CVE Vulnerability Catalog

In the Linux kernel, a vulnerability was resolved in iomap where a non-existent integrity payload was freed. fs_bio_integrity_alloc might not allocate a bio integrity payload if PI verification is disabled on the block device — the fix checks for that case before calling fs_bio_integrity_free in iomap_bio_read_folio_range_sync to avoid a NULL pointer dereference.

In the Linux kernel, an IRQ leak on the cpuhp_setup_state error path in the nxp-pit clocksource driver was resolved. When cpuhp_setup_state fails after pit_clockevent_per_cpu_init successfully called request_irq, the error handling skips freeing the registered IRQ, leaking the IRQ line and leaving a dangling pointer as the interrupt handler's dev_id, potentially leading to a use-after-free.

A bug was fixed in the Linux kernel in backing_file_open(), which derived the path stored in a new backing file from user_file->f_path. With nested filesystems (e.g. overlayfs on top of overlayfs) this caused an incorrect internal intermediate-layer path to be stored instead of the user-visible path. As a result, files mapped through a nested overlayfs showed the wrong path in /proc/<pid>/maps and in perf/ftrace mmap records.

In the Linux kernel, ovl_create_real() in overlayfs calls end_creating() twice on the casefold-mismatch error path. This causes the parent directory's i_rwsem to be unlocked twice and the dentry reference to be released twice, leading to a deadlock on subsequent creation operations under that parent. The issue is reachable by an unprivileged user.

In the Linux kernel, the PIDFD_GET_*_NAMESPACE ioctls in pidfd_ioctl() perform a ptrace access check based on credentials but, unlike the corresponding procfs paths, do not hold the target task's exec_update_lock. This allows a caller to pass the check against the target's old credentials and then read the namespace after the target has execve()'d a setuid binary and committed new credentials. The fix holds exec_update_lock for reading around the ptrace check and namespace lookup.

In the Linux kernel on native sparc64, struct __kernel_old_timeval contains a four-byte hole after tv_usec because tv_sec is 64-bit while __kernel_suseconds_t is 32-bit. put_itimerval() fills only the named fields in a stack-allocated __kernel_old_itimerval and copies the entire object to userspace, so getitimer() can expose the two padding holes. The fix zero-initializes the aggregate before assigning the fields.

In the Linux kernel's Rust devres layer, a race condition occurs when two paths concurrently revoke a Devres. devres_release_all() calls Revocable::revoke() via the release callback, while Devres::drop() calls revoke_nosync() on another CPU. The revoker that does not claim the is_available swap returns immediately, but the other may still be executing drop_in_place() on the inner data, causing a use-after-free. The fix adds a Completion that Devres::drop() waits on when it loses the is_available swap.

A use-after-free vulnerability exists in the Linux kernel's trusted keys (KEYS: trusted) module due to incorrect TPM teardown ordering. The trusted_tpm_exit() function drops the TPM chip reference and frees the digest array before unregistering the trusted key type, allowing a concurrent key operation to dereference freed memory.

A use-after-free (UAF) vulnerability in the Linux kernel's AppArmor module, related to begin_current_label_crit_section(), has been fixed. The function could directly replace credential pointers (struct cred) during an LSM hook invocation, causing task->cred and task->real_cred to become inconsistent and leading to freed credential memory still being referenced by other tasks.

A fix has been applied in the Linux kernel for an out-of-bounds write in the AppArmor aa_vec_unique() function. When all label components are distinct, the NULL terminator is written to vec[n], but vec_setup() does not reserve space for this extra entry, causing a write one element past the end of the local array or allocation. The vulnerability can be triggered by an unprivileged task writing to /proc/self/attr/apparmor/current or via lsm_set_self_attr(2), and also through the securityfs .access file which is mode 0666.

In the Linux kernel, a bug in swap memory management causes hibernation slots to be freed even when a folio is present in the swap cache. The function swap_free_hibernation_slot() clears the entry under that folio, making it unreachable from the swap table and allowing the offset to be reused by another process. This can trigger silent memory corruption, process crashes, or data instability across unrelated userspace applications, typically when uswsusp is preparing the hibernation image.

In the Linux kernel, a vulnerability was fixed in the kmemleak module where kmemleak_scan() scanned all task stacks under a single RCU read-side critical section with no reschedule point. On hosts with very many threads, this could hog a CPU and trip the soft lockup watchdog. The fix walks tasks one PID at a time using find_ge_pid() and releases the RCU lock between tasks.

A vulnerability exists in the Linux kernel's queue_folios_pmd() function in mm/mempolicy, which fails to skip non-present PMD entries (e.g., device-private) before calling pmd_folio(). This can lead to VM_BUG_ON() on debug kernels, an oops on a bogus vmemmap dereference, or silently isolating an unrelated live folio from LRU. The issue is triggered when an HMM-based GPU driver migrates an anonymous THP folio to device memory and userspace then calls mbind(), migrate_pages(), or set_mempolicy_home_node().

In the Linux kernel, the mglru mechanism's sort_folio() function contained a buggy shortcut for folios that are no longer evictable but still on a generation list. The bug caused mlock_count to alias LIST_POISON2 (0x122, i.e. 290), leading to incorrect Mlocked accounting and folios remaining unevictable until freed. The shortcut also manipulated LRU flags in the wrong order, potentially causing unexpected behavior during concurrent folio isolation.

In the Linux kernel, migrate_pages_batch() unmaps each folio, which on KVM hosts triggers expensive MMU notifier callbacks and keeps the CPU busy for a long time. The loop only calls cond_resched(), which is a no-op on PREEMPTION kernels, so the migrating task (e.g. kcompactd) never reports a Tasks-RCU quiescent state and stalls the Tasks-RCU grace period for minutes.

In the Linux kernel, __migrate_device_pages() reads the folio mapping before calling folio_free_swap(). When folio_free_swap() succeeds, the folio is removed from the swap cache but the saved mapping still points to swap_space, leading to use of a stale mapping and invalid reference accounting, eventually triggering a folio reference count BUG.

A flaw in the Linux kernel's mm/pagewalk mechanism causes walk->action to remain incorrectly set to ACTION_AGAIN after a PMD entry is cleared, leading to duplicate walk callbacks and an out-of-bounds write. This was detected by KASAN in __mincore_unmapped_range.

In the Linux kernel, the scan loop in shrink_lruvec() only calls cond_resched(), which is a no-op on PREEMPTION kernels. As a result, the reclaiming task never reports a Tasks-RCU quiescent state and becomes a holdout, causing rcu_tasks stalls during reclaim.

In the Linux kernel, kernfs serializes file operations only per open file, so concurrent writes to memory.high or memory.max can overlap. If another writer raises or removes the limit, the first writer may keep reclaiming toward a stale target, and for memory.max it can loop indefinitely while repeatedly incrementing the OOM event counter.

On x86, TDX port I/O handling (handle_in() and handle_out()) uses the mask GENMASK(BITS_PER_BYTE * size, 0), which includes the high bit. For size=1 this yields a 9-bit mask 0x1FF instead of the 8-bit 0xFF, making the mask one bit too wide for all I/O sizes.