CVE Vulnerability Catalog

In the Linux kernel, hwrng_register() adds rng to the global rng_list and may then try to set it as current_rng. If that step fails, it returns an error but does not remove rng from the list, causing a dangling reference and potential use-after-free if the caller frees rng. The fix adds a list_del_init() cleanup step.

In the Linux kernel, the crypto qat driver queues SR-IOV re-enable work using a work_struct and completion embedded in an on-stack adf_sriov_dev_data. If the completion wait times out, the reset worker can return while device_sriov_wq still holds or executes the stack-backed work item. The fix cancels the work on device_sriov_wq on timeout before the stack frame unwinds.

In the Linux kernel, qat_alg_xts_reverse_key() expands the forward XTS AES key on the stack, and the key schedule contains key material that can remain in the stack frame. The fix clears the temporary crypto_aes_ctx with memzero_explicit() after the copy.

In the Linux kernel, the hardware ECDH path in atmel_ecdh_compute_shared_secret() uses the private key stored in the device, but the public key is cached only after atmel_ecdh_set_secret() successfully generated that private key for the current tfm. The fix adds a check for a missing cached public key to prevent using a private key not generated for the current tfm.

In the Linux kernel, the crypto: atmel-sha204a driver failed to free the work_data structure when an I2C transfer failed in the nonblocking RNG path. The pointer remained in rng->priv, so subsequent reads could interpret stale state as valid RNG completion data, causing a heap information leak.

In the Linux kernel, sa_ul_probe() in the crypto: sa2ul driver ignored the return value of sa_init_mem(), which creates the DMA pool for security context buffers. If pool creation failed, probe continued with DMA setup and algorithm registration even though later request setup depends on that pool.

In the Linux kernel, xtrng_readblock32() in the hwrng: xilinx-trng driver returned the number of bytes read even when the first poll timed out. The caller treated a zero return as a short successful read, and partial reads for full 32-byte blocks could make the tail copy use a fixed block offset instead of the amount already produced.

In the Linux kernel, rk_hash_run() in the crypto: rk3288 driver waited for RK_CRYPTO_HASH_STS to become idle after the final DMA transfer but ignored the poll result. If the hash engine never became idle, the driver still read the digest registers and finalized the request with the previous success value.

In the Linux kernel, register_aes_algs() in the crypto: keembay driver registered AEAD algorithms before skcipher algorithms. If skcipher registration failed, the function unwound the earlier AEAD registration passing ARRAY_SIZE(algs) (the skcipher table size) instead of ARRAY_SIZE(algs_aead).

In the Linux kernel, the RDMA/irdma driver did not prevent userspace from deregistering the MRs backing QP/CQ/SRQ rings. The fix adds refcounting to user ring MRs by bumping the MR's refcount upon association.

In the Linux kernel, __wait_for_resp() in the RDMA/bng_re driver ignored wait_event_timeout() expiry. If the response slot remained in use after the timeout and the polled CREQ service attempt, the loop started another full timeout period and could repeat forever.

In the Linux kernel, apple_nvme_init_queue() in the nvme-apple driver initialized queue state and then marked the queue enabled. The old wmb() after WRITE_ONCE(enabled, true) did not publish the earlier initialization before enabled became visible, potentially racing with interrupt and request paths.

A resource leak exists in the Linux kernel's nvmet-rdma module. When an NVMe target with RDMA transport is removed while I/Os are in flight, a response can be posted but its send completion is never delivered before the connection is torn down, so nvmet_rdma_send_done() and nvmet_rdma_release_rsp() are never called, leaking the allocated RDMA read/write context and request SGLs.

In the Linux kernel, the nr_deadline_tasks variable in the cpuset structure could be modified concurrently by inc_dl_tasks_cs() under rq->lock and by cpuset_attach() under cpuset_mutex. Simultaneous updates could corrupt the variable, leading to incorrect operations.

In the Linux kernel, the mac80211_hwsim driver has a vulnerability where a NULL pointer can be passed to ieee80211_free_txskb() during queue stop. The issue arises from separating the empty queue check from the dequeue operation, which is unsafe under concurrent TX status handling.

In the Linux kernel's BPF subsystem, there is a vulnerability allowing out-of-bounds memory access for MEM_ALLOC BTF pointers. During BTF struct walks, the size limit is not properly enforced for statically allocated objects, potentially leading to reads/writes beyond the allocated area.

In the Linux kernel's BPF subsystem for s390 architecture, there is an issue with the 'ly' instruction that does not zero the upper bits of a 64-bit register when loading a 32-bit value. The 'llgf' instruction should be used instead, as it correctly zeroes the upper bits.

In the Linux kernel's proc_timens_set_offset() function, there is a lack of validation for the tv_nsec field, which should be in the range [0, 999999999]. Invalid values can lead to incorrect calculations or unexpected behavior when adding times.

In the Linux kernel's qcom gdsc clock driver, there is an issue with improper removal of genpd domains during unregistration. The gdsc_unregister() function does not call pm_genpd_remove() for registered domains, leaving entries on the global list and causing errors on re-registration.

In the Linux kernel's BPF subsystem, there is a vulnerability allowing writes through untrusted BTF pointers, bypassing the read-only policy for pointers created by helpers such as bpf_rdonly_cast(). Non-read accesses are not rejected at the common entry point.