CVE Vulnerability Catalog

In the Linux kernel, mctp_route_lookup() uses rt->dev without holding a reference, and mctp_route_lookup_single() returns the route under RCU only. The route's device can be torn down concurrently, leading to a use-after-free in mctp_dev_saddr() when reading rt->dev->addrs[0], reachable by an unprivileged local AF_MCTP user without CAP_NET_RAW. In the same window mctp_dev_hold() increments a refcount that has already reached zero.

In the Linux kernel, the openvswitch module has a use-after-free vulnerability involving the flow->mask pointer during flow deletion (CMD_DEL). The mask pointer is freed via RCU, but ovs_flow_cmd_fill_info() uses it after the flow is removed from the table without first taking the RCU read lock. This creates a race condition and can cause a kernel crash (KASAN slab-use-after-free) in the window between removal and info filling.

In the Linux kernel, phylink_inband_caps() only checks whether the PCS returned by mac_select_pcs is NULL, but mac_select_pcs can also return an error pointer. This causes phylink_pcs_inband_caps() to dereference ops from the phylink_pcs struct despite the error, leading to a kernel panic.

In the Linux kernel, the ravb driver can dereference an invalid PTP clock because the PTP clock is unavailable before the first open, and registration failures can leave an error pointer in priv->ptp.clock. Querying the clock index can then cause a NULL or error pointer dereference.

In the Linux kernel, the ravb Ethernet driver's PTP interrupt handler ravb_ptp_interrupt() can race with ravb_ptp_stop(), passing the clock pointer to ptp_clock_event() while ptp_clock_unregister() is freeing it, leading to a use-after-free. The fix uses READ_ONCE()/WRITE_ONCE() for lockless access, atomically detaches the clock with xchg() before disabling PTP interrupts, and synchronizes IRQs before unregistering.

In the Linux kernel, the Thunderbolt driver's tb_xdomain_alloc_in_hopid() passes the wanted HopID as the lower bound to ida_alloc_range(), so a taken ID is not an error and the allocator returns the next free one. tbnet_connected_work() treats any other ID as a failure and returns without releasing the allocated ID, leaving it live for the rest of the XDomain connection. The fix releases the ID when it is not the one requested.

In the Linux kernel, every failure path in the Thunderbolt driver's tbnet_connected_work() undoes its own work and returns without clearing login_sent, so the connection still looks established. The next tbnet_tear_down() repeats a teardown that already happened: it stops already-stopped rings (dev_WARN(), fatal under panic_on_warn) and releases net->remote_transmit_path even on the HopID mismatch path where this connection never owned that ID. The fix clears login_sent on those paths.

In the Linux kernel, the NTB ntb_transport module's ntb_transport_tx_enqueue() was meant to drop packets submitted while the QP link is down, but it only returned 0 without consuming the packet. Zero means success, so ntb_netdev reports NETDEV_TX_OK and forgets the skb — nothing queued or freed it, leaking one skb per transmit racing a link-down. The fix returns -ENOLINK, restoring the contract that a non-zero return leaves the buffer owned by the caller.

In the Linux kernel, the NTB ntb_transport module's ntb_process_tx() handles an oversized buffer by calling tx_handler() with a NULL data pointer and returning success. ntb_netdev therefore neither frees the skb in its completion callback nor takes its enqueue error path, leaking it. The fix rejects oversized buffers in ntb_transport_tx_enqueue() before acquiring a queue entry and returns -EMSGSIZE.

In the Linux kernel, a flaw exists in net/smc where the peer rkey counts in SMC-Rv2 LLC messages are not bounded. On links with a device having max_recv_sge == 1, smc_llc_save_add_link_rkeys() reads the v2 extension beyond the allocated buffer, causing a slab-out-of-bounds read. This occurs on every SMC-Rv2 link addition regardless of what the peer sends.

In the Linux kernel, the net/smc module's smc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys() read the part of a v2 message that does not fit into the 44-byte smc_llc_msg union, bounding themselves by the buffer size rather than what arrived. On a link with a shared v2 receive buffer, a 44-byte DELETE_RKEY_V2 declaring 255 rkeys reaches rkey[9..254] in leftover data and passes them to smc_rtoken_delete(), potentially deleting a registered rtoken. The fix copies the tail into the queue entry and declares inline rkeys as a union member.

In the Linux kernel, the net/smc module's smc_close_stream_wait() calls smc_tx_prepared_sends() inside its sk_wait_event() condition, which is evaluated once with the socket lock released. smcd_buf_detach() clears conn->sndbuf_desc from smc_conn_kill() under lock_sock(), so a link group terminating while a socket waits leaves the helper dereferencing NULL, faulting out of close(). The fix samples the pointer once in the helper and reports nothing prepared while it is unset.

In the Linux kernel, the net/smc module's smc_switch_conns() takes a reference on the SMC socket before dropping lgr->conns_lock so the connection stays alive while the CDC slot is fetched. The err_out label only drops the wr_tx link reference, so this early exit returns without the matching sock_put(). A leaked sk_refcnt means the smc_sock is never destroyed, its buffers stay allocated, and the network namespace reference is never released, preventing netns teardown. The fix restructures so a single sock_put() covers both outcomes.

In the Linux kernel, the net/smc module's smc_rx_splice() hands RMB pages to a pipe and takes a socket reference per entry so the smc_sock stays alive until the reader finishes. The connection does not: a concurrent close runs smc_conn_free(), which releases the receive buffer back to the link group pool. smc_rx_pipe_buf_release() tests sk_state before taking the socket lock; the state can change between the test and the lock, and smc_rx_update_cons() then dereferences conn->rmb_desc and walks conn->lgr, which smc_conn_free() has already released — a use-after-free. The fix takes the socket lock first and tests conn->freed instead.

In the Linux kernel, smc_llc_srv_add_link() in the net/smc subsystem contains a use-after-free flaw. The add_llc pointer references a queue entry that is freed by smc_llc_flow_qentry_del() and then used by smc_llc_save_add_link_rkeys() on a link without a shared v2 receive buffer. The issue has been fixed.

In the Linux kernel's net/smc subsystem, three connection state flags (killed, freed, out_of_sync) are single-bit bitfields sharing one byte of struct smc_connection. Because they are not written under a common lock, storing one flag performs a read-modify-write that corrupts the neighbouring bits, causing a race and inconsistent connection state.

In the Linux kernel's net/smc subsystem, smc_conn_free() unregisters the connection only while the link group is still on its device list and never sets conn->killed. In the window between unlinking the group and killing its connections, the device can re-arm the receive tasklet after tasklet_kill() has returned, leading to a use-after-free.

In the Linux kernel, IP tunnel devices derive their advertised needed_headroom from lower output devices. A stack of user-created devices can make the derived value exceed the range representable by 16-bit skb header offsets, so once IP output reserves it, skb head expansion can wrap those offsets.

In the Linux kernel, skb_tx_error() completes the zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, while skb_zcopy_downgrade_managed() clears SKBFL_MANAGED_FRAG_REFS — both in skb_shinfo(), which every clone shares. With an Open vSwitch clone (OVS_ACTION_ATTR_RECIRC) this strips the marker from a packet still being forwarded and a later local ESP delivery decrypts in place over frags it does not own privately.

A vulnerability exists in the Linux kernel's IPv6 segment routing (SRv6) handling. The decap_and_validate() function fails to reset the IPv6 control block (IP6CB) after decapsulation, allowing an unprivileged user to trigger a slab-out-of-bounds read in ip6_protocol_deliver_rcu().