CVE Vulnerability Catalog

In the Linux kernel, the BPF verifier incorrectly inferred that a pointer with an unbounded offset is non-NULL based solely on its type. As a result, a BPF program could pass verification while a NULL pointer dereference occurred at runtime.

In the Linux kernel, the BPF verifier could resurrect a scalar id dropped by collect_linked_regs() because snapshots of compared registers were taken before linked registers were collected. This could lead to range inconsistencies and precision propagation issues.

In the Linux kernel, the BPF verifier incorrectly predicted the outcome of pointer vs zero comparisons in JMP32 instructions, failing to distinguish BPF_JMP from BPF_JMP32 comparisons. This led to incorrect inference that a jump is always taken.

In the Linux kernel, the BPF verifier did not mark the zero register as precise for a register-form NULL check. As a result, one path was pruned and the program could dereference a zero pointer at runtime.

In the Linux kernel, the BPF verifier did not require the MEM_PERCPU flag for stores to percpu kptr fields, accepting both plain bpf_obj_new() allocations and kernel pointers. This could lead to arbitrary kernel read/write or invalid address relocation.

In the Linux kernel, the BPF verifier incorrectly classified borrowed RCU kptr references as owning references, thus not requiring a NULL check. At runtime refcount_inc_not_zero() could return NULL while the verifier treated the result as non-NULL.

In the Linux kernel, the BPF verifier treated PTR_UNTRUSTED pointers with the MEM_ALLOC flag as live allocated objects even though their lifetime is no longer protected. The bpf_refcount_acquire() function could then dereference NULL or stale memory.

In the Linux kernel, rhtab_map_update_elem() reinitialized special fields in recycled map elements, clearing the only pointer to a timer. As a result, the timer could fire with its key and value pointing into freed memory.

A vulnerability in the Linux kernel BPF subsystem related to rhtab maps was fixed. The functions rhtab_map_update_existing() and rhtab_delete_elem() called bpf_obj_free_fields(), which could be unsafe in NMI context. The fix uses bpf_obj_cancel_fields() to cancel only asynchronous fields, leaving referenced kptr release to the allocation destructor.

A vulnerability in the Linux kernel BPF verifier regarding stores to kptr fields was fixed. The function check_map_kptr_access() allowed a scalar store into an untrusted kptr field only when the register was known to be zero, but did not mark that register as precise. This could allow bypassing the verifier and writing attacker-controlled data into the kptr field.

A vulnerability in the Linux kernel BPF subsystem regarding inner map identity in callback frames was fixed. Callback frame constructors cleared the map_uid field, preventing distinction between inner maps sharing an inner_map_meta template. This could lead to use-after-free of a map.

A vulnerability in the Linux kernel tracing subsystem regarding subbuffer resize races was fixed. Concurrent subbuffer resizes could crash trace_pipe_raw readers or leak uninitialized memory to userspace. The fix modifies ring_buffer_alloc_read_page() and adds a new ring_buffer_read_page_size() function.

A vulnerability in the Linux kernel nexthop subsystem regarding uninitialized extack in remove_nh_grp_entry() was fixed. The function prints an extack message when a listener fails to replace the reduced nexthop group, but extack is not initialized, leading to dereference of an uninitialized stack pointer.

A vulnerability in the Linux kernel DSA bcm_sf2 driver regarding unbounded CFP rule dump by caller's buffer size was fixed. The function bcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap without consulting nfc->rule_cnt, allowing out-of-bounds access. The flaw is reachable without CAP_NET_ADMIN.

In the Linux kernel, the nfp ethernet driver dumps ntuple rules into a caller-provided buffer without checking its size. nfp_net_get_fs_loc() writes every entry of nn->fs.list into rule_locs[] while ignoring cmd->rule_cnt, so a user without CAP_NET_ADMIN can call ETHTOOL_GRXCLSRLALL with fewer slots than there are rules and run past the allocation; a rule_cnt of 0 leaves a NULL pointer that gets dereferenced.

In the Linux kernel, the nfp ethernet driver fails to drop a replaced rule from the list when reprogramming fails. nfp_net_fs_add() deletes the old rule from hardware and decrements nn->fs.count, but if nfp_net_fs_add_hw() fails the old entry stays on nn->fs.list, so the list is one longer than the counter and still advertises a rule whose hardware entry was already torn down.

In the Linux kernel, the DSA mv88e6xxx driver dumps policy rules into a caller-provided buffer without checking its size. mv88e6xxx_get_rxnfc() uses rxnfc->rule_cnt as the write index, clobbering the input value that indicates how many slots the caller had room for, so a user without CAP_NET_ADMIN can call ETHTOOL_GRXCLSRLALL with fewer slots than there are rules and run past the allocation; a rule_cnt of 0 leaves a NULL pointer that gets dereferenced.

In the Linux kernel, the bridge multicast code improperly converts mglist to RCU. br_multicast_del_port_group unlists the port group without the proper RCU helper that preserves the next pointer and then immediately frees the port group without waiting for an RCU grace period; the only RCU walker of mglist, br_multicast_list_adjacent(), has always been buggy because mglist was never properly converted to RCU.

A heap overflow vulnerability was found in the Linux kernel's cx82310_eth USB driver. When a device sends a URB starting with the 0xffff reboot sentinel, the driver bypasses the MTU check and copies up to 4094 bytes of device-supplied data into a 1516-byte buffer, corrupting memory and delivering a malformed frame to the network stack.

In the Linux kernel, the s390/ism driver frees memory with the wrong function after an error. dmb->cpu_addr was allocated via folio_alloc(), but the error exit of ism_alloc_dmb() uses kfree() instead of folio_put(), which can corrupt the slab allocator; dmb->cpu_addr should also be reset after folio_put to avoid future use-after-free.