CVE Vulnerability Catalog

In the Linux kernel, the hv vmbus module attempts to clean up an uninitialized VMBus module for a non-nested root partition. hv_acpi_init() does nothing in that scenario but reports success, so the module is loaded. Later unloading tries to clean up never-initialized resources, resulting in memory faults and a panic.

In the Linux kernel, a vulnerability was found in the FUSE filesystem related to direct writes with the O_APPEND flag. The fuse_direct_write_iter() function used a stale position before write checks, causing invalidation of the wrong page range after the write. This can lead to data inconsistency when the file size is not page-aligned.

In the Linux kernel, a fix was made to the condition that enables over-io-uring in FUSE. The fuse_uring_cmd() function now requires the FUSE_OVER_IO_URING flag to be set in the FUSE_INIT reply before accepting an IORING_OP_URING_CMD. Without this flag, there is a risk of deadlock when attempting to use io-uring. The change is trivial but alters behavior: FUSE servers must set this flag to handle io-uring.

In the Linux kernel, a bug was fixed in context management for ARM64 processes related to the Memory Tagging Extension (MTE) store-only mode. The SCTLR_EL1.TCSO0 bit was not included in SCTLR_USER_MASK, so after a context switch the setting was not cleared and could leak into another task. The fix adds SCTLR_EL1_TCSO0_MASK to SCTLR_USER_MASK to ensure proper clearing during switch.

In the Linux kernel, a fix was made for safely accessing the chan->conn field in getsockopt/setsockopt functions for Bluetooth L2CAP. After a previous change, chan->conn retains a reference and remains non-NULL even after the associated hci_conn is deleted, but accessing its fields (e.g., hdev) is invalid and leads to a KASAN crash. The fix adds a check to verify that hci_conn is still alive, and holds l2cap_chan_lock() to avoid data races.

In the Linux kernel, a fix was made for the Bluetooth L2CAP issue where a new socket could be added to the parent accept queue after l2cap_sock_cleanup_listen() had run and the state was set to BT_CLOSED, leading to a use-after-free (UAF). The fix adds a check for sk_state == BT_LISTEN after acquiring the sk lock in l2cap_sock_new_connection_cb(), and further prevents data races.

A race condition exists in the Linux kernel Bluetooth L2CAP subsystem between l2cap_sock_cleanup_listen() and l2cap_sock_put_chan(). An unsynchronized read of the l2cap_pi(sk)->chan pointer may return NULL, leading to a null-ptr-deref and kernel crash. The issue is fixed by taking lock_sock() in l2cap_sock_kill().

In the Linux kernel, the btmtksdio Bluetooth driver's TX path rounds the transfer size up to the 256-byte SDIO block size but hands the controller the SKB buffer as-is. The controller therefore reads up to 255 bytes of uninitialised memory, and the read can extend past the end of the buffer.

In the Linux kernel, the btnxpuart Bluetooth driver's nxp_process_fw_dump() reads seq_num and buf_len from a firmware dump header struct at skb->data without verifying the ACL payload is long enough. A short frame with connection handle 0xfff reads both fields beyond the received data, and a buf_len of zero can end a dump early and reset the controller.

In the Linux kernel, the Bluetooth RFCOMM rfcomm_apply_pn() accepts the MTU value from a remote Parameter Negotiation frame without checking for zero. When a peer sends an MTU of zero, d->mtu becomes 0, causing an infinite loop during data fragmentation and exhausting system memory.

A leak of the hci_conn structure occurs in the Linux kernel when a second LE connection is rejected. The create_le_conn_complete() function incorrectly compares the failed connection against hci_lookup_le_connect(), so when two connections are pending simultaneously, hci_conn_failed() is never called and the connection remains stuck in BT_CONNECT forever. As a result, all subsequent LE connection attempts fail with -EBUSY and require an adapter reset.

In the Linux kernel, the xsk zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set XDP_TX_METADATA. The fix passes descriptor options through the metadata helpers and ignores metadata unless the option is set.

In the Linux kernel, the octeontx2-af driver's rvu_dbg_nix_tm_tree_display() dereferences pfvf->sq_ctx without checking whether the SQ context has been allocated. Reading /sys/kernel/debug/octeontx2/nix/tm_tree for a NIX LF without configured transmit queues triggers a kernel oops.

In the Linux kernel, the octeontx2-vf driver has a workqueue and netdev race in the probe/remove paths. The VF workqueue is not initialized before register_netdev(), so ndo_set_rx_mode can queue work on a NULL workqueue, and the workqueue is destroyed before the netdev is unregistered.

A vulnerability in the Linux kernel's act_ife module (net/sched) causes a kernel panic (skb_under_panic) when processing non-Ethernet frames. The issue stems from using skb->dev->hard_header_len instead of ETH_HLEN, leading to incorrect skb buffer operations. The fix restricts IFE to Ethernet frames only and enforces the correct header length.

In the Linux kernel, the net: mana driver's mana_gd_query_max_resources() sizes gc->num_msix_usable from resp.max_msix and the CPU count but never from the device MSI-X table. On a 1792 vCPU M-series VM this yields 1793 while the table has 1024 entries, causing an out-of-bounds access and a page fault.

In the Linux kernel, net/rds rds_cong_map_updated() uses waitqueue_active() without the required memory barrier, leading to a store-buffering pattern. The updater can observe an empty wait queue while the waiter still sees the port as congested, so no wake-up is issued.

In the Linux kernel, the octeontx2-pf driver lacks NULL checks before calling test_bit() on the af_xdp_zc_qidx pointer. This pointer is only allocated for AF_XDP zero-copy paths, while representors and other paths leave it NULL, causing a NULL dereference when switching devlink eswitch mode.

In the Linux kernel, the octeontx2-af driver leaks memory and mishandles resource teardown when rvu_mbox_init() is called repeatedly. Each call allocated a new ng_rvu object, overwriting the previous pointer, and error paths freed resources incorrectly, leaving mailbox memory in use.

In the Linux kernel, the net/sched act_skbmod module has header length calculation errors. The tcf_skbmod_act() function calls skb_network_header_len() without guaranteeing transport_header is set and calls skb_mac_header_len() on L3 devices, causing warnings and incorrectly dropping valid short packets.