CVE Vulnerability Catalog

In the Linux kernel, a race condition in the IPv4 routing subsystem allows rt_bind_exception() to bind a new dst to a stale fnhe entry that is about to be freed, causing a permanent dst reference leak and device reference leak, visible as a hang during net device unregistration (e.g., sit interfaces).

In the Linux kernel, in the io_uring subsystem for network commands, the skb_queue_splice() function received transposed arguments when retrying timestamp retrieval. This caused packets to be spliced in the wrong direction, into the on-stack list instead of the socket queue. The fix reverses the arguments to restore correct behavior.

A race condition in the Linux kernel's veth driver can permanently stall the TX queue, observed on ARM64 systems (Ampere Altra Max). This leads to a complete halt of network traffic.

In the Linux kernel's SMB client, an incomplete backport of a fix misses a kref_put() call in cfids_invalidation_worker(). This can lead to a use-after-free (UAF) vulnerability.

A lockdep WARN was found in the NVMe multipath driver in the Linux kernel due to partition scan work. The dependency among open_mutex, kblockd workqueue, and partition scan can lead to a deadlock.

In the Linux kernel ice driver, a vulnerability was found due to improper cleanup of PTP resources during driver removal in an error path. Missing calls to ice_ptp_cleanup_pf and deinitialization of the 'ps_lock' mutex cause a warning and call trace when freeing the ice_adapter object.

In the Linux kernel's statmount_string() function, an uninitialized 'offp' pointer exists for STATMOUNT_MNT_UIDMAP and STATMOUNT_MNT_GIDMAP flags, which can lead to dereferencing uninitialized memory.

In the Linux kernel, the widen_imprecise_scalars() function in BPF fails to account for differences in stack depth between states, potentially causing out-of-bounds stack memory access.

In the DRM driver for Intel Xe GPUs (drm/xe/guc), a missing synchronization during device unbind allows the Dead CT worker to run after resources are freed, leading to a use-after-free condition.

In the Linux kernel netfilter subsystem, a vulnerability was found where the seqadj extension is missing for NATted connections when a conntrack helper is assigned. This causes kernel warnings and incorrect NAT translation for FTP traffic in PASV/EPSV modes, potentially leading to connection drops.

In the Linux kernel for AMD Zen5 CPUs, a missing terminator in the zen5_rdseed_microcode array causes an out-of-bounds read when running x86_match_min_microcode_rev().

In the Linux kernel, a vulnerability in the DRM driver for MSM (Qualcomm) chipsets has been fixed, which caused a warning (splat) when freeing imported DMA buffers (dma-buf). The issue occurred when msm_gem_free_object incorrectly handled the _NO_SHARE case for objects with an external reservation (resv).

In the Linux kernel DRM driver for Mediatek, a bug was found in AFBC (ARM Frame Buffer Compression) support. This feature, added in commit c410fa9b07c3, causes VBlank timeouts and garbled rendering on MT8188 (Genio 700 EVK) when AFBC is used by default by Mesa since v25.0. As a result, AFBC support has been disabled until a fix is available.

In the Linux kernel, a bug in the IMA module caused the IMA_DIGSIG flag to be cleared when setting or removing extended attributes (xattr) other than security.ima. In IMA and EVM fix mode, this replaced the IMA signature with a plain hash, preventing the generation of a valid reference signature.

In the iwlwifi driver in the Linux kernel, a potential use-after-free (UAF) exists in iwl_mld_remove_link(), where the 'fw_id' field is read after freeing the 'link' structure.

In the radeon DRM driver, calls to drm_put_dev() were removed but remained in error and device removal paths, causing double-free and use-after-free warnings.

On s390 architecture, enabling HVO optimization (ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP) causes crashes because kernel page table modifications violate architecture requirements – replacing entries without special instructions leads to data corruption.

In the Linux kernel driver for NXP i.MX8 ISI, a vulnerability was found where the release function incorrectly calls stream cleanup even when the stream is active. This causes kernel errors and warnings when device parameter queries (e.g., via v4l2-ctl) are performed during an active video stream.

In the Linux kernel's amd/amdkfd driver, a race condition was found between kfd_process release and partition switching, causing a division by zero in kfd_get_num_sdma_engines. The fix introduces an atomic counter kfd_processes_count to synchronize KFD process creation and teardown.

In the Linux kernel, during signal delivery to a non-AMX task preempted by an AMX task, the XFD state in the CPU is not synchronized, causing a warning and potential issues.