CVE Vulnerability Catalog

A subtle race condition in the Linux kernel's huge_zero_folio implementation can cause the huge_zero_pfn to be overwritten with an invalid sentinel value by the shrinker, leading to misidentification of the huge zero page as a regular THP folio. This may result in incorrect splitting and handling of the huge zero folio.

In the Linux kernel, smc_rx_splice() has a lifetime imbalance issue for splice entries. The function passes pages to splice_to_pipe() before taking references, which can lead to use-after-free due to refcount underflow.

In the Linux kernel, in6_dev_get() can resurrect an inet6_dev object after it has been freed. It reads dev->ip6_ptr under RCU and then unconditionally increments its refcount. If device teardown clears the pointer and drops the last reference between these operations, the increment can resurrect an object whose RCU free has already been queued, leading to use-after-free.

In the Linux kernel, the net/dibs module has a double-free and use-after-free (UAF) issue with dmb_clientid_arr. An interrupt handler can be active after dibs_dev_del() and still access the array. In case of failure in dibs_dev_add(), the array is freed twice.

In the Linux kernel, the zerocopy_fill_skb_from_devmem() function lacks a check to prevent mixing net_iov and page-backed fragments in a single skb. Such mixing can cause a crash in the network stack.

In the Linux kernel, the ntb_netdev driver's ntb_netdev_rx_handler() hands the received skb to the network stack before allocating its replacement. If allocation fails, the buffer is not reposted, gradually depleting the RX queue and potentially stalling reception.

In the Linux kernel's netfilter bridge subsystem, a nftables ct zone rule can attach a conntrack template to an skb before nf_ct_bridge_pre() processes it. For non-IP EtherTypes, the function overwrites the conntrack state without releasing the template reference, causing memory leaks.

In the Linux kernel's netfilter nf_conntrack, TCP and SCTP paths can emit invalid-packet logs while holding ct->lock. If logging is routed to nfnetlink_log and conntrack export is enabled, a deadlock can occur.

A vulnerability in the Linux kernel's net/sched/act_ct module causes an sk_buff leak when header checks reject a packet. The function tcf_ct_handle_fragments() returns errors without freeing the skb, and the caller treats all non-zero returns as ownership transfer, leading to a memory leak. Reproduced on v7.2-rc6, each malformed packet leaks a 232-byte skbuff_head_cache object plus a 704-byte data buffer.

A vulnerability in the Linux kernel's VXLAN driver arms the ageing timer on a down interface due to a missing netif_running() check. This leads to a use-after-free when the interface is deleted, as the timer is still queued on freed memory. An unprivileged user can trigger this in a new user and network namespace.

In the Linux kernel, in virtio vsock, the RX, TX, and event workers read their virtqueue before checking the run flag, which can lead to use of a deleted queue after device suspend/resume.

A vulnerability in the Linux kernel's vsock/virtio driver allows the RX worker to refill the queue after teardown, leading to a use-after-free and kernel panic. The issue occurs when work is queued after virtio_vsock_vqs_del() has been called.

In the Linux kernel, in TLS, when the sk_msg ring is full, the full_record flag is not set, which can lead to pointer wrap and overwriting entries, then to a system crash (NULL pointer dereference).

A use-after-free vulnerability was found in the TIPC module of the Linux kernel. The tipc_node_link_down() function reads the link pointer before acquiring the lock, which can lead to dereferencing freed memory during concurrent link deletion. The issue was fixed by moving the pointer read inside the lock.

In the Linux kernel KVM/SVM subsystem, a synchronization issue was found with the owner and mirror lists. Concurrent move and copy operations of encryption context can corrupt the list or cause an incorrect kvm_put_kvm() call.

In the Linux kernel eventfs subsystem, a use-after-free vulnerability was found in eventfs_remove_rec(). During recursive removal, the list iterator may read a pointer after memory is freed, leading to security issues.

In the Linux kernel eventfs subsystem, an issue was found with using the list field as an RCU head and missing memory barriers. This could lead to reading corrupted data during iteration over the children list.

In the Linux kernel hwmon thermal driver, a commit was reverted that introduced a use-after-free in the error path of thermal_add_hwmon_sysfs(). The fix restores the removed validation.

In the Linux kernel ptp_ocp driver, an out-of-bounds read was found in the board ID field from EEPROM. The field is not NUL-terminated, which could lead to reading memory beyond the buffer.

A vulnerability was found in the Linux kernel's ring-buffer mechanism, where ring_buffer_swap_cpu() can swap per-CPU buffers during an ongoing write operation. The committing counter may temporarily drop to zero, allowing an unsafe buffer swap and leading to inconsistent state and RB_WARN_ON. The fix replaces the counter check with current_context checks, which are set at the start of the operation and remain valid throughout.