CVE Vulnerability Catalog

In the Linux kernel, the RDMA/nldev subsystem has a locking issue when accessing the mr->pd pointer, which can change during rereg_mr. The fix uses mr->device instead of mr->pd->device and adds an rdma_restrack_sync() operation to safely access the PD restrack ID.

In the Linux kernel, the ASoC driver for AMD (acp-sdw-legacy) has an out-of-bounds read in create_sdw_dailinks(). The loop iterates over the soc_dais array, which has exactly num_ends entries, but if all are initialized, the read goes past the end of the array, as reported by KASAN.

In the Linux kernel, the ASoC driver for AMD (acp-sdw-sof) has an out-of-bounds read in create_sdw_dailinks(). The loop iterates over the sof_dais array, which has exactly num_ends entries, but if all are initialized, the read goes past the end of the array.

In the Linux kernel, the configfs filesystem has an issue with lockless traversals of ->s_children. Having the parent directory locked protects entries from removal by another thread, but it does not protect cursors from being moved around by lseek() or freed.

In the Linux kernel, the iommufd subsystem has an ordering issue when detaching from dmabuf. The mutex could still be in use through the dmabuf invalidation callbacks, so the pages content should not be destroyed until the dmabuf is fully detached.

In the Linux kernel, the mt76 WiFi driver has a use-after-free issue in mt76_put_vif_phy_link(). The function frees the offchannel mlink with kfree(), but rcu_assign_pointer does not wait for existing RCU readers who may still hold the pointer. The TX path can dereference freed memory.

In the Linux kernel, the mt7996 driver's mt7996_tx_prepare_skb() function may leak transmission tokens if the link_conf or link_sta lookup fails. The token is allocated before the check and is not released on error. The fix releases the token in case of error.

In the Linux kernel, the __btrfs_run_delayed_refs() function of the Btrfs filesystem has an invalid pointer dereference. When btrfs_select_ref_head() returns -EAGAIN, the locked_ref variable remains an error pointer and is then used in spin_lock(), leading to dereferencing an invalid address. The fix resets locked_ref to NULL and increments the counter to avoid looping.

In the Linux kernel, the ixgbe driver vulnerability involves calling netif_set_xps_queue() for XDP Tx queues that are not netdev-exposed. On systems with >=64 CPUs and E610 adapter, XDP configuration results in 64 XDP queues while max queue pairs is 63, causing a warning and KASAN report (slab-out-of-bounds). The fix skips XPS configuration for XDP Tx queues.

In the Linux kernel, the NFSD server's nfsd4_drop_revoked_stid() function does not handle the SC_TYPE_LAYOUT case, causing that when a client sends FREE_STATEID for an admin-revoked layout stid, the stid is not removed from the list or freed. The fix removes the layout stid from the list and calls nfs4_put_stid() to drop the reference.

A vulnerability in the Linux kernel's BPF mechanism related to map value recycling has been discovered. During map update or delete, special fields (e.g., timers, workqueues) were freed in the operation context, which could be unsafe in NMI context. A new cancel function has been introduced that performs only NMI-safe cleanup, leaving full destruction to the final cleanup path.

In the Linux kernel, vduse_dev_open() has a race condition between IDR lookup and acquiring the device lock. An attacker can exploit the window where VDUSE_DESTROY_DEV removes and frees the object before the open path locks it, leading to use-after-free.

In the Linux kernel, vhost_vdpa_mmap() and vhost_vdpa_fault() do not properly validate the virtqueue index before using it in get_vq_notification(). Missing check that the index is less than v->nvqs allows an out-of-range index to reach the driver, potentially leading to out-of-bounds access and system crash.

In the Linux kernel, the virtio:rtc driver does not delete old virtqueues before reinitializing them during device restore. If reinitialization fails, a NULL pointer dereference can occur in vp_del_vq(), crashing the guest kernel.

In the Linux kernel, the vfio/qat driver's qat_vf_resume_write() checks the file position before taking the migf->lock, but copies data after taking the lock and re-reading the position. Two concurrent writers can bypass the bounds check and write past the end of the migration-state buffer.

In the Linux kernel, the BPF cookie compatibility check for program arrays is insufficient. A program without cgroup storage can be considered compatible with any storage cookie, allowing a bridge in a tail call chain between an entry program and a storage-using callee, leading to incorrect access to cgroup local storage.

In the Linux kernel, the Bluetooth hci_core subsystem has a use-after-free vulnerability in hci_unregister_dev(). The function does not disable cmd_timer and ncmd_timer before freeing the hci_dev structure. If a timer fires during device teardown, the callback dereferences freed memory, leading to use-after-free. The fix adds disable_delayed_work_sync() calls alongside existing disable_work_sync().

In the Linux kernel, the Bluetooth hci subsystem has a vulnerability due to improper validation of the capability element length in controller responses. hci_read_codec_capabilities() only checks the payload length but does not account for the length byte, allowing out-of-bounds read. The fix validates the full element size including the length byte.

In the Linux kernel, the RDMA/mlx5 driver has an undefined shift of user RQ WQE size. set_rq_size() computes the size as "1 << rq_wqe_shift" based on user-provided value, which is only checked to be greater than 32, so shifts of 32 are still accepted. A shift of 31 also overflows a signed integer, leading to undefined behavior. The fix uses check_shl_overflow() to compute the size and rejects invalid values.

In the Linux kernel, the RDMA/mlx5 driver has a bug where it frees the software-provided UAR index instead of the hardware-provided one. The fix is to free the UAR index returned by the hardware.