CVE Vulnerability Catalog

A vulnerability in the Linux kernel's memory cgroup (memcg) mechanism causes OOM-killed processes to get stuck in the exit path for hours. The issue occurs when the oom_reaper fails to free the process memory (setting MMF_OOM_SKIP), and dying threads still attempt to swap in pages from zswap, leading to serialization on oom_lock and severe exit delays.

In the Linux kernel, the memcg v1 soft limit has been deprecated — writes to memory.soft_limit_in_bytes are now ignored and reads always report the maximum value. The fix also addresses a syzbot warning related to soft limit reclaim invoked from kswapd.

In the Linux kernel on arm64, show_pte() performs a lockless page-table walk that can dereference a freed table page or derive a bogus pointer during concurrent teardown. The fix uses lockless offset helpers with saved parent entries and disables local interrupts around the walk.

In the Linux kernel's s390/vfio-ap module, the apm_filtered bitmap is stack-allocated without zero-initialization. When a hot plug change adds only control domains, the filtering function is bypassed and the uninitialized bitmap is passed to reset_queues_for_apids(), potentially causing unintended guest hardware queue resets. The fix zero-initializes the bitmap at the start of the function.

The Linux kernel for the LoongArch architecture lacks a DIRECT_MAP_PHYSMEM_END definition, causing get_free_mem_region() and mhp_get_pluggable_range() to potentially return ZONE_DEVICE regions outside the vmemmap window. This can lead to page table corruption or system crashes, especially on CPUs with fewer physical address bits, such as the Loongson-2K series.

In the Linux kernel's media: meson: vdec driver, vdec_try_fmt_common() falls back to V4L2_PIX_FMT_MPEG2 for unsupported pixel formats. If a distro has patched out MPEG2 support, find_format() returns NULL, causing a NULL pointer dereference and crash. The fix uses the first format in the platform's format array instead of hardcoding MPEG2.

A flaw was found in the Linux kernel F2FS filesystem where extending a file size across an unaligned EOF boundary did not zero out post-EOF data in the partial page. As a result, stale disk data beyond the previous EOF could be exposed after remounting or crash recovery.

In the Linux kernel's drm/gud driver, gud_connector_add_tv_mode() passes fixed-size TV mode names directly to the DRM property code. If a device returns an entry without a NUL terminator, strlen() reads past the buffer, causing an out-of-bounds read. The fix validates the NUL terminator and rejects malformed responses with -EIO.

Vulnerability in the Nouveau driver (drm/nouveau/dmem) causes an underflow of the callocated counter when a large folio is split. The counter is not updated on split, leading to memory leak and warnings. The fix accounts for new sub-folios in the split hook.

A vulnerability in the Linux kernel causes a boot panic on CONFIG_DEBUG_VM kernels when hugetlb_free_vmemmap is enabled. The issue is due to late initialization of shared tail pages (zone->vmemmap_tails[]) used by HVO, leading to dereferencing an uninitialized page during bootmem HugeTLB folio preparation. The fix moves initialization to gather_bootmem_prealloc() before bootmem HugeTLB folios are processed.

In the Linux kernel, a vulnerability was found in the lockd module where the nlmsvc_match_ip() function had swapped arguments during IP address comparison. This caused lock release by server IP address (via /proc/fs/nfsd/unlock_ip) to practically never work, as the comparison read invalid data from memory.

Vulnerability in the HugeTLB mechanism for gigantic bootmem pages involves late initialization of struct pages. This can cause incorrect zone contiguity or kernel panic during boot. The fix moves initialization to an earlier phase.

In the NFS server (nfsd), there is a missing read barrier in the rpc_status_get dumpit function, which on weakly-ordered architectures (ARM, POWER) can lead to an ineffective retry mechanism. This could result in reading inconsistent data. The fix adds smp_rmb() before the second counter check.

A vulnerability was found in the Linux kernel's svcrdma module (NFS/RDMA server). A remote peer can send a Write or Reply chunk with a segcount field of zero, which passes validation in xdr_check_write_chunk() and causes a degenerate chunk (ch_segcount == 0) to be linked onto the rc_write_pcl or rc_reply_pcl lists. An earlier patch made pcl_for_each_segment() safe for segcount 0, but the issue remains relevant as defense in depth.

In the Linux kernel, a vulnerability was found in the deferred struct page initialization mechanism (CONFIG_DEFERRED_STRUCT_PAGE_INIT). When large CMA reservations are used, deferred_grow_zone() may improperly update the first_deferred_pfn pointer, leading to an overflow and triggering a BUG_ON in deferred_init_memmap(), causing a system crash during boot.

In the Linux kernel, rt6_nh_dump_exceptions() iterated over RCU-protected IPv6 route exception lists using hlist_for_each_entry() without holding rt6_exception_lock, while rt6_insert_exception() could concurrently add entries. This caused a data race reported by KCSAN. The fix switches to hlist_for_each_entry_rcu() for safe iteration.

In the phy driver (fsl-imx8mq-usb), there is a leak of the typec switch when probe errors occur. The fix uses devm_add_action_or_reset() to ensure cleanup on both probe failure and driver removal.

A flaw was fixed in the Linux kernel's svcrdma module where a failed accept path called rpcrdma_rn_unregister() without a prior successful registration. This caused erasure of another caller's XArray slot and an unmatched reference release on the RDMA device, as well as a memory leak of the svcxprt_rdma structure on every failed accept.

In the Linux kernel, the tegra-video driver (staging/media) has a bug where tegra_vip_channel_of_parse() drops a reference to the OF node in its error paths without ever taking one, underflowing the refcount. This occurs when endpoint parsing fails on a malformed device tree.

In the Linux kernel, send_signal_locked() rewrites sender IDs for the target namespace, and group sends reuse the same siginfo, so one recipient can affect the next. This allows cross-recipient influence over signal data.