CVE Vulnerability Catalog

In the Linux kernel, the copy_net_ns() function has a resource leak in its error handling path. When preinit_net() fails, the code jumps to the dec_ucounts label, skipping the release of resources allocated by net_alloc(), such as key_remove_domain() and net_passive_dec().

In the Linux kernel, the net/sched fq module has an integer overflow when computing quantum and initial_quantum. A device with a huge MTU makes psched_mtu() return 0x80000000, and multiplication by 2 and 10 wraps to zero, causing an infinite loop in fq_dequeue() and a soft lockup.

In the Linux kernel, the net/sched fq_codel module fails to clamp quantum and mtu values. A device with a huge MTU overflows the signed flow->deficit to INT_MIN, causing an infinite loop and soft lockup, and also silently disables the CoDel mechanism.

In the Linux kernel, the net/sched fq_pie module fails to clamp the default quantum value. A device with a huge MTU overflows the signed flow->deficit to INT_MIN in fq_pie_qdisc_dequeue(), causing an infinite loop and soft lockup.

In the Linux kernel, the net/sched hhf module lacks an overflow check when setting quantum. A device with a huge MTU overflows the signed deficit in hhf_dequeue(), causing an infinite loop, and also causes -EINVAL when adding qdisc with options.

In the Linux kernel, the net/sched sfq module fails to clamp the quantum value. A device with a huge MTU makes slot->allot equal INT_MIN, and INT_MIN + INT_MIN toggles between INT_MIN and 0, causing an infinite loop in sfq_dequeue() and a soft lockup.

In the Linux kernel, the net/sched: sch_teql module has a vulnerability where teql_master_xmit() sets skb->dev to the slave device before calling ndo_start_xmit(), but does not restore it when transmission fails. This causes the packet with a stale skb->dev to be queued on the ARP queue, and after the slave device is deleted, a use-after-free (UAF) occurs.

In the Linux kernel, st33zp24_status() ignores the transport read result and returns data even when no byte was received. In the I2C transport, when the register-select write is short or fails, i2c_master_recv() is skipped, leaving data uninitialized. The resulting stack value can be interpreted as TPM_STS flags and let status checks complete spuriously.

In the Linux kernel, ACOMP_REQUEST_ON_STACK() reserves only enough storage for the synchronous fallback. When an async implementation is selected, acomp_request_clone() copies only the stack-sized object, so the clone has no storage for the async provider request context. Providers such as QAT write past the allocation through acomp_request_ctx(), reported by KASAN as a slab OOB write.

In the Linux kernel, snd_soc_dapm_put_enum_double() rejects item[0] once it reaches e->items, but lets item[1] be equal to it. Both go to snd_soc_enum_item_to_val(), which indexes e->values with no bound of its own, so an enum with a value table reads one element past the end. Only adav80x pairs a value table with two shifts.

In the Linux kernel, the libceph module (Ceph messenger v2 protocol) did not validate the payload_len field in the banner prefix. A client could send a banner with payload_len of 0, causing a 0-length socket read and violating a state machine invariant, triggering a warning in populate_in_iter(). Per the msgr2 specification, payload_len must be at least 16 bytes.

In the Linux kernel, ftrace_direct_multi_init() assigns kthread_run()'s return value to simple_tsk without an IS_ERR() check. When kthread_run() fails it returns ERR_PTR(-ENOMEM), but init still returns 0, so the module loads with simple_tsk holding an error pointer. On unload, ftrace_direct_multi_exit() passes that ERR_PTR to kthread_stop(), leading to a null-pointer-dereference.

In the Linux kernel, IPPROTO_SMC sockets create an internal TCP sock ("clcsock") from the proto->init hook. When socket creation fails after proto->init has run — e.g. a cgroup BPF program attached to BPF_CGROUP_INET_SOCK_CREATE denies the socket — sk_common_release() only invokes sk_prot->destroy if it is set, but neither smc_inet_prot nor smc_inet6_prot defines it, and smc_destruct() returns early. As a result, every failing socket(AF_INET, SOCK_STREAM, IPPROTO_SMC) call leaks one tcp_sock.

In the Linux kernel, in the drm/xe driver, having scratch enabled does not make a VM capable of handling recoverable page faults. Allowing scratch VMs through the ASID lookup also admits dma-fence mode VMs. If such a VM faults on an already valid VMA, the handler reports success without fixing the fault, causing the GPU to retry indefinitely.

In the Linux kernel, in virtio-net the user can specify any gso_size in a packet crafted with an AF_PACKET PACKET_VNET_HDR socket, even smaller than TCP_MIN_GSO_SIZE = 8. Since GSO_MAX_SIZE = 8 * GSO_MAX_SEGS = 8 * 65535, with gso_size < 8 there is a risk of overflowing the 16-bit gso_segs field when dividing the SKB length by gso_size.

In the Linux kernel, in netfilter nf_tables the hardware offload step is performed before building the chain blob. Allocating the chain blob before the ruleset offload reduces the chance of entering an inconsistent state where the offloaded ruleset in the NIC and the software ruleset differ.

In the Linux kernel, in netfilter nf_tables both the dynset and newsetelem path clone the existing set expressions when setting set element expressions if no override expressions are provided. This results in a double clone. The fix adds an override_exprs flag to annotate override expressions and conditionally releases expressions, also fixing a module refcount imbalance for the connlimit expression.

In the Linux kernel's ALSA control layer, there is a NULL pointer dereference vulnerability. A write-only control element without a get callback can be created, leading to a kernel Oops in snd_ctl_led_notify().

In the Linux kernel, the stmmac network driver's RX path was converted to zero-copy, but NET_IP_ALIGN was not carried over into stmmac_rx_offset(). As a result, the IP header lands at a misaligned address, causing an alignment fault and kernel panic on architectures such as ARM32 when receiving e.g. an ICMP echo request.

Vulnerability in the Linux kernel net/sched component allows causing a soft lockup via crafted size table (stab) in DRR and ETS schedulers. An attacker with CAP_NET_ADMIN in a namespace can trigger a huge qdisc_pkt_len value (~1 GiB), leading to a loop in the scheduler and system hang.