unprivileged user can create a new user namespace, gain CAP_NET_ADMIN only in that namespace, and then issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against an inherited network namespace.

In the Linux kernel, bpf_prog_test_run_skb() calls eth_type_trans() and then uses skb->protocol to initialize sk family and address fields for the test. For IPv4/IPv6 packets, it may access ip_hdr(skb) or ipv6_hdr(skb) even when the test input only contains an Ethernet header. The fix rejects the input earlier if the Ethernet frame carries IPv4/IPv6 EtherType but the L3 header is too short.

A vulnerability in the Linux kernel in the Bluetooth HCI UART driver (hci_ldisc). When hci_register_dev() fails, the HCI_UART_PROTO_INIT flag is not cleared, potentially leading to recv being called after resources are freed. The fix clears the flag before closing.

In the Linux kernel, a vulnerability was found in the Bluetooth stack where hci_conn_request_evt() calls hci_connect_cfm() without holding the hdev->lock when the protocol sets HCI_PROTO_DEFER. This can lead to a use-after-free (UAF) if the connection is deleted concurrently.

In the Linux kernel, missing channel lock in l2cap_ecred_reconf_rsp allows a remote BLE device to send a crafted L2CAP ECRED reconfiguration response, potentially corrupting the channel list while another thread iterates it.

A vulnerability in the Linux kernel's SCTP over UDP implementation fails to disable BH before calling tunnel xmit functions, causing unbalanced recursion counters and potential packet drops.

A null-pointer dereference vulnerability was found in the Linux kernel's xdp_master_redirect() function when redirecting XDP traffic to a master interface that has not been brought up. The issue occurs when a bond interface in round-robin mode is never opened (bond_open()), leaving the per-CPU rr_tx_counter uninitialized, leading to a kernel panic.

In the Linux kernel, the DRM komeda driver had an integer overflow vulnerability in AFBC framebuffer size validation. The minimum required buffer size calculation added AFBC payload size to the framebuffer offset without overflow checking, potentially allowing an undersized GEM object and out-of-bounds memory access.

In the Linux kernel PCI endpoint subsystem, a vulnerability was found in pci_epf_alloc_doorbell(). After a failed MSI vector allocation, the doorbell message array is freed but EPF structure pointers still point to freed memory, potentially causing a double-free. Additionally, missing checks for already allocated doorbells allow memory leaks or overwriting existing allocations.