CVE Vulnerability Catalog

In the Linux kernel, in the netfilter/ipset module, kfree_rcu() was called before rcu_assign_pointer() when handling the comment extension, which is incorrect order. The order was fixed so that rcu_assign_pointer() is called first.

In the Linux kernel, in the netfilter/ipset module, when destroying a set, cancel_delayed_work_sync() was called while gc unconditionally calls queue_delayed_work(), which can prevent proper shutdown of gc. This was fixed.

In the Linux kernel, in BPF, there is an effective prog array index error with BPF_F_PREORDER. replace_effective_prog() and purge_effective_progs() located the slot in the effective array by walking the program hlist and counting entries linearly, which does not match the array layout when a preorder program is present.

In the Linux kernel BPF mechanism, during cleanup of dead stack slots in 4-byte halves, when the high half of a STACK_SPILL slot is dead and the low half remains live, converting the low half to STACK_MISC or STACK_ZERO clears the spilled_ptr metadata. This is safe only for scalar spills, but for pointer spills it allows a later 32-bit fill from the live half to bypass the normal non-scalar register-fill check and be treated as an ordinary scalar stack read. The fix leaves non-scalar spill slots intact in this half-live shape, which is conservative for pruning and preserves the existing rejection path for partial fills from pointer spills.

In the Linux kernel ice driver, there is a resource leak of CTRL VSI when resetting all VFs with FDIR filters enabled. The ice_reset_all_vfs() function only invalidates CTRL VSIs but does not free them, leading to resource leak. The fix uses ice_vf_ctrl_vsi_release() instead of ice_vf_ctrl_invalidate_vsi(), aligning with the behavior of ice_reset_vf().

In the Linux kernel BPF mechanism, conntrack lookup and allocation kfuncs take an opts pointer and an opts__sz argument. The verifier checks only the memory range described by opts__sz, but the wrappers unconditionally write opts->error whenever the internal helper returns an error. For an invalid size smaller than the end of opts->error, that write can land outside the verifier-checked range. The fix keeps returning NULL for invalid arguments, but only reports the error through opts->error when the supplied size includes the field.

A race condition was found in the Linux kernel's md/raid5 subsystem during stripe batch breaking. The issue involves R5_Overlap flag operations, potentially causing a process to hang (wait_on_bit) due to a missed wake-up. The fix expands the protected zone and reorders batch_head pointer updates to prevent concurrent access.

A vulnerability was found in the Linux kernel's netfilter nf_nat module, involving the use of an invalid nat_net pointer after a failed nf_nat_init(). This leads to an out-of-bounds read (slab-out-of-bounds), which could be exploited by a local user to cause a system crash or potentially escalate privileges.

A vulnerability in the Linux kernel's netfilter (nf_conncount) causes incorrect packet drops for valid connections when using connlimit in soft-limiting scenarios. The issue occurs when a new connection reuses a socket in TIME_WAIT state, where the connection tracking entry is mistakenly treated as confirmed, leading to a zeroed active connection count and false rejection of traffic. The fix replaces the loopback interface check with protocol-agnostic state checks (IPS_ASSURED), allowing early-confirmed setup packets to be properly evaluated and counted.

In the Linux kernel, the nft_compat layer fails to reject non-bridge targets in ebtables emulation. xtables targets return verdicts incompatible with ebtables, which may lead to incorrect behavior.

In the Linux kernel, the ge_put_enum_double() function in ASoC SDCA lacks validation of the index value before use. This may lead to an out-of-bounds read of the values buffer.

In the Linux kernel, the DSA driver mxl862xx has a use-after-free of DSA ports in crc_err_work. The work may run after ports are freed, leading to dereferencing freed memory.

In the Linux kernel, in the octeontx2-af subsystem, an incorrect condition checking whether any LFs (Logical Functions) have been assigned to a PF/VF was fixed. The patch addresses validation of the maximum number of LFs set via the devlink command.

In the Linux kernel, the mvneta driver (Marvell Armada 370/XP/38x) has a vulnerability causing permanent masking of per-CPU interrupts after resume from suspend. If suspend occurs while NAPI poll is pending, the interrupt is never re-enabled, leading to complete loss of network connectivity.

In the Linux kernel, in the sungem subsystem, a double-free of resources during error handling in gem_init_one() was fixed. Previously, when register_netdev() failed, gem_remove_one() was called, and then the same resources were freed again, leading to a double-free.

In the Linux kernel, in the udp_tunnel subsystem, a vulnerability was fixed involving double queueing of work in udp_tunnel_nic_device_sync, leading to a use-after-free. The fix involves returning early if the work_pending flag is already set.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's TIPC UDP media bearer. The cleanup_bearer() function destroys the dst_cache before synchronizing with RCU readers, which can lead to system crashes or rcuref warnings. Additionally, freeing the ub structure after synchronize_net() without closing the socket first leaves a window for UAF for concurrent receivers.

In the Linux kernel, seg6_validate_srh() lacks a minimum length check before reading fixed SRH fields. The BPF SEG6 encap path can supply a too-short buffer, leading to an out-of-bounds read.

In the Linux kernel's hwmon subsystem (pmbus/core), pmbus_data2reg_vid() always uses VR11 encoding, ignoring the configured vrm_version. This can lead to sending wrong codes to PMBUS_VOUT_COMMAND, resulting in incorrect voltage.

In the Linux kernel's hwmon subsystem (pmbus), regulator events are passed to the regulator core as a combined bitmask. If multiple distinct faults occur, the mask does not match any case in regulator_handle_critical(), bypassing the critical hardware protection trigger.