CVE Vulnerability Catalog

In the Linux kernel, the jbd2 shrinker only counted successfully released checkpoint buffers against nr_to_scan, so busy buffers did not consume the scan budget. With a large checkpoint list mostly of busy buffers, the shrinker could scan the entire list while holding journal->j_list_lock, causing long lock hold times and soft lockups or RCU stalls.

In the Linux kernel, journal_shrink_one_cp_list() skips busy checkpoint buffers when called with JBD2_SHRINK_BUSY_SKIP, and the continue statement also skips the need_resched() check at the end of the loop body. When a checkpoint list contains mostly busy buffers, the shrinker can walk the entire list while holding journal->j_list_lock even when a reschedule has been requested, causing soft lockups or RCU stalls.

In the Linux kernel, in collect_md mode ipip_tunnel_rcv() returns 0 without freeing the skb when ip_tun_rx_dst() fails to allocate the metadata_dst. Since ipip_rcv() and mplsip_rcv() are registered as xfrm_tunnel handlers, tunnel4_rcv() and tunnelmpls4_rcv() read the zero return as 'packet consumed' and do not free it either, leaking the skb.

A use-after-free vulnerability exists in the Linux kernel's IPv4/IPv6 multicast forwarding path. When a multicast packet is not locally deliverable, the skb retains an skb->sk association set by bpf_sk_assign() or UDP early demux even though a socket reference is not guaranteed. After the prefetched socket is destroyed, a later skb free invokes sock_pfree() and dereferences the stale skb->sk.

In the Linux kernel, ip6_tnl_xmit() uses skb_realloc_headroom(), which replaces the caller-owned skb and keeps the replacement only in a local variable. If an error occurs after reallocation (e.g., non-NONE encap rejection in collect_md tunnels or ip6_tnl_encap() failure), the caller still holds the original skb pointer, leading to a double free of the skb.

In the Linux kernel, ip6gre_tnl_link_config_route() incorrectly accumulates the lower device's hardware header length into dev->hard_header_len for NBMA ip6gre tunnels. This results in an incorrect hardware header length for the tunnel, potentially causing packet transmission issues.

A NULL pointer dereference vulnerability exists in the Linux kernel's ipv6_rpl_srh_rcv() function, which reads idev->cnf.rpl_seg_enabled without checking whether idev from __in6_dev_get() is NULL. When the device MTU drops below IPV6_MIN_MTU, addrconf_ifdown() clears dev->ip6_ptr, and a packet that passed the earlier idev check can reach ipv6_rpl_srh_rcv() with a NULL pointer.

A vulnerability in the Linux kernel's Landlock mechanism related to whiteout object creation used by OverlayFS has been fixed. Creating whiteouts via mknod(2) with S_IFCHR and makedev(0,0), and via renameat2(2) with RENAME_WHITEOUT, was not properly restricted by Landlock permissions, allowing bypass of restrictions. The fix requires LANDLOCK_ACCESS_FS_MAKE_REG for both cases.

In the Linux kernel, __nd_label_validate() in libnvdimm/labels has an integer overflow. The nslot field (u32) is multiplied by the label size in 32-bit arithmetic, which can wrap around and bypass the bounds check, leading to an out-of-bounds write in nd_label_data_init().

In the Linux kernel, the still_degraded variable in raid10_sync_request() was inverted (set to false instead of true) during conversion from int to bool. This causes the bitmap to be incorrectly cleared when recovering a device while another mirror is still missing, leading to silent data corruption after the missing device is re-added.

In the Linux kernel, the super_1_load() function in the md module did not validate the range of sb->bblog_shift loaded from the on-disk superblock. This value (0-255) is used as a bit shift when computing sector and block counts, which with an invalid value can overflow a 64-bit variable and cause an error in badblocks_set() in block/badblocks.c.

In the Linux kernel, elf_validity_cache_secstrings and elf_validity_cache_index_str access the section name table (.shstrtab) and symbol string table (.strtab) headers without first ensuring their type is SHT_STRTAB. If a section type is SHT_NULL or SHT_NOBITS, sh_offset has not been validated and may reference out-of-bounds memory, causing an out-of-bounds read.

In the Linux kernel, mpls_select_multipath() caches the hdr pointer to the MPLS header and then calls pskb_may_pull(), which may replace the skb head and free the old one, leaving hdr pointing to freed memory. This leads to a use-after-free when reading the inner IP header.

In the Linux kernel, mptcp_token_join_cookie_init_state() fails to restore the local_id field from the saved cookie entry when rebuilding the request socket for an MP_JOIN handled under SYN cookies. The uninitialized field is then read by subflow_ulp_clone() and stored as the joined subflow's address-ID, which an off-path peer can influence by sending concurrent MP_JOIN SYNs.

In the Linux kernel, the nouveau/gem driver has a race in the non-uvmm path between the info lookup finding the vma and the gem close path closing the vma, leading to a use-after-free.

In the Linux kernel, param_set_charp() releases the previous parameter value before the replacement allocation succeeds. If kmalloc_parameter() fails, the setter returns -ENOMEM with the parameter left as NULL, which can later trigger a NULL pointer dereference, e.g., when failing zswap's compressor update before zswap is initialized.

In the Linux kernel, xdr_buf_trim() does not clamp the subtraction from buf->len, so when buf->len is smaller than the sum of iov_lens, an underflow occurs and wraps to near UINT_MAX. This state is reachable via gss_krb5_unwrap_v2(), and the wrapped value propagates as the authoritative stream bound into all downstream XDR decoders.

In the Linux kernel, svcauth_gss_unwrap_priv() only validated an upper bound on the wire-supplied opaque length before passing the buffer to gss_unwrap(), with no minimum length check. A token of 16 bytes or less (the RFC 4121 header size) reached gss_krb5_unwrap_v2(), where header reads ran past the token and rotate_left() could divide by zero. The fix adds a minimum-length check before the token reaches the krb5 unwrap core.

In the Linux kernel, svc_pool_for_cpu() can select a pool with no threads when a service runs fewer threads than it has pools (e.g., nfsd in pernode/percpu mode with fewer threads than NUMA nodes). A transport enqueued on such a pool is never picked up, causing the connection to hang indefinitely.

In the Linux kernel, sunrpc_destroy_cache_detail() only cancels the global cache_cleaner delayed_work when cache_list is empty, which never happens during per-netns teardown. This leads to a use-after-free where cache_clean() may still hold a dangling pointer to the freed cache_detail.