CVE Vulnerability Catalog

In the Linux kernel, ntfs_mft_record_alloc() reads the old update sequence number from an unvalidated MFT record using the untrusted usa_ofs field. A corrupted record can place usa_ofs past the end of the record, causing a two-byte read outside the folio and a use-after-free.

In the Linux kernel ALSA mtpav driver, snd_mtpav_free() deletes the timer without waiting for a running callback to finish. A callback running on another CPU can still access the card-private state or rearm the timer after deletion. The fix uses timer_shutdown_sync() without holding chip->spinlock.

In the Linux kernel XDP socket (xsk) subsystem, __xsk_rcv() in the multi-buffer path calls xsk_buff_alloc() in a loop without checking its return value. When xsk_buff_alloc() returns NULL, a NULL pointer dereference causes a kernel crash. The fix introduces a two-stage buffer allocation transaction.

In the Linux kernel bridge subsystem, a pair of descending VLAN and tunnel ID ranges can pass the tunnel range span check. The VLAN subtraction produces a negative int converted to unsigned, which can equal the wrapped tunnel ID delta. The range loop then performs no iterations, leaving err uninitialized and making the return value unpredictable.

In the Linux kernel netdevsim driver, receive queues embed their own napi_struct. During queue reset, nsim_queue_start() failed to update the queue-to-NAPI mapping via netif_queue_set_napi(), so dev->_rx[idx].napi still pointed to the old NAPI struct. After the old queue was freed, a Netlink queue dump triggered a slab-use-after-free read in nla_put_napi_id().

In the Linux kernel qlcnic driver, the unified ROM parser reads directory, product, and data-descriptor fields from the firmware file. Existing validation ends with unchecked additions and multiplications, and malformed values can wrap before comparison with the firmware size. The parser can also read beyond the firmware allocation during validation or loading.

In the Linux kernel IPv6 multicast routing (ip6mr) subsystem, incoming packets attach a non-refcounted (NOREF) dst under RCU. When an ingress multicast packet misses MFC lookup, it is placed on the unresolved queue, escaping the receive-side RCU grace period. If the underlying route is deleted and freed and the MFC queue is later resolved with a wrong parent interface, ip6mr_cache_report() executes dst_clone() on the freed dst entry, triggering a use-after-free.

A vulnerability exists in the Linux kernel's inetpeer rate limiting system, which stores peer entries in a Red-Black tree keyed deterministically on the remote IP address. An off-path adversary can predict the tree topology and force eviction of targeted nodes, resetting their rate-limiting token buckets, which allows bypassing IP-keyed ICMP rate limits and inferring open UDP ports. The fix randomizes the RB-tree node comparison using SipHash with a secret key.

In the Linux kernel traffic scheduling (net: sched) subsystem, gred_enqueue(), bfifo_enqueue() and plug_enqueue() compute the sum of backlog and packet length in 32 bits. Once the true backlog exceeds 4 GiB the sum wraps and becomes small, so the queue grows without bound and can drive the kernel to OOM. The fix promotes the sums to u64.

In the Linux kernel SMC (net/smc) subsystem, when the local LLC flow transitions from SMC_LLC_FLOW_REQ_ADD_LINK to SMC_LLC_FLOW_ADD_LINK, smc_llc_flow_qentry_set() is called unconditionally. A previously stashed qentry (from CONFIRM_LINK or ADD_LINK_CONT) is overwritten without being freed, leaking one kmalloc object.

In the Linux kernel SMC (net/smc) subsystem, smc_llc_flow_stop() resets a flow struct with a blind memset. If flow->qentry is non-NULL at that point, the pointer is overwritten without the allocation being freed, leaking one kmalloc object. This can occur when a late duplicate CONFIRM_LINK or ADD_LINK_CONT message arrives.

In the Linux kernel, the bridge module's ARP/ND proxy reads the neigh ha address directly, which can result in torn or partial reads while the neigh entry is being updated. The fix uses neigh_ha_snapshot to take a stable snapshot of the address.

In the Linux kernel, the vxlan module's arp/neigh_reduce functions read the neigh ha address directly, which can lead to partial reads while the neigh entry is being updated. The fix uses neigh_ha_snapshot to take a stable snapshot, similar to route_shortcircuit.

In the Linux kernel, the NFSv4.1 implementation fails to zero referring call lists before decoding. decode_cb_sequence_args() allocates csa_rclists with kmalloc_objs(), leaving each referring_call_list uninitialized, and decode_rc_list() assigns rcl_refcalls only when rcl_nrefcalls is nonzero. A valid list with zero referring calls leaves the pointer uninitialized, and nfs4_callback_sequence() later passes stale slab contents to kfree().

In the Linux kernel, the NFSv4.2 implementation has a LAYOUTSTATS send buffer exhaustion issue. The encode_layoutstats_maxsz macro budgets 256 bytes, but the flexfiles record can exceed that because the server controls the filehandle and address lengths. This can drive the encoder past the end of the send buffer and leave a mutex permanently held when xdr_reserve_space() returns NULL.

In the Linux kernel, the NFSv4/pnfs implementation keys the data server cache on the multipath address set alone, without including the NFS version. When two deviceids on the same address have different versions, they share a single nfs4_pnfs_ds, and whichever mirror connects first pins ds_clp to its own version. The other mirror is handed that client and selects rpc_call_ops for a version the connection does not speak, leading to a NULL dereference.

In the Linux kernel, the bnxt_en driver passes the platform device instead of the hardware monitoring device as the first parameter to hwmon_notify_event(). This API break results in undefined behavior and may cause a crash.

In the Linux kernel, the ptp netc driver has a period truncation and potential divide-by-zero issue in PEROUT. The max_period value exceeds U32_MAX, causing silent truncation of period_ns to zero and a divide-by-zero in roundup_u64(). Additionally, a zero pp->period causes an unsigned wraparound to 0xFFFFFFFD, mis-programming the FIPER hardware register.

A vulnerability in the Linux kernel's net/sched classifier mechanism allows unprivileged users to pin kernel memory outside memcg control by using GFP_KERNEL allocations without __GFP_ACCOUNT in classifier *_change() paths and the shared tcf_exts_init_ex() action array. Additionally, an error path in cls_basic leaves a dangling pointer in the IDR.

In the Linux kernel, the sparx5 driver has a sleep-in-atomic-context issue in MAC table access. sparx5_set_rx_mode() runs with netif_addr_lock_bh held and iterates dev->mc, leading to taking the sparx5->lock mutex and polling a register in atomic context, which is not allowed. The fix converts the driver to the new .ndo_set_rx_mode_async callback.