CVE Vulnerability Catalog

A vulnerability was found in the Linux kernel's SOCKMAP mechanism for AF_UNIX sockets. SOCKMAP can hide an inflight file descriptor from the garbage collector (GC), leading to memory leaks and potential use-after-free. An attacker could exploit this to escalate privileges or destabilize the system.

A vulnerability in the Linux kernel's sctp_getsockopt_peer_auth_chunks function fails to properly validate the user buffer size before writing data. Missing the 8-byte header of the sctp_authchunks structure leads to an out-of-bounds write that can overwrite adjacent user data.

A vulnerability in the Linux kernel's PPPoE driver allows dropping frames with Protocol Field Compression (PFC). An attacker can send a crafted frame with a 1-byte protocol field, shifting the payload by one byte and potentially causing unaligned access exceptions on some architectures.

In the Linux kernel's netfilter/nat subsystem, a vulnerability was found where NAT hook registration structures (ops) were not freed using kfree_rcu. This can cause use-after-free when userspace dumps active hooks via nfnetlink_hook (introduced in v5.14).

In the Linux kernel, a vulnerability was found in the netfilter nfnetlink_osf module, where the nf_osf_ttl() function accessed skb->dev without verifying the device pointer, potentially causing a NULL pointer dereference. The TTL check logic also incorrectly assumed packets from the same subnet would not have a decremented TTL, which is false in container and virtual switching environments.

In the Linux kernel, a vulnerability in the ADFS filesystem lacks validation of the zone count (nzones) in adfs_validate_bblk(), leading to an out-of-bounds write. A crafted disk image with zero zones triggers kmalloc_array(0, ...) returning ZERO_SIZE_PTR, followed by a write before the allocated buffer.

A race condition in the Linux kernel between pressure write and cgroup file release leads to a use-after-free vulnerability in the priv member of struct kernfs_open_file.

In the Linux kernel netfilter/nf_tables subsystem, a vulnerability was found where new hooks are published unsafely into the basechain/flowtable list during the commit phase. The lack of splice_list_rcu() can cause race conditions between netlink dump traversal and concurrent ruleset updates.

In the Linux kernel, the amdgpu driver has a double call to drm_exec_fini() in the userq validation function. When new_addition is true, exec is finalized first, and then on error from amdgpu_ttm_tt_get_user_pages(), drm_exec_fini() is called again, causing a double free. The issue was found by a static analysis tool and confirmed by code review.

In the Linux kernel, a vulnerability was found in the airoha network driver causing a BQL (Byte Queue Limits) imbalance in the TX path. The issue stems from incorrect TX queue indexing, where inflight packets are accounted only for a limited number of queues, while completions are accounted for all queues.

In the Linux kernel, the neigh_xmit function leaks an skb when called with an uninitialized neighbor table (e.g., NEIGH_ND_TABLE with IPv6 disabled). The function did not free the packet in that case, and its return value was ignored by callers like MPLS. The fix ensures full skb ownership and removes the last code path that neither transmits nor frees the packet.

Two bugs were found in the drm/xe graphics driver's xe_exec_queue_create_ioctl() function. The first leaves a dangling pointer when xe_hw_engine_group_add_exec_queue() fails. The second fails to remove the queue from the engine group after xa_alloc() failure, causing a use-after-free.

A data race was found in the Linux kernel's bonding 802.3ad (LACP) implementation due to missing RCU protection for the port->aggregator pointer. The fix adds the __rcu qualifier and proper RCU API usage.

A memory leak was discovered in the Linux kernel's TLS subsystem. During a failed attempt to switch TLS RX to hardware offload, the cleanup function did not free the anchor skb allocated by strparser. The issue was introduced after a change to the strparser implementation.

A vulnerability in the Linux kernel futex subsystem where need_futex_hash_allocate_default() incorrectly required CLONE_THREAD for proper hash allocation. This caused a use-after-free bug when sharing memory (mm) in non-thread ways, such as via child processes.

In the Linux kernel, a use-after-free vulnerability was found in the ena driver's get_timestamp function. The issue is caused by missing synchronization when checking the active flag and reading the DMA memory pointer, potentially leading to NULL pointer dereference.

A vulnerability was found in the Linux kernel's KVM subsystem in the kvm_reset_dirty_gfn() function. Missing overflow check when adding offset and mask allows bypassing range validation via integer wrap. An attacker can exploit this for out-of-bounds memory access.

In the Linux kernel, a vulnerability in the KVM subsystem for s390 architecture causes double-scaling of pointer arithmetic when indexing the GAIT table. Functions kvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and aen_host_forward() manually multiply the index by sizeof(struct zpci_gaite), leading to out-of-bounds access for aisb >= 32.

In the Linux kernel, the SMB/client subsystem has a vulnerability causing an infinite loop and out-of-bounds read in the symlink_data() function. On 32-bit architectures, an invalid ErrorDataLength value can make the next pointer point to the beginning of the structure or beyond it.

A buffer leak was discovered in the __ceph_setxattr() function in the Ceph filesystem within the Linux kernel. During retries, the old_blob variable stores the ci->i_xattrs.prealloc_blob value but is never freed via ceph_buffer_put(), causing a memory leak.