CVE Vulnerability Catalog

In the Linux kernel, openvswitch's queue_userspace_packet() calls skb_tx_error() on a packet it does not own and that is still being forwarded. This strips SKBFL_SHARED_FRAG from the live skb, causing a later local ESP-in-UDP delivery to decrypt in place over pages the sender does not own, enabling an unprivileged page-cache write (the "Fragnesia" primitive).

In the Linux kernel, the IPMI subsystem has a use-after-free in _ipmi_destroy_user(). Removing the synchronize_rcu() between unlinking command receivers from intf->cmd_rcvrs and freeing them allows a reader to still hold a pointer to a freed cmd_rcvr. The cmd_rcvrs list is still traversed under plain RCU, so the missing grace period causes a use-after-free.

In the Linux kernel, lockd's nlm_traverse_files() pins the current file with f_count++ across a mutex unlock but does not pin the saved next pointer. A concurrent nlm_release_file() can free next during the unlock window, and the iterator dereferences freed memory on the next loop step. The fix pins both files and releases them after the iteration.

In the Linux kernel, lockd's nlmclnt_locks_init_private() installs NLM file lock operations even when nlmclnt_find_lockowner() fails to allocate a lockowner. The VFS still tears down the partially initialized file_lock and calls locks_release_private(), which dereferences fl->fl_u.nfs_fl.owner and crashes (NULL dereference). The fix clears fl_ops before initialization and installs NLM operations only after a lockowner is allocated.

A vulnerability was fixed in the Linux kernel NVMe driver where nvme_setup_discard() fell back to the per-controller ctrl->discard_page on allocation failure, which was never zeroed. As a result, up to 4080 bytes of uninitialized memory from the page's previous contents were sent to the NVMe controller.

In the Linux kernel, the nvme-tcp driver accepted C2HData based solely on blk_rq_payload_bytes() without also checking req->data_len. For REQ_OP_WRITE_ZEROES, which has no physical segments but a non-zero blk_rq_bytes(), this causes data to be copied into an uninitialized iterator, triggering a KASAN wild-memory-access in _copy_to_iter().

In the Linux kernel, the nvme-tcp driver's nvme_tcp_handle_r2t() does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it, sending the READ destination buffer (containing stale kernel data) to the controller. This leaks host memory, including struct page pointers.

In the Linux kernel, the nvme-tcp driver's nvme_tcp_recv_data() completes a request once the current C2HData PDU is consumed, without comparing total bytes received against the length the command asked for. A malicious controller can answer a 4096-byte read with 512 bytes and have it reported as complete, exposing 3584 bytes of stale page data to user space. The fix counts received bytes and refuses to complete an incomplete read.

A use-after-free vulnerability exists in the Linux kernel's SCTP handling. A remote peer can bundle COOKIE ECHO, SHUTDOWN and SHUTDOWN ACK chunks in a single packet, causing the association and its transports to be freed, after which the endpoint loop writes to freed memory. This occurs when the packet is processed from the socket backlog in task context.

In the Linux kernel, sctp_rcv() resolves the transport once per packet and keeps it in chunk->transport until processing completes. An authenticated ASCONF DEL-IP can remove and free that transport via RCU in the meantime, and a subsequent delayed SACK then reads the freed transport's state. This results in a use-after-free.

The Linux kernel has a NULL pointer dereference vulnerability in the SCTP implementation when completing a stream reconfiguration request that has not yet been transmitted. When a request is already published in asoc->strreset_chunk but has no assigned transport (chunk->transport == NULL), stopping the reconf timer dereferences NULL and panics the kernel. It can be triggered locally by an unprivileged process or remotely via a crafted RECONF packet.

In the Linux kernel, a cached SCTP RECONF chunk may contain more than one request parameter. A duplicate response can process the same ADD_OUT request again, rolling back the outcnt counter twice and potentially underflowing it. The fix tracks outstanding request types as bits and ignores later responses.

In the Linux kernel, in the power: supply: bq24257 driver the STAT-pin interrupt is devm-managed and stays armed until devm cleanup after remove() returns. remove() cancels bq->iilimit_setup_work while the threaded handler can still fire and reschedule it, dereferencing freed memory. The fix uses devm_delayed_work_autocancel() and registers the work before the interrupt request.

In the Linux kernel, in the power: supply: bq256xx driver the USB-PHY notifier queues usb_work, whose handler calls power_supply_changed(bq->charger). The reset devm action is registered before the power supplies, so devm frees bq->charger before the action runs, and a still-queued usb_work can dereference it. The fix registers the reset action after the supplies and initializes usb_work before the notifiers.

In the Linux kernel, in the power: supply: bq25890 driver bq25890_fw_probe() acquires a reference to a secondary charger via power_supply_get_by_name(), but does not release it on later probe failures or on driver detach. The fix registers a device-managed cleanup action immediately after acquiring the reference.

In the Linux kernel, the charger-manager (power: supply) driver has a use-after-free vulnerability. Regulators are freed (regulator_put) before sysfs entries are unregistered (power_supply_unregister), and sysfs entries are registered before regulators are acquired, allowing a race condition and access to freed handles.

In the Linux kernel, in the power: supply: cros_usbpd-charger driver cros_usbpd_charger_probe() reads two port counts from the EC and uses num_charger_ports as the loop bound when populating the fixed-size ports[] array of 8 entries. Without validation against EC_USB_PD_MAX_PORTS, a malfunctioning or malicious EC can report up to 255, causing a slab out-of-bounds write. The fix rejects a port count larger than the array can hold.

In the Linux kernel, in the power: supply: cros_usbpd-charger driver the probe iterates based on the raw charger port count returned by the embedded controller. The only check is against the number of USB PD ports also defined by the EC, so a malicious EC could return an inaccurate count (up to 255), causing an out-of-bounds write and memory corruption. The fix limits port counts to EC_USB_PD_MAX_PORTS.

In the Linux kernel, in the power: supply: lp8727 driver lp8727_release_irq() cancels pchg->work before freeing the IRQ, so an IRQ delivered in between can re-arm the work through the threaded handler. After .remove returns, the devm layer frees pchg while lp8727_delayed_func() may still run and dereference it. The fix frees the IRQ first, then cancels the work.

In the Linux kernel, the lp8788-charger driver has a use-after-free on device removal. lp8788_charger_remove() flushes charger_work before unregistering IRQs, so an IRQ thread can queue work after flush_work() returns, and the work then dereferences freed pchg memory.