CVE Vulnerability Catalog

A bug in the Linux kernel's x86 alternatives patching code can cause a kernel crash (BUG_ON) in __text_poke. This occurs when vmalloc_to_page() fails due to a race between text poking and change_page_attr (CPA), particularly when CONFIG_ARCH_HAS_EXECMEM_ROX=y and modules share a single execmem range and call set_memory_*() in parallel. The fix excludes this race by using the init_mm mmap read lock.

A race condition exists in the Linux kernel's __slab_try_return_freelist() function in mm/slab. The function incorrectly assumed that if freelist is NULL and cmpxchg succeeds, no other CPU has freed an object to the slab, leading to a classic ABA problem and list corruption. This results in a kernel panic and denial of service (DoS).

In the Linux kernel, the IPv6 subsystem has a use-after-free vulnerability in the fib6 walker iterator during sequence stop. A walker can be moved to the FWS_U state, which is incorrectly treated as unlinked, leading to the seq object being freed while still on the fib6_walkers list, and later route deletions use the freed walker.

In the Linux kernel, the ipmr subsystem lacks memory accounting for multicast tables and routes. A netadmin in a user+net namespace can create many multicast routing tables that are not charged to memcg, leading to uncontrolled growth of unreclaimable slab memory.

A use-after-free race exists in the Linux kernel around the global cad_pid pointer. proc_do_cad_pid() and kill_cad_pid() use cad_pid without protecting the lifetime of the referenced struct pid, so a concurrent writer can drop the final reference to the old struct before the reader finishes dereferencing it. The fix treats cad_pid as an RCU-protected pointer and waits for a grace period before dropping the old reference.

A use-after-free flaw exists in the Linux kernel ftrace subsystem during process forking. The function graph state is initialized too late — after copy_exec_state() — so if the task_exec_state allocation fails, free_task() releases the parent's return stack (ret_stack), which the parent then accesses as freed memory.

A vulnerability exists in the Linux kernel tracing subsystem related to the '.stacktrace' histogram modifier. parse_field() sets HIST_FIELD_FL_STACKTRACE before resolving the field name, and create_hist_field() selects HIST_FIELD_FN_STACK based solely on the field pointer, without verifying that the field actually holds a stacktrace. This leads to unbounded copying and memory corruption (out-of-bounds read/write) during event processing.

A use-after-free vulnerability was found in the Linux kernel tracing histogram mechanism. hist_register_trigger() registers the trigger on the global named_triggers list before setting the trace clock, so an unknown clock name fails after registration, causing the object to be freed without removal from the list and later read after free.

A vulnerability in the Linux kernel tracing subsystem allows memory corruption via a "STACKTRACE" histogram key. The field is passed as non-NULL to create_hist_field(), causing an untrusted offset and length to be read and an unbounded memcpy to occur. This can result in a general protection fault and kernel panic.

A use-after-free vulnerability exists in the Linux kernel tracing subsystem. When opening a tracer options file, a race condition can cause the topts array element to be freed by removal of the trace_array instance before it is used to increment the reference counter. This can lead to use of freed memory.

In the Linux kernel, the tracing enable_event trigger deferred trace_event_put_ref() to the trigger free kthread, but the associated trace_event_file could already be freed when the instance was removed. This led to a use-after-free. The fix keeps the trace_event_call directly in enable_trigger_data so the deferred free does not access the freed trace_event_file.

In the Linux kernel, the ALSA us122l driver did not clear the VM_MAYWRITE flag for read-buffer mappings created with PROT_READ. A process with O_RDWR access to the hwdep node could later use mprotect() to make the mapping writable, then modify the read_size field and access pages beyond the allocation. The fix clears VM_MAYWRITE for read-buffer mappings.

In the Linux kernel, the ALSA usbusx2y driver has a size mismatch between the in04_last array (char[24]) and the in04_buf buffer allocated as 21 bytes (sizeof(struct us428_ctls)). In i_usx2y_in04_int(), 24 bytes are copied from a 21-byte allocation, reading 3 bytes past the end of the object. The fix introduces a USX2Y_IN04_SIZE constant and uses it consistently.

In the Linux kernel, the ALSA usbusx2y driver's i_usx2y_in04_int() processes URB data without checking urb->actual_length. A short transfer from a malfunctioning device causes the handler to process uninitialized heap data from in04_buf, which is then copied to the mmap-accessible ctl_snapshot[] array. The fix uses kzalloc() and adds an actual_length check.

In the Linux kernel, the drm/amdgpu driver performs an unnecessary VMID 0 flush for clear-on-release operations on VRAM even though it does not program a GART window. On GFX11 chips (e.g. Navi33) this spurious SDMA flush can wedge the engine. The fix only flushes when a GART window is actually used.

In the Linux kernel, the UFS filesystem installed sb->s_root before loading cylinder group structures for a writable mount. When loading failed, the error path freed superblock info and set sb->s_fs_info to NULL while sb->s_root remained, causing a NULL dereference during teardown. The fix loads cylinder group metadata first and creates the root dentry last.

In the Linux kernel, the UFS filesystem copied the cylinder group index and rotor positions from disk without validation, then used them as indices during allocation and free. A crafted image could set arbitrary values, causing writes outside the s_csp allocation or bitmap scans far past the cylinder group buffers. The fix rejects cylinder groups with mismatched index or out-of-group rotors.

A race condition in the Linux kernel during broadcast device replacement can lead to using a detached device, potentially triggering a BUG() in tick_cleanup_dead_cpu() when the last CPU in a restricted interrupt affinity mask goes offline.

In the Linux kernel, the tracing/user_events mechanism destroyed an event's fields before attempting to remove the trace event call. If removal failed (e.g. returning -EBUSY), the event remained registered with an irreversibly destroyed field list, leading to operations on an empty field list. The fix moves field destruction after call removal and restores the field list on failure.

In the Linux kernel, create_var_ref() allocates a VAR_REF hist_field and then calls init_var_ref(). When initialization fails, the field is leaked because destroy_hist_field() returns early for HIST_FIELD_FL_VAR_REF and the field has not yet been added to the var_refs[] array. The fix calls __destroy_hist_field(), which frees the field without consulting the flag.