CVE Vulnerability Catalog

In the Linux kernel's btrfs filesystem, there is a use-after-free vulnerability during RAID stripe insertion. If allocation of a RAID stripe extent fails, btrfs_insert_one_raid_extent() aborts and ends the transaction before returning -ENOMEM. The caller still owns the transaction handle and on error handling ends the transaction again, potentially leading to use-after-free.

In the Linux kernel's btrfs filesystem, there is a memory leak of the bioc structure on the bioc_list of an ordered_extent. The bug can occur during RAID extent insertion or when an ordered extent encounters an I/O error, causing the bioc to not be freed.

In the Linux kernel's btrfs filesystem (zoned mode), there is a bug in do_zone_finish(): if call_zone_finish() fails, the block group remains on the zone_active_bgs list, leading to reference leak, never waking waiters, and spinning in btrfs_zoned_activate_one_bg().

In the Linux kernel, a bug in the btrfs subsystem forces unnecessary reloc root creation during snapshot creation when qgroups (quota) are enabled. This triggers a kernel warning in lookup_inline_extent_backref and flips the filesystem to read-only mode. The issue is reproducible during balance/relocate operations on a btrfs filesystem with quota enabled.

In the Linux kernel's zstd compression for btrfs, there is a lost wakeup bug in zstd_get_workspace(). A writer can sleep forever even though a workspace is free, due to not re-checking the pool after prepare_to_wait().

In the Linux kernel's IPVS, there is a bug with reversed argument order in sequence serialization for version 1 sync. This leaves 24 bytes of the message unwritten, potentially disclosing stale heap data and replacing the live connection sequence state with values read from the buffer.

In the Linux kernel's netfilter nf_conntrack_sip module, there is an out-of-bounds read vulnerability in sip_skip_whitespace(). The function returns dptr unchanged when its loop exhausts the buffer, instead of NULL, leading to a read one byte past the buffer when a SIP header ends with spaces/tabs without a colon.

A use-after-free vulnerability exists in the Linux kernel's tracing/probes subsystem. Fields of a probe-based dynamic event (kprobe, uprobe, eprobe, fprobe) store pointers to argument name/type strings that are freed when the defining probe is removed, even though the event persists due to other probes. Any field lookup, such as setting a filter, then reads freed memory.

In the Linux kernel, a vulnerability in the BPF mechanism allows referencing the main program as a pseudo-function (BPF_PSEUDO_FUNC). Such an address is not properly rewritten, which can lead to a function call at a bogus address.

In the Linux kernel, a vulnerability in the bonding driver involves prematurely clearing the curr_active_slave pointer when releasing all interfaces. This can lead to a promiscuous mode leak on the physical device after bond teardown.

The Linux kernel has an issue in __dev_change_net_namespace() where conflicting alternative names (altnames) of network devices are not removed when changing network namespaces. This leads to a warning in cfg80211_pernet_exit() when removing a non-root namespace if two devices share the same altname. The vulnerability occurs when a device in init_net has a conflicting altname with a device in the dying namespace.

In the Linux kernel, release_in_xmit() in net/rds uses clear_bit_unlock() without a full memory barrier before checking waitqueue_active(). This can cause a lost wake-up for threads waiting in rds_conn_shutdown() and rds_tcp_reset_callbacks().

In the Linux kernel RDS subsystem, a data race was found in rds_conn_path_reset(), which clears the entire cp_flags word with a plain store while other operations use atomic bitops. This can lead to lost flag updates, destabilizing RDS connection management.

A vulnerability was fixed in the Linux kernel's net/rds module. The rds_tcp_reset_callbacks() function quiesced the transmit path by waiting for RDS_IN_XMIT to be sampled clear instead of taking the lock, which on weakly ordered architectures could allow the transmit path to run concurrently with the reset of cp_xmit_* state.

In the Linux kernel, a flaw was fixed in net/rds where rds_conn_shutdown() only sampled the RDS_IN_XMIT and RDS_RECV_REFILL flags as clear instead of acquiring their locks. On weakly ordered architectures, the transmit path could re-acquire the bit and run concurrently with connection teardown, causing a race and state corruption. The fix acquires both fastpath locks before transport shutdown and releases them after rds_conn_path_reset().

In the Linux kernel RDS subsystem, a vulnerability was found where rds_conn_shutdown() can consume a concurrent drop, leading to a wedged connection path in RDS_CONN_DOWN. The race between connection teardown and socket acceptance can leave sockets established but never torn down, causing receive queue growth and connection stalls.

A vulnerability was found in the Linux kernel's EROFS filesystem related to LZ4 decompression. The 'rolling decompression' optimization can lead to data corruption because the LZ4 implementation may copy literals backward, breaking the algorithm's assumptions. The vulnerability is fixed by temporarily disabling this optimization.

In the ALSA caiaq driver in the Linux kernel, a vulnerability involves a potential double-free during error handling. Resources such as URBs may be freed multiple times, leading to improper memory management.

A vulnerability in the Linux kernel BPF subsystem allows creating a hash map with key-less BTF (btf_key_type_id == 0). After htab and rhtab gained ->map_check_btf callbacks, validation no longer rejected such maps, leading to a NULL pointer dereference in btf_type_show() when the map is read via bpffs. This results in a kernel oops.

In the Linux kernel, btf_modifier_show() unconditionally calls show() for the resolved type, but for the void type (type_id 0, BTF_KIND_UNKN) there is no entry in kind_ops[], so the show pointer is NULL. A BPF program passing a "const void" type_id from vmlinux BTF to bpf_snprintf_btf() triggers a NULL dereference. The fix falls back to btf_df_show() with the "<unsupported kind:N>" placeholder.