CVE Vulnerability Catalog

In the Linux kernel svcrdma module, svc_rdma_create() calls kfree(cma_xprt) when svc_rdma_create_listen_id() fails. Because svc_xprt_init() has already acquired a net namespace reference via get_net_track(), kfree bypasses svc_xprt_free() which would release it, leading to unbalanced reference counts.

In the Linux kernel svcrdma module, the RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim. xdr_count_read_segments() checks only 4-byte alignment and never compares the position against the received inline body length, so in the single-chunk path a position past the inline body underflows the tail length and exposes adjacent slab memory, while in the multi-chunk path overlapping chunks cause unsigned underflows and copies past the receive buffer.

In the Linux kernel UDF filesystem, UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings, where s_num_entries stores the number of entries, not the highest valid index. udf_get_pblock_virt15() currently rejects only indexes greater than s_num_entries, so a crafted image can request index s_num_entries, pass the bounds check, and make the kernel read one entry past the allocated VAT table.

In the Linux kernel's ath6kl wifi driver, ath6kl_cfg80211_connect_event() subtracts fixed IE offsets from assoc_req_len and assoc_resp_len (both u8) without a lower bound. When the length is smaller than the offset, the u8 wraps to about 250, and cfg80211_connect_result()/cfg80211_roamed() treat that wrapped value as the IE length and copy that many bytes from the small assoc_info buffer to user space via nl80211, disclosing adjacent slab memory.

In the Linux kernel's mt76 wifi driver (mt7925), the pending mlo_pm_work is not cancelled in reset, suspend, and unregister paths. If the device is reset, suspended, or unregistered within that window, the pending work can still run and access already freed vif/bss data or send MCU commands while the firmware is unavailable.

In the Linux kernel's media staging/ipu7 driver, isys_register_devices() registers the V4L2 async notifier, but the probe error path (isys_probe()) only calls isys_unregister_devices(), which does not unregister or clean up the notifier. As a result, the notifier stays on the global notifier_list while the enclosing struct ipu7_isys is freed by devres, leading to list corruption and a use-after-free the next time the list is walked.

In the Linux kernel scheduler (sched/core), core scheduling's pick_next_task() breaks when a ->pick_task() implementation can release the rq lock. The selection state derived on entry is only valid while the lock is held continuously; once a pick can drop the lock, an interleaving selection can invalidate it, leading to an incorrect committed pick or skewed forceidle accounting.

In the Linux kernel scheduler (sched/core), core scheduling's pick_next_task() operates on all sibling rqs under one acquisition of the shared core-wide lock. When a ->pick_task() releases the rq lock, every sibling __lock is momentarily free, letting __sched_core_flip(false) complete mid-selection and rebind rq_lockp() under it. The selection resumes on split locks, touching sibling state it no longer protects, and __schedule() finally releases a lock that was never taken while leaking the one that was.

In the Linux kernel's sched_ext scheduler, the SCX_RQ_BAL_KEEP flag tells the pick to keep running the previous task, a leftover from when balancing and picking were separate operations. An rq-level flag only works while dispatches and picks pair up one to one, which core scheduling breaks: selections interleave through dispatch's lock drops and a pick can consume a stale flag, keeping a task that has since been dequeued.

A bug was fixed in the Linux kernel's sched_ext scheduler regarding dispatch kfuncs. Under core scheduling, ops.dispatch() may run on a different CPU than the dispatched rq, leading to incorrect assumptions in several kfunc paths, including a potential deadlock in scx_dsq_move() and incorrect resolution of SCX_DSQ_LOCAL.

In the Linux kernel, a bug in the sched_ext scheduler caused corruption of rq->core_pick state under core scheduling. When a task pick released the rq lock during dispatch, concurrent selections on the same SMT core corrupted each other's state, leading to a NULL deref or deadlock and hard hangs. The fix forces RETRY_TASK whenever dispatch released the lock, so a selection only commits picks made under a continuously held lock.

In the Linux kernel's sched_ext scheduler, scx_bpf_dsq_reenq() queues a deferred reenq (dru) that runs from run_deferred(), not ops.dispatch(). If the DSQ is destroyed before the dru runs, process_deferred_reenq_users() sees dsq->id == SCX_DSQ_INVALID and hits the BUG_ON. destroy_dsq() doesn't flush pending drus, so it should just skip.

A vulnerability exists in the Linux kernel SCSI subsystem where scsi_alloc_sgtables() leaves DMA padding bytes (pad_len) uninitialized for the last unaligned scatterlist element. This leads to an uninitialized memory read (detected by KMSAN) during DMA operations, potentially causing data leakage or system instability.

In the Linux kernel, the fnic (SCSI/FCoE) driver allocates a VLAN descriptor with GFP_KERNEL while holding the vlans_lock spinlock. GFP_KERNEL allocation may sleep, which is not allowed in this atomic context and can trigger a sleeping-from-invalid-context warning or deadlock.

In the Linux kernel, the RISC-V KVM implementation has an integer overflow in the PMU event info array size calculation. The guest-controlled num_events value is multiplied by sizeof(*einfo) and stored in a 32-bit integer, causing truncation for large values and allocation of an undersized buffer. The subsequent loop iterates over the original num_events, resulting in out-of-bounds reads and writes.

In the Linux kernel, the remoteproc subsystem (SCP driver) leaks a device reference on a failed driver data lookup before the driver has been bound. The reference taken to the SCP device is not dropped when the lookup fails.

In the Linux kernel, the qede driver (QLogic FastLinQ NIC) has a bug where memory pressure causes a NULL pointer dereference while processing TPA continuation fragments. Because tpa_info->buffer.data is not assigned in qede_tpa_start(), a "ghost" buffer with a valid DMA mapping but a NULL data pointer is pushed back into the Rx ring, causing a kernel panic in qede_fill_frag_skb().

In the Linux kernel, the RDMA/cxgb4 driver's c4iw_remove() can free ctx->dev while the queued reg_work (which registers the RDMA device) is still pending or running. This leaves c4iw_register_device() accessing the freed device.

In the Linux kernel, the RDMA/ionic driver was not adapted to the requirement of embedding struct rdma_counter in a driver-specific struct and registering its size via INIT_RDMA_OBJ_SIZE. As a result, rdma_zalloc_drv_obj() allocates zero bytes, causing a NULL pointer dereference in alloc_and_bind().

In the Linux kernel, ucma_set_ib_path() called ucma_event_handler() from the write() path without the handler lock that keeps ctx->file stable while a uevent is queued. A concurrent ucma_migrate_id() could reassign ctx->file, causing list operations on another file's event_list without the correct mutex, leading to a use-after-free (detected by KASAN).