CVE Vulnerability Catalog

In the Linux kernel, the RSS context delete logic in the bnxt_en driver was fixed. The netif_running() check caused firmware VNIC leaks when closing with active RSS contexts, potentially leading to loss of active RSS contexts.

On Alpha systems with memory compaction enabled, the Linux kernel could cause sporadic user-space crashes and heap corruption due to insufficient TLB shootdown during page migration. The fix introduces a dedicated helper combining MM context invalidation, immediate per-CPU TLB invalidation, and synchronous cross-CPU shootdown.

A vulnerability has been identified in the Linux kernel related to the ovpn module, concerning the processing of TCP stream data. Issues with header offset overflow and misaligned protocol headers may lead to packet loss and performance degradation.

In the Linux kernel iommu/amd module, with iommu.strict=1 the completion wait path can cause soft lockups under stressed environments, because wait_on_sem() busy-waits under the spinlock with interrupts disabled. The fix moves the completion wait out of the spinlock.

In the Linux kernel, the ChipIdea UDC driver's _ep_nuke() returned requests to the gadget layer without properly unmapping DMA buffers or cleaning up scatter-gather bounce buffers. This caused alignment errors and potential memory corruption when a USB device was reconnected after disconnection during an active transfer.

The Linux kernel contains a double-free bug in the xen_9pfs_front_free() function within the 9p/xen subsystem. The xenwatch thread can race with other back-end change notifications and invoke this function twice, causing memory corruption and a general protection fault. The fix guards the teardown path so only one caller can release the front-end state at a time.

In the Linux kernel, the vhost subsystem has a missing bounds check for vdpa groups. In vdpa_sim, a valid ASID can be assigned to a group equal to ngroups, causing an out-of-bounds write.

A vulnerability in the Linux kernel has been resolved that allowed two query interface operations to concurrently update interfaces. A locking mechanism has been introduced to prevent these races.

In the Linux kernel, the amdgpu_gem_va_ioctl function in the AMDGPU driver has a dma_fence reference management flaw leading to refcount underflow and use-after-free. This can cause a kernel panic during GPU timeline updates.

A vulnerability was fixed in the Linux kernel's netfilter nf_conntrack_h323 module, in the decode_choice() function. The boundary check before calling get_len() used the variable len set to 0, allowing a 1-2 byte out-of-bounds heap read. It can be triggered remotely by sending a crafted Q.931 SETUP message to port 1720 when the nf_conntrack_h323 helper is active.

In the Linux kernel cifs subsystem, some tcon struct fields were still protected by cifs_tcp_ses_lock instead of the dedicated tc_lock. The fix replaces those uses with the proper tc_lock, ensuring consistent and more granular locking.

In the Linux kernel, a vulnerability exists in KVM on x86: __get_sregs2() reads PDPTR registers without the required SRCU protection. Reading PDPTRs may trigger guest memory access, causing a lockdep warning about suspicious RCU usage. The issue was found by Syzkaller and fixed by adding SRCU protection.

A vulnerability was found in the Linux kernel's rtw89 Wi-Fi PCI driver due to missing validation of the sequence number in the TX release report. Hardware rarely reports an abnormal sequence number, which leads to an out-of-bounds access of the wd_ring->pages array and a NULL pointer dereference, causing a kernel crash (oops).

In the Linux kernel PCI subsystem, after commit a4e772898f8b, pci_slot_trylock() delegates the bridge lock to pci_bus_trylock() but failed to remove the corresponding pci_dev_unlock() on the failure path. This results in unlocking a lock no one holds or incorrectly unlocking a lock owned by another thread.

In the Linux kernel drm/amdkfd driver, kfd_event_page_set() writes KFD_SIGNAL_EVENT_LIMIT * 8 bytes via memset without checking the buffer size parameter. An unprivileged user can trigger an out-of-bounds kernel memory write by passing a small buffer.

In the Linux kernel net/mlx5e driver there is a "scheduling while atomic" bug in mlx5e_ipsec_init_macs(). The function mlx5_query_mac_address() performs a hardware query (mlx5_cmd_exec) that can sleep, but it is called from a workqueue running in atomic context. The fix replaces the hardware query with reading the MAC address directly from netdev->dev_addr.

A bug in the Linux kernel's handling of transmit errors for GSO frames has been fixed. When a network device (e.g., veth) reports a transmit error for a single segment within a GSO super frame, TCP incorrectly interprets it as loss of the entire frame, causing the connection to stall and transmission to hang. The fix ignores the error code in the GSO case when no Qdisc is present.

In the Linux kernel netfilter module (xt_tcpmss), the TCP option parser reads op[i+1] without validating the remaining option length. When the last byte of the option field is not EOL/NOP and i+1 == optlen, an out-of-bounds read occurs beyond the buffer boundary (stack buffer or payload).

In the Linux kernel, the XFS filesystem has a bug in handling attribute leaf freemap entries. Zero-length freemap entries with nonzero base can be left behind, and combined with another bug in _leaf_add, this can cause overlapping entries and data loss. The fix zeroes out the base of any freemap entry with zero size.

In the Linux kernel USB kaweth driver, kaweth_set_rx_mode() calls netif_stop_queue() and netif_wake_queue(), which are TX queue flow control functions unrelated to RX multicast configuration. The premature netif_wake_queue() can re-enable TX while tx_urb is still in-flight, causing a double usb_submit_urb() on the same URB.