CVE Vulnerability Catalog

A race condition was found in the Linux kernel's md/raid5 subsystem during stripe batch breaking. The issue involves R5_Overlap flag operations, potentially causing a process to hang (wait_on_bit) due to a missed wake-up. The fix expands the protected zone and reorders batch_head pointer updates to prevent concurrent access.

A vulnerability was found in the Linux kernel's netfilter nf_nat module, involving the use of an invalid nat_net pointer after a failed nf_nat_init(). This leads to an out-of-bounds read (slab-out-of-bounds), which could be exploited by a local user to cause a system crash or potentially escalate privileges.

A vulnerability in the Linux kernel's netfilter (nf_conncount) causes incorrect packet drops for valid connections when using connlimit in soft-limiting scenarios. The issue occurs when a new connection reuses a socket in TIME_WAIT state, where the connection tracking entry is mistakenly treated as confirmed, leading to a zeroed active connection count and false rejection of traffic. The fix replaces the loopback interface check with protocol-agnostic state checks (IPS_ASSURED), allowing early-confirmed setup packets to be properly evaluated and counted.

In the Linux kernel, the nft_compat layer fails to reject non-bridge targets in ebtables emulation. xtables targets return verdicts incompatible with ebtables, which may lead to incorrect behavior.

In the Linux kernel, the ge_put_enum_double() function in ASoC SDCA lacks validation of the index value before use. This may lead to an out-of-bounds read of the values buffer.

In the Linux kernel, the DSA driver mxl862xx has a use-after-free of DSA ports in crc_err_work. The work may run after ports are freed, leading to dereferencing freed memory.

In the Linux kernel, in the octeontx2-af subsystem, an incorrect condition checking whether any LFs (Logical Functions) have been assigned to a PF/VF was fixed. The patch addresses validation of the maximum number of LFs set via the devlink command.

In the Linux kernel, the mvneta driver (Marvell Armada 370/XP/38x) has a vulnerability causing permanent masking of per-CPU interrupts after resume from suspend. If suspend occurs while NAPI poll is pending, the interrupt is never re-enabled, leading to complete loss of network connectivity.

In the Linux kernel, in the sungem subsystem, a double-free of resources during error handling in gem_init_one() was fixed. Previously, when register_netdev() failed, gem_remove_one() was called, and then the same resources were freed again, leading to a double-free.

In the Linux kernel, in the udp_tunnel subsystem, a vulnerability was fixed involving double queueing of work in udp_tunnel_nic_device_sync, leading to a use-after-free. The fix involves returning early if the work_pending flag is already set.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's TIPC UDP media bearer. The cleanup_bearer() function destroys the dst_cache before synchronizing with RCU readers, which can lead to system crashes or rcuref warnings. Additionally, freeing the ub structure after synchronize_net() without closing the socket first leaves a window for UAF for concurrent receivers.

In the Linux kernel, seg6_validate_srh() lacks a minimum length check before reading fixed SRH fields. The BPF SEG6 encap path can supply a too-short buffer, leading to an out-of-bounds read.

In the Linux kernel's hwmon subsystem (pmbus/core), pmbus_data2reg_vid() always uses VR11 encoding, ignoring the configured vrm_version. This can lead to sending wrong codes to PMBUS_VOUT_COMMAND, resulting in incorrect voltage.

In the Linux kernel's hwmon subsystem (pmbus), regulator events are passed to the regulator core as a combined bitmask. If multiple distinct faults occur, the mask does not match any case in regulator_handle_critical(), bypassing the critical hardware protection trigger.

A vulnerability in the Linux kernel's net/sched sch_teql module involves missing synchronization of the teql master's slaves list, leading to race conditions and use-after-free (UAF) during concurrent queue operations. This can compromise memory integrity.

A use-after-free vulnerability was found in the Linux kernel's bridge subsystem related to STP. Missing IFF_UP check in br_topology_change_detection() allows arming the topology change timer while the bridge is administratively down, leading to use-after-free when the bridge is deleted.

In the Linux kernel's SCTP subsystem, a race condition was found in sctp_free_addr_wq() regarding the addr_wq_timer. Using timer_delete() does not guarantee that a currently running timer handler has completed, which can lead to use-after-free.

In the Linux kernel's ksmbd server, a vulnerability was found where undersized DACLs are not properly rejected before parsing ACEs. Due to an underflow in the calculation, a malicious client can bypass the ACE count limit and cause excessive memory allocations.

In the Linux kernel's xen/pvcalls driver, the request ID (req_id) from the backend is not validated before being used as an index into the rsp[] array. A malicious or buggy backend can set req_id out of bounds, leading to an out-of-bounds write. Additionally, the int type for req_id does not cover u32 values, allowing negative indexing.

In the Linux kernel, in afs_extract_vl_addrs(), error codes are only set on the first iteration of the loop. Subsequent iterations do not update them, which can lead to incorrect error reporting.