CVE Vulnerability Catalog

In the Linux kernel, the cls_u32 (net/sched) module has a flaw where gen_new_kid() returns max (htid | 0xFFF) when the ID pool is exhausted instead of reporting an error. This causes u32_change() to insert a new knode with a handle already live in the hash table, breaking handle uniqueness. A similar silent failure exists in gen_new_htid(), which returns 0 when the tp_c handle pool is full, causing root hash tables with handle 0 to alias.

In the Linux kernel, the ip_sf_list structure in IGMP was converted to RCU. This fix eliminates a potential deadlock and lockdep warnings that occurred when ip_check_mc_rcu() tried to acquire a lock already held on the same CPU.

In the Linux kernel, a bug in ip6_mc_del1_src() related to RCU lists in IPv6 multicast was fixed. Previously, when a source filter was removed, the pointer was mutated before the grace period, which could cause concurrent readers to see the tombstone list instead of the proper source list.

In the Linux kernel, ip6_mc_source() in IPv6 multicast was changed to use copy-on-write RCU updates. Previously, modifications to the source filter list were done in-place, which could lead to torn IPv6 addresses or duplicated/missed entries for concurrent readers.

In the Linux kernel, several places in IPv6 multicast where RCU-protected lists were updated without rcu_assign_pointer() were fixed. The fix ensures consistent use of rcu_assign_pointer() along with appropriate dereference helpers.

In the Linux kernel, a vulnerability in the TIPC module was fixed where exceeding the TIPC_MAX_PUBL (65535) limit of local service publications prevented protocol service types (node state, link state) from being inserted into the name table. This caused missing event notifications and a NULL pointer dereference in tipc_named_node_up() when the publication list was empty.

In the Linux kernel, a problem in TIPC where random pad bytes were sent in RESET/ACTIVATE messages was fixed. Previously, strcpy() was used, which could send random data from the skb buffer to the remote system. Now memcpy() is used, which copies zeroed pad bytes.

In the Linux kernel, a problem in IPv6 Segment Routing where the network header was not properly restored before routing and forwarding was fixed. Previously, when the SRH did not immediately follow the IPv6 header, the network offset could be negative, potentially leading to buffer overflows during forwarding.

In the Linux kernel, tpacket_parse_header() in the af_packet subsystem cast the user-provided tpacket_hdr.tp_len (u32) to int. A value larger than INT_MAX became negative, passed the size check, and was returned up to sock_sendmsg_nosec(), triggering BUG().

In the Linux kernel, the fbtft staging driver's dirty_lock was not IRQ-safe. fbtft_mkdirty() can be reached from the fbcon rendering path in hardirq context, while fbtft_deferred_io() takes the same lock in workqueue context with local interrupts enabled, leading to a possible lock inversion and deadlock.

In the Linux kernel, the ASoC fsl_micfil driver's hw_params() and hw_free() enabled and disabled the mclk clock without balancing. The PCM core does not guarantee 1:1 pairing, so hw_free() can run without hw_params(), and hw_params() can be called multiple times, causing an "already disabled" warning or an enable reference leak.

In the Linux kernel, the ASoC amd yc driver's acp6x_pdm_dma_close() does not free the runtime->private_data buffer allocated in acp6x_pdm_dma_open(). The missing kfree causes a memory leak.

In the Linux kernel, in the btrfs filesystem, when creating the first metadata chunk for a sprout filesystem, create_chunk() adds the new device to the transaction dev_update_list. If the subsequent system chunk creation fails, btrfs_init_new_device() aborts the transaction and releases the device while post_commit_list is still linked, causing a warning and leaving the transaction list referencing freed memory.

In the Linux kernel, in the btrfs filesystem, btrfs_init_new_device() switches latest_dev and possibly s_bdev from the seed device to the new sprout device before creating the first writable chunks. If chunk creation or the subsequent sprout setup fails, the error path releases the new device without switching those pointers back, so btrfs_show_devname() can dereference the freed latest_dev and crash.

In the Linux kernel, the bonding module (alb mode) function alb_determine_nd() uses icmp6_hdr(skb) to inspect ICMPv6 headers, but in transmit paths (e.g. packets sent via AF_PACKET / raw sockets or forwarded packets) skb->transport_header is not guaranteed to be initialized. pskb_network_may_pull() does not set the transport header offset, so dereferencing icmp6_hdr(skb) can access out-of-bounds memory.

In the Linux kernel, the scsi mpt3sas driver's _base_assign_reply_queues() calls cpumask_of_node() with the value returned by dev_to_node(), which can be NUMA_NO_NODE (-1) on systems without NUMA topology information for the PCI device. Passing -1 to cpumask_of_node() causes an out-of-bounds array read of node_to_cpumask_map[-1], caught by UBSAN.

In the Linux kernel, a bug in the real-time scheduler (sched/rt,dl) causes RT tasks with migrate_disable() to remain on the pushable tasks list (rq->rt.pushable_tasks) even though they cannot be moved to another CPU. As a result, the RT balancer repeatedly attempts to push such a task, fails every time, and wastes CPU time — in the described case, 37 ms out of an 89 ms window was consumed by failed push attempts.

In the Linux kernel, in the ALSA ump subsystem, snd_ump_parse_endpoint() sets ump->parsed on every exit, including error, before the caller attaches the legacy rawmidi device. ump_handle_ep_name_msg() then treats parsed as "legacy_rmidi is live" and calls ump_legacy_set_rawmidi_name(), which snprintf()s into ump->legacy_rmidi->name. If a UMP packet arrives in that window (IRQ path from snd_ump_receive), legacy_rmidi is still NULL, causing a null-ptr-deref in snprintf.

In the Linux kernel, the precision backtracking mechanism for BPF_LD | BPF_{IND,ABS} instructions did not handle the implicit exit from a subprogram. This caused backtracking to continue in the caller frame while processing instructions in the callee frame, leading to segmentation faults or unsound state pruning.

In the Linux kernel, the precision backtracking for bpf_loop() calls had a bug: on the second visit of the call, the precision of register R1 (loop counter) was reset by processing the preceding BPF_EXIT. This resulted in injecting a checkpoint without R1 marked as precise, potentially allowing the verifier to accept unsafe programs.