CVE Vulnerability Catalog

In the Linux kernel, btf_var_show() unconditionally calls btf_type_id_resolve(), which dereferences btf->resolved_ids, which is NULL for a base BTF (e.g., vmlinux BTF). A BPF program passing a BTF_KIND_VAR type_id from vmlinux BTF to bpf_snprintf_btf() triggers a NULL dereference. The fix resolves the var's type directly with btf_type_skip_modifiers() when resolved_ids is NULL.

In the Linux kernel, the signal_generate and signal_deliver tracepoints declare their info argument as a struct kernel_siginfo pointer, so btf_ctx_access() treats it as a trusted pointer for tp_btf programs. However, signal delivery uses SEND_SIG_NOINFO (0) and SEND_SIG_PRIV (1) as special values that are not pointers. A tp_btf program can dereference these values and fault the kernel, and signal_generate can run from timer interrupt context, leading to a kernel panic.

In the Linux kernel, a tail call from a non-zero frame is modeled as a return from that frame, and the verifier makes R0 unknown and calls prepare_func_exit(). When the current frame is a synchronous callback, prepare_func_exit() enforces the callback return-value contract and marks R0 precise, triggering the "callback unexpected regs" verifier bug. A CAP_BPF task can cause a WARN and an -EFAULT BPF_PROG_LOAD. The fix rejects a tail call made directly by a callback.

In the Linux kernel, __bpf_rbtree_add() keeps parent and link pointers live across calls to the program-supplied comparison callback, so the verifier requires the root's lock to remain held throughout the callback. The helper path enforces this rule for bpf_spin_lock() and bpf_spin_unlock(), but the resilient lock kfunc argument path does not. A callback can release the root lock and let another CPU remove and free the node referenced by the in-progress tree walk, leading to use of freed pointers.

In the Linux kernel, do_wait() passes wo->wo_pid to the sched_process_wait tracepoint, but kernel_wait4() leaves wo_pid NULL for wait4(-1), and kernel_waitid_prepare() does likewise for waitid(P_ALL). btf_ctx_access() types argument 0 as PTR_TO_BTF_ID | PTR_TRUSTED without PTR_MAYBE_NULL, so the verifier accepts an unchecked dereference. Since trusted pointer loads have no fault protection, a wait for any child can cause a NULL pointer dereference in JITed BPF code. The fix marks argument 0 as nullable.

In the Linux kernel, bpf_sys_bpf() and bpf_sys_close() can sleep (e.g., via mutexes, GFP_KERNEL allocations, waiting for an RCU grace period), but they lack .might_sleep on their prototypes. They are limited to BPF_PROG_TYPE_SYSCALL, whose main program is sleepable, but a bpf_timer callback registered by a syscall program is checked in a non-sleepable context. Such a callback can invoke bpf_sys_bpf() from hrtimer softirq context and trigger a scheduling-while-atomic failure. The fix sets .might_sleep on both prototypes.

In the Linux kernel, the persistent ring buffer validation code used meta->nr_subbufs without ensuring it matched nr_pages + 1, assuming the two were the same. The fix adds a check in the validation code to ensure the saved nr_subbufs matches what is expected.

In the Linux kernel, nvme_scan_ns_list() drops stale namespaces in each gap of the reported NSID list one NSID at a time, calling nvme_find_get_ns() in each iteration. Since NSIDs are 32-bit, a sparse NSID space can make a single gap spin the loop billions of times with nothing to remove, leading to a soft lockup. The fix renames nvme_remove_invalid_namespaces() to nvme_remove_nsid_range() with an open (start, end) NSID range, bounding the work by the namespaces actually present.

In the Linux kernel, the ASoC Intel AVS driver's snd_hdac_ext_bus_get_ml_capabilities() may fail and its return code was not checked in avs_pci_probe(). Additionally, if a later part of avs_pci_probe() failed, the hlink list was not cleaned up before leaving the scope.

In the Linux kernel, the ASoC Intel AVS driver's strace_open() invokes try_module_get(), which on success takes a module reference. If any follow-up operation causes strace_open() to fail, the reference count is not released, resulting in an unbalanced state.

In the Linux kernel, the ASoC Intel AVS driver accesses entries in the init_configs array using indexes from the config_ids array, which are bounded by num_config_ids rather than num_init_configs. Using an ID greater than or equal to num_init_configs leads to an out-of-bounds access in avs_path_module_send_init_configs().

In the Linux kernel, the bcmasp network driver's bcmasp_xmit() only set txcb->last = true for the final fragment of an SKB, leaving the field untouched for non-final fragments. If a descriptor slot was reused while still holding a stale true from a previous SKB, bcmasp_tx_reclaim() could prematurely free the sk_buff while its remaining fragments were still in flight.

In the Linux kernel, the bcmasp network driver's tx_spb_ring_full() initialized next_index from intf->tx_spb_index on every loop iteration, so incr_ring() always produced the same result and only one slot was ever tested. This caused incorrect checking of consecutive descriptor slot availability before transmission.

In the Linux kernel, the mlxsw spectrum_ptp driver's PTP garbage-collection workqueue called napi_gro_receive() outside the NAPI poll context. This caused concurrent mutation of the NAPI GRO list by the GC workqueue and the NAPI thread on another CPU, leading to list corruption and a kernel panic. The fix introduces an ingress-delivery helper that uses netif_receive_skb() instead of napi_gro_receive().

In the Linux kernel's BPF subsystem, is_cmpxchg_insn() matches only BPF_MODE == BPF_ATOMIC, so an arena cmpxchg misses the required zero extension for a 32-bit operation. This can lead to incorrect values in the destination register on architectures requiring explicit zero extension.

In the Linux kernel's BPF subsystem, mark_fastcall_pattern_for_call() must ensure that a matched "spill; call; fill" instruction series is not interrupted by a jump. Otherwise the rewrite applied by bpf_remove_fastcall_spills_fills() is unsound. The fix records instructions targeted by jumps in insn_aux_data[*].jump_target and uses this flag to stop growing a pattern.

In the Linux kernel's BPF subsystem, in_rbtree_lock_required_cb() only checks the innermost verifier frame, so rbtree callback restrictions disappear in a nested static subprogram call frame. The subprogram can unlock the tree, remove and drop the node being compared, then relock, leading to freed memory being linked into the tree.

In the Linux kernel's BPF subsystem, bpf_btf_find_by_name_kind() returns a new BTF object fd through __btf_new_fd(), which reaches anon_inode_getfd() that can sleep while allocating or expanding the current task fd table. The helper prototype does not set might_sleep, so the verifier allows the helper in non-sleepable contexts such as BPF timer callbacks.

In the Linux kernel, a BPF verifier vulnerability affects stack helpers that may block on filesystem reads (e.g., resolving build IDs) but were not marked as sleepable. The verifier could still allow these helpers from non-sleepable regions such as RCU or preemption-disabled sections.

In the Linux kernel, the BPF verifier mishandled legacy packet-load instructions (BPF_LD_ABS/BPF_LD_IND) reached from callbacks, triggering a verifier bug warning and an -EFAULT on BPF_PROG_LOAD. A privileged program loader could trigger this issue.