CVE Vulnerability Catalog

In the Linux kernel's sunrpc subsystem, xprtsock functions use plain stores and loads for shared callback pointers sk_data_ready and sk_write_space. This can lead to another CPU using a stale pointer after the original callbacks are restored. The fix adds READ_ONCE/WRITE_ONCE for these operations.

In the Linux kernel's NFS subsystem, when the client fails to record a delegation received from the server, it does not send DELEGRETURN. This causes the server to believe the client still holds the delegation, leading to issues with delegation recall and loops in the client's state manager. The fix returns the delegation in these error paths.

In the Linux kernel's nvme-pci driver, descriptor DMA pools are not released on probe failure after the admin tag set is allocated. This causes a leak of dma_pool objects. The fix adds pool release in the out_disable error path.

The vulnerability in the Linux kernel affects the AMT (Automatic Multicast Tunneling) driver. It allows creating AMT devices on a lower device in a different network namespace, leading to a kernel warning and system hang during device unregistration. The fix forbids such cross-netns setup.

A flaw in the Linux kernel AppArmor subsystem affects the unconfined user namespace restriction when a task is already confined by a profile stack. The restriction is not correctly applied, allowing an escape if two transitions through an unconfined profile can be executed. The fix moves the check into the per-profile label build so it is always evaluated against unconfined.

In the Linux kernel nvmet subsystem, nvmet_auth_negotiate() performs a heap out-of-bounds read because it does not validate the host-supplied transfer length (tl) or the halen/dhlen values. A malicious or non-conformant host can supply a too-small tl or too-large halen/dhlen (up to 255), causing reads past the allocated buffer. The fix passes tl into the function and rejects invalid values.

In the Linux kernel's nvme-apple driver, the admin queue allocated with blk_mq_alloc_queue() was never destroyed on controller removal. This left the timeout timer and work armed on a queue that was about to be freed, eventually causing an oops inside blk_mq_timeout_work(). The issue could only be triggered when the controller failed to come up and was then immediately torn down.

In the Linux kernel nvmet subsystem, nvmet_execute_identify_ns_zns() calls bdev_is_zoned() on req->ns->bdev, which is NULL for a file-backed namespace. A host can send an Identify command with CNS 05h and CSI 02h, causing a NULL pointer dereference and kernel oops. The fix rejects the command when the namespace is not backed by a block device.

In the Linux kernel, the NVME_IOCTL_SUBMIT_IO command never calls nvme_cmd_allowed(), unlike IO_CMD and IO64_CMD. Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. The fix passes flags and open_for_write and rejects disallowed commands with -EACCES.

In the Linux kernel NFC LLCP subsystem, nfc_llcp_getsockopt() always stores 4 bytes via put_user() regardless of the caller-supplied optlen. A call with optlen < 4 writes past the user buffer, violating the getsockopt(2) contract. The fix rejects calls with optlen < sizeof(u32), with an explicit check for negative values.

In the Linux kernel NFC LLCP subsystem, nfc_llcp_getsockopt() reads llcp_sock->local before acquiring the socket lock and then dereferences the cached pointer inside the locked region. A race with an in-flight bind() can cause a use-after-free. The fix moves the read and NULL check inside the lock_sock() region.

In the Linux kernel NFC NCI subsystem, nci_close_device() and nci_rx_work can concurrently call nci_data_exchange_complete(), leading to a double sock_put() and refcount underflow that frees a socket still in use (use-after-free). The fix replaces clear_bit() with test_and_clear_bit() so only the first caller proceeds.

In the Linux kernel NFC LLCP subsystem, nfc_llcp_recv_snl() walks the SNL TLV list without bounding reads to the actual skb data, causing length underflow, out-of-bounds reads, and a bug in strncmp()/nfc_llcp_sock_from_sn(). A nearby NFC device can reach this without authentication since LLCP link activation happens automatically after NFC-DEP. The fix walks the TLV list by pointer bounded by skb_tail_pointer() and validates lengths.

In the Linux kernel, the NFC pn533 driver has a use-after-free bug. __pn533_send_async() publishes the command and then calls send_frame(), while the I2C threaded IRQ can concurrently complete the command and free the skb before the transport finishes using it.

In the Linux kernel, the NFC NCI functions parsing the CORE_INIT_RSP packet do not validate the skb length. A malformed response can declare a large number of RF interfaces with insufficient data, causing reads of uninitialized memory.

In the Linux kernel, the ALSA seq bounce_error_event() embeds a data.ext.ptr pointer in the bounce payload that reaches userspace. This leaks a kernel address (8 bytes on 64-bit) even though the event header read path clears it.

In the Linux kernel, the RDMA cxgb4 driver's c4iw_alloc() creates a debugfs tree but does not remove it in c4iw_dealloc(). When RDMA device registration fails, the err_dealloc_ctx path bypasses c4iw_remove(), leaking debugfs entries.

In the Linux kernel, the RDMA/cma module has a bug that triggers a WARN_ON in res_to_rt() during asynchronous address resolution. The issue occurs when cma_acquire_dev_by_src_ip() fails, yet the resource is still added to restrack with a NULL device pointer. The fix ensures the resource is only added when device acquisition succeeds.

In the Linux kernel, the BPF verifier's iterator type comparison during state pruning does not distinguish MEM_RCU from PTR_UNTRUSTED. This can let the verifier prune an unsafe path and accept a dangerous BPF program.

In the Linux kernel, the UBI subsystem's ubi_init_attach() rolls back failed initializations by scanning ubi_devices[0..i-1], assuming the mtd= parameter index matches the UBI device number. With an explicit ubi_num this assumption is wrong and a successfully attached device can be missed during rollback.