CVE Vulnerability Catalog

In the Linux kernel, the BPF mechanism has a vulnerability where a BPF program in the cgroup getsockopt hook can set a negative ctx->optlen, which is accepted and propagated to the TCP getsockopt code, leading to a hardened usercopy warning (bytes > INT_MAX).

In the ksmbd module of the Linux kernel, a lock ordering flaw occurs when a lock is deferred. When vfs_lock_file() defers a lock, smb2_lock() places its ksmbd_lock on rollback_list before allocating and registering the asynchronous work; if that setup fails, rollback dereferences NULL and frees a file_lock still linked into the VFS blocked-lock state.

In the ksmbd module of the Linux kernel, a file_lock lifetime flaw exists. Retained file_lock objects can still be part of the VFS blocked-request graph, and freeing them directly triggers BUG_ON(!list_empty(&flc->flc_blocked_requests)) and can leave a freed ksmbd_lock reachable.

In the ksmbd module of the Linux kernel, ksmbd_all_conn_set_status() treats every connection with the transient binding flag set as belonging to the target SessionId. As a result, a logoff or session replacement can move an unrelated connection to NEED_RECONNECT or NEED_SETUP.

In the ksmbd module of the Linux kernel, smb_check_perm_dacl() bounds its ACE walks by the remaining NTSD length (acl_size) rather than the DACL's declared size (pdacl_size). A crafted DACL can place an access-granting ACE beyond pdacl->size, which is accepted during SMB2_CREATE access validation.

In the ksmbd module of the Linux kernel, ksmbd_session_register() fails to remove the session from sessions_table and drop its table reference when xa_store() fails. This causes a session leak because the reference count stays at 1 and the session is not freed.

In the Linux kernel NFSv4 client, nfs4_alloc_client() allocates an NFSv4.0 callback identifier before finishing client setup. If a later initialization step fails, the error path frees the nfs_client directly via nfs_free_client(), bypassing removal of the cb_ident_idr entry and leaving a stale pointer to freed memory.

In the Linux kernel pnfs/blocklayout module, bl_parse_concat() and bl_parse_stripe() do not release the failed child or already parsed children on a parse error, and bl_free_device() does not release the children array when nr_children is zero. Additionally, bl_parse_scsi() can leave d->bdev_file set after dropping the file reference.

In the Linux kernel NFSv4/flexfiles module, two code paths assume the data server client has a session, which is not true for NFSv4.0 (clp->cl_session is NULL). This causes NULL dereferences in nfs4_init_ds_session() and ff_layout_async_handle_error_v4(), and a busy-loop in nfs4_renew_state() due to zero cl_lease_time.

In the Linux kernel NFSv4 client, nfs4_add_lease() calls nfs4_delete_lease() with the priv argument, which can legitimately be NULL, when racing with a delegation return. Passing NULL eventually leads to a NULL pointer dereference in generic_setlease().

In the Linux kernel clk/devres subsystem, devm_clk_get_optional_enabled_with_rate() registers its cleanup action before setting the clock rate. If setting the rate fails, it attempts to disable and unprepare a clock that was never enabled.

In Linux kernel BPF/XDP subsystem, program checks were moved into dev_xdp_install() to prevent swapping a normal XDP program for an offloaded/device-bound one via BPF_LINK_UPDATE, which previously bypassed verification and allowed execution on the software path.

In the hinic3 network driver in Linux kernel, an issue was fixed related to skb linearization and error handling in skb_checksum_help(). The bug could lead to out-of-bounds DMA reads or IOMMU faults, and also to sending corrupted packets with incomplete checksums.

A NULL pointer dereference/use-after-free exists in the Linux kernel dpll subsystem. When the last owner of a dpll device unregisters while a foreign driver still holds a pin via dpll_pin_on_pin_register(), the dpll object remains with an empty registration list, and a queued pin notification dereferences the missing registration in dpll_device_ops().

In the Linux kernel KCM (Kernel Connection Multiplexer) module, RCU protection was missing during execution of a BPF program in the strparser, which could trigger kernel warnings during BPF map operations. The fix holds the RCU lock while running the program.

In the virtio_net driver, the RX ring resize operation was fixed for when an AF_XDP socket is attached, preventing write past the end of the xsk_buffs array when the size grows. The fix properly resizes the array.

In the Linux kernel IPVS module, an integer overflow was fixed in the FTP helper that parses PASV/EPSV responses, which could wrap values and use incorrect port/address for data connections. The fix widens the port accumulator to u32 and rejects values above 65535 and address octets above 255.

In the Linux kernel, the cuse module has a use-after-free vulnerability during module unload. fuse_conn_put() frees fuse_conn via call_rcu(), and if the cuse module is removed before the RCU grace period ends, the callback may execute freed module memory, causing a page fault or undefined behavior.

In the Linux kernel, fuse_fill_super_submount() did not check whether fuse_iget() returned NULL. When the root inode allocation for a FUSE submount failed — e.g. under memory pressure — the NULL result was passed to get_fuse_inode(), causing a NULL pointer dereference and an oops during mount.

In the Linux kernel, vsock_accept() checked the listener's sk_err field, causing valid incoming connections to be rejected if a stale error from an earlier failed connection attempt (e.g., self-connect returning EPROTO) remained on the socket. This led to a resource leak — the child socket created for the rejected connection was never freed on virtio and hyperv transports. The issue was resolved by removing these checks.