CVE Vulnerability Catalog

In the Linux kernel, the cortina ethernet driver has a bug in NAPI budget accounting. The gmac_rx() function returns the remaining NAPI budget, but its caller treats the return value as the number of packets received. An idle poll therefore reports a full budget and remains scheduled. The fix returns the number of received packets instead.

In the Linux kernel, the cortina ethernet driver has a bug in NAPI budget accounting for dropped frames. The RX loop only consumes budget when it successfully delivers a frame; error paths keep consuming descriptors without reducing the budget, potentially processing the entire receive ring in one poll. The fix moves budget accounting to a common end-of-frame path.

In the Linux kernel, the s390/debug subsystem has a NULL pointer dereference in debug_set_level(). Commit a2cec6863709 removed a null-id check from debug_set_level(), introducing a possible NULL pointer dereference for debug-API users that put debug_register() results unchecked into debug_set_level(). The fix moves the check back to the external wrapper.

A memory leak was found in the Linux kernel's Intel ICE network driver. The missing xa_destroy call for the sched_node_ids structure can cause memory leaks even after all elements are removed. The fix moves the structure to the hw struct and adds proper cleanup.

In the Linux kernel, the ice network driver has a double dereference in the TP_printk() function of the ice_tx_dim_work trace event. After new checks were added to the tracing subsystem, dereferencing pointers at print time can lead to use of invalid data because the pointers may be stale. The fix copies eight scalar values into the event instead of storing pointers.

In the Linux kernel, the Bluetooth btusb driver has a use-after-free (UAF) vulnerability related to the asynchronous rx_work. btusb_close() and btusb_flush() cancel rx_work asynchronously, so if btusb_rx_work() is already running on another CPU, it may continue after cancellation. After device disconnect, btusb_data is freed, and the running work may access freed memory. The fix uses cancel_delayed_work_sync() instead of asynchronous cancellation.

In the Linux kernel, the Bluetooth btintel_pcie driver lacks validation of the packet_len field before using it in skb_put_data(). The function btintel_pcie_submit_rx_work() reads packet_len from the rfh_hdr header without checking if it exceeds the RX buffer size. An oversized packet_len can lead to an out-of-bounds read in skb_put_data(). The fix adds validation to ensure packet_len is non-zero and does not exceed the buffer size.

A race condition exists in the Linux kernel between hci_conn_del_sysfs() and concurrent unregistration of a child device (e.g., a BNEP network device in bnep_session). During unregistration, device_del() uses a stale parent pointer, leading to a NULL pointer dereference in klist_put(). The issue is fixed by holding an explicit reference to the parent device (get_device/put_device) and restoring the __match_tty filter.

A null-ptr-deref vulnerability exists in the Linux kernel's IPv6 __ip6_del_rt_siblings() function. When deleting a route (inet6_rtm_delroute) without the RTNL lock, another thread can modify the routing table and set rt->fib6_node to NULL, leading to a NULL dereference and kernel crash.

In the Linux kernel, the macb network driver has a phylink instance leak on the probe error path. The macb_mii_init() function creates a phylink instance on both success paths, but the probe unwind frees the netdev without destroying the instance, leading to memory leak. The fix destroys the phylink instance at the appropriate location.

In the Linux kernel, the macb network driver has a reference leak to the 'mdio' child node in the device tree. The macb_mii_init() function holds the reference returned by of_get_child_by_name() for macb_mdiobus_register() and drops it only on error paths, causing a reference leak on every successful probe. The fix drops the reference after registration, where __mdiobus_register() has already taken its own.

A flaw was found in the Linux kernel's namespace listing mechanism (listns), where legitimize_ns() takes a reference on the namespace before may_list_ns() checks permissions. On the denied path, dropping the last reference to a mount namespace occurs inside an RCU read-side critical section, which can sleep there and trigger a kernel warning.

In the Linux kernel, the msc313e watchdog driver has a division by zero vulnerability. The function clk_get_rate() can return 0, leading to division by zero and kernel panic. The fix adds a check to avoid division by zero.

In the Linux kernel, the msc313e watchdog driver has two severe bugs in the settimeout() function: clock leak and spurious timer start. The function msc313e_wdt_settimeout() unconditionally calls msc313e_wdt_start(), which increases the clock reference count when the watchdog is already active, and starts the timer when the watchdog is stopped. The fix factors out the register-writing logic into a helper and calls it only if the watchdog is running.

In the Linux kernel hwmon corsair-cpro driver, debugfs entries were created before hwmon device registration. If registration failed, the entries remained, and after HID core freed the memory, reading one of them caused a use-after-free. The fix moves debugfs creation after hwmon registration.

In the Linux kernel hwmon corsair-cpro driver, when hwmon device registration failed, debugfs entries were not removed, leading to use-after-free when reading them. The fix adds debugfs removal on the error path.

In the Linux kernel octeontx2-pf driver, during HTB hierarchy teardown, scheduler queues were freed without clearing TOPOLOGY settings, which could affect later allocations. The fix adds functions to reset TOPOLOGY before returning queues to the AF.

In the Linux kernel, the vxlan_xmit_one() function in the VXLAN driver has an uninitialized stack variable _md when a VXLAN device has both VXLAN_F_COLLECT_METADATA and VXLAN_F_GBP enabled, and the transmitted packet lacks the IP_TUNNEL_VXLAN_OPT_BIT flag. This leads to reading garbage from the stack, which can spuriously set flags in the VXLAN header and leak 16 bits of uninitialized kernel data onto the wire.

In the Linux kernel ppp_synctty driver, ppp_sync_txmunge() did not ensure the skb header was writable, which could overwrite data visible to other sockets. The fix uses skb_cow_head() to ensure a writable header.

In the Linux kernel net: stmmac driver, ptp_lock was initialized only during PTP registration, but used also when the interface is down, leading to undefined behavior. The fix moves initialization to __stmmac_dvr_probe().