CVE Vulnerability Catalog

In the Linux kernel's BTF, btf_find_struct_field() initializes a fresh seen mask on every recursive descent, so unique special fields at different levels of the same aggregate do not see each other. Duplicate fields can reach btf_parse_fields(), triggering an invariant WARN_ON_ONCE(). A crafted user BTF can trigger the warning before capability checks. The fix initializes the mask once and passes the same pointer through the entire traversal.

In the Linux kernel, the RDMA/erdma driver has a use-after-free in the CEQ tasklet during device removal. free_irq() does not drain a tasklet already scheduled by the interrupt handler, so the tasklet can access freed EQ buffers (eq->qbuf or eq->dbrec) after erdma_eq_destroy().

In the Linux kernel, the RDMA/mana_ib module has a use-after-free during partial table insertion of a QP. mana_table_store_ud_qp() publishes a QP before inserting the receive-queue id, dropping the XArray lock, allowing a concurrent completion handler to take a transient reference; when the second insertion fails, rollback erases only the send-queue entry, leaving references outstanding and causing a use-after-free.

A use-after-free vulnerability has been found in the Linux kernel in the ib_query_qp() function within the RDMA/core subsystem. The issue arises from improper synchronization when querying a QP via netlink while the QP is being destroyed, potentially leading to access to freed memory.

In the Linux kernel, the RDMA/core subsystem has a potential use-after-free in ib_destroy_cq_user(). rdma_restrack_del() is invoked too late, leaving the CQ accessible through restrack while vendor-specific resources are already being freed.

In the Linux kernel, the RDMA/core subsystem has a potential use-after-free in ib_destroy_srq_user(). rdma_restrack_del() is invoked too late, leaving the SRQ accessible through restrack while vendor-specific resources are already being freed.

In the Linux kernel, the RDMA/core subsystem has a potential use-after-free in counter_release(). rdma_restrack_del() is invoked too late, leaving the counter accessible through restrack while vendor-specific resources are already being freed.

In the Linux kernel, the RDMA/core subsystem has a potential use-after-free in ib_free_cq(). rdma_restrack_del() is invoked too late, leaving the CQ accessible through restrack while vendor-specific resources are already being freed.

In the Linux kernel, the RDMA/core subsystem has a potential use-after-free in ib_dealloc_pd_user(). rdma_restrack_del() is invoked too late, leaving the PD accessible through restrack while vendor-specific resources are already being freed.

In the Linux kernel, the firmware arm_scmi subsystem has a race during requested device removal. scmi_protocol_device_unrequest() drops scmi_requested_devices_mtx while notifying listeners but retains the list head; when two SCMI drivers for the same protocol unregister concurrently, one thread can free the list head while the other dereferences it after reacquiring the mutex, potentially freeing it twice.

In the Linux kernel, the iommu/amd subsystem has undefined behavior in the devid_write debugfs function. When the for_each_pci_segment() loop completes without finding a matching segment, pci_seg is not NULL but points to the list head, and accessing pci_seg->id after the loop causes undefined behavior.

In the Linux kernel, the thermal intel int3400 driver's evaluate_odvp() creates per-ODVP sysfs files before the thermal zone and later probe resources are registered. The unwind path only calls cleanup_odvp() from the late sysfs failure path, so failures after evaluate_odvp(), including thermal_tripless_zone_device_register() failures, leave the ODVP files and storage behind. The fix moves ODVP cleanup to the common ART/TRT unwind path and clears cached ODVP pointers.

A fix was applied in the Linux kernel for an ABBA deadlock in ext4_xattr_inode_cache_find() triggered by concurrent extended attribute (xattr) workloads using the ea_inode mount option. The deadlock occurred between a transaction holding a reference to an mbcache entry and the eviction thread evicting the same EA inode. The fix introduces a new EXT4_IGET_NOWAIT flag that performs a non-blocking inode lookup and returns -ENOENT instead of waiting for eviction or creation to complete.

In the Linux kernel, the ext4 filesystem in data=journal mode has a vulnerability that triggers a WARN_ON_ONCE and potential data loss during remount read-only (e.g., reboot). The issue is caused by stale xarray tags (PAGECACHE_TAG_DIRTY and PAGECACHE_TAG_TOWRITE) not being cleared on folios skipped during writeback, leading to clean folios being incorrectly treated as dirty.

A race condition exists in the Linux kernel's ext4 filesystem during write operations. When a direct I/O (DIO) write to a hole in a no-extent inode returns -ENOTBLK, it falls back to buffered I/O, and in the window between releasing the inode lock and flushing/invalidating pages, concurrent DIO completions can trigger page cache invalidation warnings and -EIO errors. The issue is fixed by adding inode_dio_wait() in ext4_buffered_write_iter() before ext4_write_checks().

A race condition in the Linux kernel's ext4 filesystem inline data write path has been fixed. During concurrent writes and page faults, the inline data state could change between write_begin and write_end, leading to NULL pointer dereferences or data loss. The fix passes the write state via the fsdata parameter and replaces a critical BUG_ON with graceful error handling and retry.

A vulnerability in the Linux kernel's ext4 filesystem was fixed, where a corrupted directory could trigger a use-after-free (reported by KASAN) during ext4_readdir(). The ext4_dir_llseek() function invalidates the directory cookie, causing a rescan of directory entries, and a corrupted rec_len field can point to an offset where the block lacks space for a complete directory entry. This leads to an out-of-bounds read and potential access to freed memory.

In the Linux kernel, the wifi ath6kl driver's WMI event handlers ath6kl_wmi_scan_complete_rx(), ath6kl_wmi_addba_req_event_rx(), and ath6kl_wmi_delba_req_event_rx() read from the event buffer without first verifying that the message is large enough. The fix adds length checks to prevent overreads.

In the Linux kernel, the wifi ath12k driver's ath12k_wmi_op_rx() reads the firmware buffer without first verifying that it contains enough data to hold a header. This could result in a buffer overread. The fix adds a check that the buffer holds at least a wmi_cmd_hdr before reading.

In the Linux kernel, the wifi ath11k driver's ath11k_wmi_tlv_op_rx() reads the firmware buffer without first verifying that it contains enough data to hold a header. This could result in a buffer overread. The fix adds an upfront length check before dereferencing skb->data as a wmi_cmd_hdr, placed before the trace_ath11k_wmi_event() call to preserve existing trace semantics.