CVE Vulnerability Catalog

A use-after-free vulnerability was found in the Linux kernel's netfs subsystem in netfs_read_gaps(), where a sink folio was released prematurely. This can lead to memory corruption and potential exploitation.

In the Linux kernel, a vulnerability was found in the cortina (Gemini Ethernet) network driver. A static local SKB buffer used for reassembling packets from fragments in gmac_rx() is shared between two Ethernet ports, potentially causing race conditions when both ports are used simultaneously.

In the Linux kernel, a vulnerability was found in the Cortina Ethernet driver where the fragment counter (frag_nr) is reset during packet reception in the gmac_rx() function. When the ring buffer is completely emptied during a poll cycle, the fragment counter is reset even though the packet is not yet fully assembled in the SKB, potentially causing incorrect packet reassembly.

In the Linux kernel, a vulnerability was found in the TLS implementation due to an off-by-one error when chaining wrapped sk_msg rings using sg_chain(). The chain pointer is placed at MAX_SKB_FRAGS instead of the last entry, potentially causing incorrect cryptographic operations.

A vulnerability in the Linux kernel's TLS implementation creates an invalid scatterlist chain when end=0 (start!=0), resulting in a chain-after-chain scenario. This passes illegal input to the crypto layer, potentially causing errors or security breaches.

In the Linux kernel's iwlwifi (MLD) driver, disabling AMSDU aggregation for a TID sets max_tid_amsdu_len to 1. The TSO segmentation path lacks a check for this sentinel value, resulting in zero gso_size, which generates over 32000 tiny frames from a single GSO skb. This floods the TX ring, causes massive TX completion events, memory corruption, and a use-after-free in TCP's retransmit queue.

In the Linux kernel, a vulnerability in the igc driver was found where the tx buffer type for SMD (Sashiko Mode Data) frames is not set. The igc_fpe_init_smd_frame() function initializes igc_tx_buffer fields but does not set the buffer type, which can cause TX completion to use the wrong cleanup path when buffers are reused, potentially affecting XDP or XSK transmissions.

In the Linux kernel's MANA driver, a TOCTOU (time-of-check time-of-use) vulnerability was found due to a double-fetch of the hwc_msg_id field from a DMA buffer. The first read is used for bounds checking, and the second for further processing, allowing a malicious device to alter the value between reads and bypass the validation.

In the Linux kernel RDMA/rtrs component, a use-after-free vulnerability was found in the error handling path of rtrs_srv_create_path_files(). Calling kobject_put() before destroying sysfs root folders can free memory that is later accessed, leading to a use-after-free condition.

In the Linux kernel, a vulnerability in the BPF skmsg mechanism was found where sk_psock_verdict_data_ready() does not check for a TLS RX context, causing a race condition with ktls reception. This can lead to a use-after-free condition during data processing.

A vulnerability in the Linux kernel's TCP implementation allows ISN (Initial Sequence Number) prediction for TIME_WAIT connections. The issue stems from storing the ISN in a per-CPU variable that is not cleared when a packet is dropped on various paths (e.g., min_ttl check, xfrm policy, MD5/AO mismatch, eBPF filter). The next SYN processed on the same CPU may receive a predictable ISN.

In the Linux kernel's MANA network driver, the rx_req_idx is not validated before being used to index the reqs[] array. In confidential VMs (SEV-SNP/TDX), DMA memory can be modified by hardware, allowing out-of-bounds array access.

In the Linux kernel's ksmbd filesystem, a vulnerability was found in the error path of durable reconnect handling. After a successful reconnect, a cleanup function may free the file object without removing it from the session ID table, leading to a use-after-free condition.

In the Linux kernel, a vulnerability was found in the netfilter synproxy module where synproxy_tstamp_adjust() uses a stale TCP header pointer after skb_ensure_writable(). This can cause writes to freed memory or sending packets with incorrect checksums.

In the Linux kernel, a vulnerability in the HSR (High-availability Seamless Redundancy) module allows out-of-bounds (OOB) access during supervision frame handling. The issue is due to insufficient length checking of the TLV header before use.

In the Linux kernel, a vulnerability was found in iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() functions, where network header pointers (ip_hdr, ipv6_hdr) were cached before a skb_cow() call that can reallocate skb->head. This can lead to a use-after-free (UAF) condition.

In the Linux kernel VXLAN driver, a vulnerability was found where a cached ip_hdr() pointer is reused after calling skb_tunnel_check_pmtu(), which can change skb->head. This leads to a Use-After-Free condition that can be exploited to compromise system security.

A vulnerability was found in the Linux kernel's iptunnel_pmtud_check_icmp() function, which can be called when the transport header in the socket buffer (skb) is not set. This causes an out-of-bounds memory access because the default value (65535) is used as an offset. The fix accesses the ICMP header based on the IPv4 network header.

A vulnerability was found in the Linux kernel's ipv6_rpl_srh_decompress() function for the IPv6 RPL protocol. The hdrlen calculation can overflow an unsigned 8-bit integer, leading to buffer overwrite and potential corruption of the routing header.

In the Linux kernel, a vulnerability in the net/handshake mechanism allows a race condition where handshake_req_next() removes a request before the accept side reads the socket file. A concurrent consumer can cancel the request and free the socket structure, leading to NULL pointer dereference or use-after-free.