CVE Vulnerability Catalog

A flaw in the Linux kernel RDMA/rxe module causes the same packet to be reprocessed after a QP enters the error state. When a QP transitions to error while a packet is being completed (e.g. an rdma_cm disconnect racing with receive processing), the responder state machine loops and repeatedly posts the same IB_WC_SUCCESS completion, eventually dereferencing a NULL pointer and panicking the kernel. The duplicate completions are indistinguishable from real receives, breaking RC exactly-once delivery.

In the Linux kernel, restore_dm_crypt_keys_to_thread_keyring() gets a reference to the user keyring before restoring saved dm-crypt keys. The same reference is passed to add_key_to_keyring() for each key, but that function drops the reference on every call. With multiple keys, the reference is dropped too many times, potentially triggering a refcount underflow or use-after-free. With more than five keys restored, a warning can be triggered.

In the Linux kernel, esp_ssg_unref() releases page references held on the source scatterlist after the AEAD operation completes. It calls skb_page_unref() on every frag page for out-of-place transforms and in the error path of esp_output_tail(). This is wrong when the skb carries managed frags (SKBFL_MANAGED_FRAG_REFS), which are owned by a zerocopy ubuf and the skb does not hold a per-frag page reference. The missing guard causes a page reference count underflow and frees a page still in use.

In the Linux kernel, rvt_alloc_device() deallocates the IB device when its port array cannot be allocated but then returns the pointer to the released allocation. Callers treat any non-NULL value as valid and dereference it, resulting in a use-after-free. The fix returns NULL immediately after deallocation so callers can propagate the allocation failure.

Vulnerability in the hfi1 driver in the Linux kernel concerns the hfi1_free_devdata() function, which assumes the device was inserted into the unit table and unconditionally erases dd->unit. If xa_alloc_irq() fails, the zero-initialized unit remains zero, so full cleanup can remove an unrelated device from index 0.

Vulnerability in the hfi1 driver involves memory leak during late probe failure. The hfi1_init_dd() function allocates shared AIP/VNIC RX support before returning. If hfi1_init() or hfi1_register_ib_device() later fails, init_one() tears down device data without calling hfi1_free_rx(), leaking netdev_rx and its dummy netdev.

Vulnerability in the v4l2-async subsystem in the Linux kernel causes a crash when disconnecting an em28xx USB device using the i2c tvp5150 driver. When the asc_list is empty, v4l2_async_unregister_subdev() never calls v4l2_device_unregister_subdev(), leading to a crash. The fix calls v4l2_device_unregister_subdev() even when asc_list is empty.

A use-after-free vulnerability exists in the Linux kernel's rdtgroup_kn_put() function within the fs/resctrl subsystem. The rdtgroup structure can be freed by two racing mechanisms, leading to use-after-free and potentially double-free. The fix replaces atomic_dec_and_test() with atomic_dec_and_mutex_lock() to ensure mutual exclusion with bulk free paths.

Use-after-free vulnerability in the Linux kernel's resctrl subsystem when removing monitoring domains. Worker threads reading event counters may sleep and use delayed_work embedded in the domain structure. Under certain conditions, while a worker waits for a lock, the domain can be freed, leading to a reference to freed memory.

A deadlock exists in the Linux kernel's rpmsg glink implementation when destroying an endpoint during driver detach. The endpoint destroy routine attempts to unregister the underlying rpmsg device, which tries to re-acquire the same device mutex already held by the device core, causing rmmod to hang indefinitely. The fix removes the redundant unregistration.

Vulnerability in the cxl/mbox subsystem in the Linux kernel involves an infinite loop in the poison list handling. A device returning count == 0 with CXL_POISON_FLAG_MORE set every iteration never advances nr_records, so the max_errors guard never trips and the do/while loop runs forever while holding poison.mutex. This hangs the sysfs-triggered scan thread and blocks all subsequent poison operations. The fix stops the loop on an empty payload.

Vulnerability in the cxl/features subsystem in the Linux kernel involves missing serialization of multi-part Get/Set Feature transfers. A payload larger than the mailbox payload size is split into multiple mailbox commands, but mbox_mutex only serializes individual commands and is dropped between iterations. Concurrent calls from fwctl and EDAC paths can interleave parts of transfers, corrupting the device's transfer context. The fix adds a per-mailbox feat_mutex held across the entire transfer.

Vulnerability in the HFS+ filesystem in the Linux kernel involves missing validation of the thread record before rebuilding the delete key. When hfsplus_delete_cat() is called with str == NULL, it reconstructs the key from thread.nodeName without checking if the record is valid. A corrupted image can provide an oversized name length, leading to a buffer overflow. The fix uses hfsplus_brec_read_cat(), which bounds the record read and verifies the record size.

Vulnerability in the ath12k wifi driver in the Linux kernel involves dangling dp_link_peer references during AP vdev rollback. When vdev creation fails after ath12k_peer_create(), the function does not call ath12k_dp_link_peer_unassign(), leaving published references pointing to potentially freed memory, leading to use-after-free. The fix uses ath12k_peer_delete(), which performs unassign first.

In the Linux kernel's ARM SCMI subsystem, a vulnerability exists where channel state is published after callbacks are enabled, potentially leading to NULL pointer dereference in the RX callback. This affects both mailbox and SMC channels, where early interrupts can trigger callbacks before the cinfo or handle pointers are initialized.

In the Linux kernel's ARM SCMI subsystem, a vulnerability exists where the device notifier is not unregistered before the active_protocols IDR is destroyed. This can lead to a race condition where the notifier callback attempts to access the already freed IDR structure.

In the Linux kernel's ARM SCMI subsystem, a vulnerability exists where notifications are not quiesced before TX/RX channels are torn down, potentially leading to use-after-free in the notification callback. Additionally, the late-init work may run after the notification instance is freed.

In the Linux kernel's ARM SCMI subsystem, a vulnerability exists where on channel setup failure, previously registered channels are not properly cleaned up. This can lead to resource leaks or leaving an inconsistent state.

In the Linux kernel's ARM SCMI subsystem, a vulnerability exists where on IDR insertion failure after successful transport channel setup, the cleanup callback (chan_free) is not invoked. This can lead to resource leaks such as IRQs, mailbox channels, and shared memory.

In the Linux kernel's ARM SCMI subsystem, a vulnerability exists where during channel cleanup, the callback that removes entries from the IDR while iterating with idr_for_each() can invalidate the iterator, leading to unsafe behavior. Additionally, the callback cannot be protected by rcu_read_lock() because it may sleep.