CVE Vulnerability Catalog

A vulnerability in the Linux kernel's VXLAN driver allows dynamic FDB entries to reference a nexthop ID, which is invalid and can lead to list corruption, race conditions, and use-after-free. The fix rejects such entries during creation and update.

In the Linux kernel, an unbounded tx_queue_len allowed an unprivileged user (via unshare -Urn) to set a huge value and exhaust global memory through ring buffer allocations in the pfifo_fast, tun, and tap subsystems. The vulnerability was fixed by capping tx_queue_len at S16_MAX (32767) in netif_change_tx_queue_len(), rejecting oversized values at set time.

A vulnerability was found in the Linux kernel's network interface creation and modification mechanism. The IFLA_TXQLEN attribute (txqueuelen) was not properly limited to S16_MAX during netlink parsing, allowing an oversized transmit queue length to be set. This led to excessive memory allocations in pfifo_fast, tun, and tap modules, which could be exploited by an unprivileged user in a namespace.

In the Linux kernel, the pds_core driver has a cmd_regs access race during BAR unmap on reset. pdsc_reset_prepare() and the pdsc_map_bars() error path in pdsc_reset_done() clear/iounmap cmd_regs without devcmd_lock, and the download loop in pdsc_legacy_firmware_update() dereferences cmd_regs after dropping and retaking the lock without re-checking; an FLR concurrent with a devlink flash can unmap cmd_regs under an in-flight devcmd, causing a NULL deref or a write to unmapped MMIO.

In the Linux kernel, the BPF verifier failed to mark the underlying scalar register as precise in two cases: when a helper argument is NULL (check_func_arg) and when the second parameter of bpf_get_local_storage() is zero (check_helper_call). As a result, a checkpoint created on such a path could be pruned against an arbitrary scalar value, leading to incorrect BPF program verification.

In the Linux kernel, mctp_i3c_probe() dropped busdevs_lock after finding the matching bus, allowing a concurrent I3C_NOTIFY_BUS_REMOVE to unregister and free the bus netdev before probe passed its private data to mctp_i3c_add_device(). This resulted in a use-after-free through the freed mbus pointer.

In the Linux kernel, an RTM_NEWQDISC request could make clsact bind a populated shared ingress block during ->init(), publishing an embedded mini_Qdisc to lockless readers. If the same request had an invalid TCA_RATE, estimator setup failed after ->init(), and the unwind synchronously freed the containing qdisc while tc_run() might still hold it, leading to a use-after-free.

In the Linux kernel, the net/mlx5e driver's sample_restore_put() could re-read restore->count after dropping restore_lock during concurrent teardown of TC sample rules sharing the same restore context. At that point another thread may have already completed cleanup and freed the restore object, leading to a use-after-free.

In the Linux kernel, mlx5_eswitch_termtbl_put() read tt->ref_count after termtbl_mutex was released. Two concurrent callers on the same mlx5_termtbl_handle raced: one decremented ref_count to zero, removed the hash entry, and called kfree(tt), while the other had already dropped the mutex and was about to evaluate if (!tt->ref_count), producing a use-after-free.

In the Linux kernel's mlx5 driver (E-Switch), a vulnerability leads to use-after-free and refcount underflow during FW-fatal recovery. The issue is in mlx5_esw_vport_disable(), where improper ordering causes mc_list repopulation during vport disable, corrupting the FDB sub-tree and leaving dangling flow_rule pointers.

In the Linux kernel, fq_pie_change() accepted any quantum value from userspace, including 1. With a crafted size table qdisc_pkt_len reached ~2 GiB, so quantum=1 made the deficit-refill loop spin ~2^31 times under the qdisc lock, causing a soft lockup and denial of service.

In the Linux kernel, sfq_change() accepted any non-negative quantum (only rejecting (int)ctl->quantum < 0). With a crafted size table qdisc_pkt_len reached ~2 GiB, so quantum=1 made the deficit-refill loop spin ~2^31 times under the qdisc lock, causing a soft lockup and denial of service.

In the Linux kernel, hhf_change() accepted any quantum value from userspace, including 1. With a crafted size table qdisc_pkt_len reached ~2 GiB, so quantum=1 made the deficit-refill loop spin ~2^31 times under the qdisc lock, causing a soft lockup and denial of service.

In the Linux kernel, drr_change_class() rejected explicit quantum==0 but otherwise fell back to psched_mtu() with no floor. With a crafted size table qdisc_pkt_len reached ~2 GiB, so quantum=1 (or a zero psched_mtu on a headerless device) made the deficit-refill loop spin under the qdisc lock, causing a soft lockup and denial of service.

In the Linux kernel, the ets network scheduler lacked a lower bound on the quantum value. With a crafted size table qdisc_pkt_len can reach ~2 GiB, and a zero psched_mtu on a headerless device makes the deficit-refill loop spin under the qdisc lock. The fix moves the floor into ets_quantum_parse() so explicitly configured quanta are also clamped to [256, 1<<20].

In the Linux kernel macb driver, when the device tree describes a fixed-link and has no "mdio" child node, macb_mii_init() returns early without allocating the MDIO bus, leaving bp->mii_bus as NULL. Two cleanup paths (driver unbind and probe error path) call mdiobus_unregister()/mdiobus_free() without a NULL check, causing an oops. The fix adds NULL guards in both places.

In the Linux kernel BPF subsystem, bpf_loop() declares its nr_loops argument as ARG_ANYTHING, allowing privileged programs to pass pointer values. Since commit bb124da69c47 the verifier marks R1 precise and reads its upper bound, but precision backtracking only accepts scalar registers, triggering a "backtracking misuse" warning and a panic when panic_on_warn is enabled. The fix introduces ARG_SCALAR and uses it for nr_loops.

In the Linux kernel, the ALSA caiaq driver has a use-after-free vulnerability. The ep1_in_urb (and midi_out_urb) object is embedded in the snd_usb_caiaqdev structure; when card initialization fails and snd_card_free() is called, the URB memory is freed while still in use by the dummy HCD driver, triggering a KASAN slab-use-after-free in usb_free_urb.

In the Linux kernel erofs filesystem, inode_share keys were encoded as fingerprint || domain_id without a separator, which could cause the fingerprint to be parsed as part of a domain ID. The fix changes the encoding to domain_id || '\0' || fingerprint, making in-memory key indices unambiguous.

In the Linux kernel iommu/riscv driver, command queue publishing was not serialized, potentially causing a race between producer state and hardware tail updates. The fix serializes publishing so software producer state advances only after a command is written and the hardware tail is updated, and waits for hardware consumption outside the queue lock when the queue is full.