CVE Vulnerability Catalog

In the Linux kernel net/mlx5e driver, the vnic health reporter for representors was created and destroyed along the netdev (un)load path, not serialized by the devlink lock, causing a warning on unbind. The fix moves the reporter's lifecycle to the eswitch devlink port.

In the Linux kernel perf/core, list corruption of sched_cb_list is possible during event overflow processing when PMU calls perf_sched_cb_dec() during iteration. The fix changes for_each_list_entry() to for_each_list_entry_safe().

In the Linux kernel perf/x86/intel, drain_pebs() can be reentered, leading to out-of-bounds memory access. The fix disables the full PMU around intel_pmu_drain_pebs_buffer() and adds a warning when PMU is not disabled.

In the Linux kernel, the net/sched: cls_route module has a memory leak. When an existing route4 filter is moved to a different bucket, the old emptied bucket is never freed and remains in head->table[], preventing proper filter deletion and causing a leak of the empty tcf_proto.

A vulnerability was fixed in the Linux kernel's net/sched: cls_api. When a netlink socket repeatedly sends RTM_GETCHAIN requests without receiving responses, tc_ctl_chain() spins and consumes CPU, triggering a Hung Task. The issue was caused by unnecessary replay logic for RTM_GETCHAIN.

In the Linux kernel, the hinic driver has a heap buffer overflow in the mailbox segment validation. The last segment can carry a full 48-byte payload, causing a 16-byte write beyond the 2048-byte receive buffer. The fix limits the last segment length to the remaining buffer space.

In the Linux kernel, the net_failover driver has a deadlock in net_failover_slave_name_change(). Using dev_open() instead of netif_open() leads to a mutex deadlock. The fix changes the call to netif_open() to avoid the deadlock.

In the Linux kernel, the mana driver has an issue with the XDP program pointer. When RX buffer pre-allocation fails, mana_xdp_set() returns an error without restoring the previous pointer, leading to use-after-free. The fix restores the previous program on the error path.

In the Linux kernel, the RDS-TCP subsystem has TCP stream corruption with large pages. rds_message_map_pages() assigns full page size to each scatterlist entry, even when the last part is smaller, causing mapping beyond the end of the congestion map. The fix limits the last mapping to the remaining bytes.

In the Linux kernel, the stmmac driver has an issue with TX descriptor availability for TSO traffic. The estimation of free descriptors is inaccurate, potentially leading to writing past available descriptors and corrupting the TX ring. The fix adds a function to compute the exact number of descriptors needed.

In the Linux kernel, when __vdc_tx_trigger() fails inside sunvdc's __send_request(), the descriptor remains marked VIO_DESC_READY and the mapped pages (cookies) are never unmapped from the LDC channel's map table. Because the descriptor is never completed by the peer and dr->prod is not advanced, entries in the fixed-size map table (8192 per channel) are leaked permanently. With trigger failures occurring under load (notably after commit a11f6ca9aef9), every I/O error leaks entries, causing fragmentation, failure of large multi-segment requests, and eventually a dead disk until reboot.

In the Linux kernel, the iSCSI target subsystem has a hang for aborted WRITE_PENDING commands. When the initiator sends remaining dataout PDUs after abort, the target does not trigger completion, leading to a deadlocked worker thread. The fix calls target_complete_cmd() upon receiving the final dataout PDU.

In the Linux kernel, the configfs system has an issue with pinning the symlink target's dirent. create_link() reads the dirent from ci_dentry, which may be freed during a race with rmdir, triggering a WARN_ON. The fix pins the dirent in get_target() under d_lock.

In the Linux kernel, the configfs system has an issue with rmdir. configfs_rmdir() leaves the dentry hashed after dropping the item, leading to use-after-free in configfs_symlink(). The fix unhashes the dentry before dropping the item.

In the Linux kernel, the powerpc/eeh subsystem has a recursive locking issue when a device lacks an EEH-sensitive driver. A previous fix added the pci_rescan_remove_lock but did not remove the existing lock inside eeh_rmv_device(), causing the eehd thread to hang on a lock it already holds.

In the Linux kernel, the x86/amd_node subsystem has a potential NULL pointer dereference in __amd_smn_rw() when amd_smn_init() fails and 'amd_roots' remains NULL. The fix replaces the 'smn_exclusive' flag check with a direct check of 'amd_roots', simplifying logic and eliminating the risk.

In the Linux kernel, the x86/amd_node subsystem has a PCI device reference counting issue in amd_smn_init(). The fix uses the __free() cleanup macro to automatically decrement the refcount for the temporary pointer and increments the refcount when caching a root pointer, separating temporary from in-use references.

A vulnerability in the Linux kernel's pmd_modify() function on x86 causes loss of the dirty bit in PMDs for transparent huge pages (THP). This can lead to user data loss when MADV_FREE is used followed by writes, as reclaim may incorrectly free dirty pages. File-backed THPs are also affected, preventing writeback of modified data.

In the Linux kernel, the x86/cfi subsystem has a bug in cfi_get_func_hash() that reads the FineIBT hash from the wrong offset (7 instead of 5). This causes BPF struct_ops trampolines to receive an incorrect hash, leading to a CFI failure on the first indirect call.

A vulnerability was found in the Linux kernel's x86 CPA (Change Page Attributes) mechanism. During the collapse of page table entries into huge pages, page tables are freed without holding relevant locks, leading to a potential use-after-free (UAF) when concurrent operations like ptdump walk the page tables.