CVE Vulnerability Catalog

In the Linux kernel's TCP for IPv6, the ip6_default_advmss() function can return IPV6_MAXPLEN (65535), which is interpreted as mss_clamp, allowing MSS to reach 65535. However, 0xFFFF is also used as a magic value GSO_BY_FRAGS, which can lead to a NULL pointer dereference during TCP packet segmentation.

In the Linux kernel's RDMA bnxt_re driver, the toggle page for SRQ is freed before firmware teardown completes, which could allow an NQ interrupt to write to an already-freed page. The fix moves the page free after bnxt_qplib_destroy_srq().

In the Linux kernel's RDMA bnxt_re driver, the toggle page for CQ is freed before firmware teardown completes, which could allow an NQ interrupt to write to an already-freed page. The fix moves the page free after bnxt_qplib_destroy_cq().

In the Linux kernel's RDMA bnxt_re driver, there is a missing max slot check for SQ. The WQE mode variable must be validated against the maximum slots supported by HW (max 64K). Added max and min checks to fail if user supplied value is more than max or zero.

In the Linux kernel, in the ksmbd module, same_client_has_lease() returns an opinfo pointer from ci->m_op_list after dropping ci->m_lock without taking a reference. This can lead to use-after-free during concurrent close. A reference is now taken and released after copying the lease state.

In the Linux kernel, in the staging nvec driver, nvec_rx_completed() has a use-after-free bug. After calling nvec_msg_free(), the code still reads nvec->rx->data[0], which may be overwritten by a concurrent nvec_msg_alloc() call. The fix saves the message type byte before freeing and uses the saved value.

In the Linux kernel, in the soundwire subsystem, the sdw_add_element_group_count function had an out-of-bounds memory access in the for-loop when i == num. The fix adds a check for existing rate/lane entries before adding them, with no functional changes apart from this fix.

In the Linux kernel, in the PCI subsystem, pci_get_rom_size can crash due to out-of-bounds access to ROM space or misaligned data structure address. Added checks for image header and data structure address, and alignment checking, to prevent crashes on x86_64 and arm64.

In the Linux kernel, the coresight platform subsystem has an issue where connection counters are incremented before successful memory allocation. If allocation fails, the counter remains incremented, and cleanup functions may dereference invalid pointers, causing a kernel panic. The fix moves counter increments after all allocations succeed.

In the Linux kernel, the USB host max3421 driver has a shift-out-of-bounds vulnerability in max3421_hub_control(). An untrusted userspace process can send a USBDEVFS_CONTROL request with wValue greater than or equal to 32, causing an out-of-bounds bit shift and corrupting port_status, including immutable bits. The fix rejects requests with a value exceeding the shift width.

In the Linux kernel, the gpib driver has a double decrement of the descriptor_busy counter in command_ioctl(). The error path inside the loop decrements the counter and breaks, but then an unconditional decrement after the loop occurs, causing an underflow. This re-enables the use-after-free that the original fix intended to prevent. The fix removes the early decrement from the error path.

In the Linux kernel, the iio: adc xilinx-ams driver has an out-of-bounds read vulnerability in ams_event_to_channel(). The function may return a pointer past the end of dev->channels when no matching scan_index is found, leading to invalid memory access in ams_handle_event(). The fix adds a bounds check and returns NULL when no channel is found.

In the Linux kernel, the NTFS3 filesystem has an out-of-bounds read vulnerability in run_get_highest_vcn(). The function parses a packed mapping-pairs buffer without any length bound, relying solely on a 0x00 terminator. A crafted $LogFile UpdateMappingPairs record can cause a read past the slab allocation, triggering a KASAN error during mount. The fix adds a run_buf_size parameter and rejects run headers whose payload would extend past the buffer end.

In the Linux kernel, the dma_release_channel() function has a use-after-free vulnerability. The privatecnt check occurs after calling dma_chan_put(), which may release the last reference to the device if the DMA provider is already gone, leading to memory free. The fix moves dma_chan_put() before the check.

In the Linux kernel, the NTFS3 filesystem has a vulnerability involving the use of an uninitialized variable lcn. When the sought VCN is not found in runs[0], run_lookup() returns false, leading to premature exit from attr_data_get_block_locked() without initializing lcn, triggering a KMSAN bug. The fix moves the clen check before the lcn check in ni_seek_data_or_hole().

In the Linux kernel's NTFS3 filesystem (fs/ntfs3), there is a buffer overflow vulnerability. During mounting of a dirty NTFS volume, log_replay() allocates one_page_buf using the host page size, then may adopt a larger on-disk page size from the restart area. If the on-disk page size is larger than the initial allocation, the buffer remains undersized, and a subsequent read of log->page_size bytes into it causes an overflow.

In the Linux kernel's xprtrdma subsystem, a vulnerability was found due to a kref imbalance when handling the ADDR_CHANGE event. If this event arrives before ESTABLISHED, an ep_put is called without a matching ep_get, leading to a kref underflow and use-after-free during disconnect.

In the Linux kernel's xprtrdma subsystem, a vulnerability exists where the reply credit grant is not sanitized before use. A malicious peer can send a reply with an unknown XID and an inflated credit, causing excessive allocation and posting of Receive WRs, exceeding the re_max_requests limit.

In the Linux kernel's xprtrdma subsystem, a vulnerability allows a remote peer to drain the client's posted Receive queue by sending a sustained stream of malformed replies (too short or with an unrecognized RPC/RDMA version). Each such reply consumes a posted Receive without replacing it, eventually stalling the transport until reconnect.

In the Linux kernel's AppArmor module, a race condition exists in Unix socket mediation when peer_path is used. Accessing the path outside the state lock allows a race with unix_release_sock(), potentially leading to use-after-free.