CVE Vulnerability Catalog

A NULL pointer dereference vulnerability exists in the Linux kernel's ipv6_rpl_srh_rcv() function, which reads idev->cnf.rpl_seg_enabled without checking whether idev from __in6_dev_get() is NULL. When the device MTU drops below IPV6_MIN_MTU, addrconf_ifdown() clears dev->ip6_ptr, and a packet that passed the earlier idev check can reach ipv6_rpl_srh_rcv() with a NULL pointer.

A vulnerability in the Linux kernel's Landlock mechanism related to whiteout object creation used by OverlayFS has been fixed. Creating whiteouts via mknod(2) with S_IFCHR and makedev(0,0), and via renameat2(2) with RENAME_WHITEOUT, was not properly restricted by Landlock permissions, allowing bypass of restrictions. The fix requires LANDLOCK_ACCESS_FS_MAKE_REG for both cases.

In the Linux kernel, __nd_label_validate() in libnvdimm/labels has an integer overflow. The nslot field (u32) is multiplied by the label size in 32-bit arithmetic, which can wrap around and bypass the bounds check, leading to an out-of-bounds write in nd_label_data_init().

In the Linux kernel, the still_degraded variable in raid10_sync_request() was inverted (set to false instead of true) during conversion from int to bool. This causes the bitmap to be incorrectly cleared when recovering a device while another mirror is still missing, leading to silent data corruption after the missing device is re-added.

In the Linux kernel, the super_1_load() function in the md module did not validate the range of sb->bblog_shift loaded from the on-disk superblock. This value (0-255) is used as a bit shift when computing sector and block counts, which with an invalid value can overflow a 64-bit variable and cause an error in badblocks_set() in block/badblocks.c.

In the Linux kernel, elf_validity_cache_secstrings and elf_validity_cache_index_str access the section name table (.shstrtab) and symbol string table (.strtab) headers without first ensuring their type is SHT_STRTAB. If a section type is SHT_NULL or SHT_NOBITS, sh_offset has not been validated and may reference out-of-bounds memory, causing an out-of-bounds read.

In the Linux kernel, mpls_select_multipath() caches the hdr pointer to the MPLS header and then calls pskb_may_pull(), which may replace the skb head and free the old one, leaving hdr pointing to freed memory. This leads to a use-after-free when reading the inner IP header.

In the Linux kernel, mptcp_token_join_cookie_init_state() fails to restore the local_id field from the saved cookie entry when rebuilding the request socket for an MP_JOIN handled under SYN cookies. The uninitialized field is then read by subflow_ulp_clone() and stored as the joined subflow's address-ID, which an off-path peer can influence by sending concurrent MP_JOIN SYNs.

In the Linux kernel, the nouveau/gem driver has a race in the non-uvmm path between the info lookup finding the vma and the gem close path closing the vma, leading to a use-after-free.

In the Linux kernel, param_set_charp() releases the previous parameter value before the replacement allocation succeeds. If kmalloc_parameter() fails, the setter returns -ENOMEM with the parameter left as NULL, which can later trigger a NULL pointer dereference, e.g., when failing zswap's compressor update before zswap is initialized.

In the Linux kernel, xdr_buf_trim() does not clamp the subtraction from buf->len, so when buf->len is smaller than the sum of iov_lens, an underflow occurs and wraps to near UINT_MAX. This state is reachable via gss_krb5_unwrap_v2(), and the wrapped value propagates as the authoritative stream bound into all downstream XDR decoders.

In the Linux kernel, svcauth_gss_unwrap_priv() only validated an upper bound on the wire-supplied opaque length before passing the buffer to gss_unwrap(), with no minimum length check. A token of 16 bytes or less (the RFC 4121 header size) reached gss_krb5_unwrap_v2(), where header reads ran past the token and rotate_left() could divide by zero. The fix adds a minimum-length check before the token reaches the krb5 unwrap core.

In the Linux kernel, svc_pool_for_cpu() can select a pool with no threads when a service runs fewer threads than it has pools (e.g., nfsd in pernode/percpu mode with fewer threads than NUMA nodes). A transport enqueued on such a pool is never picked up, causing the connection to hang indefinitely.

In the Linux kernel, sunrpc_destroy_cache_detail() only cancels the global cache_cleaner delayed_work when cache_list is empty, which never happens during per-netns teardown. This leads to a use-after-free where cache_clean() may still hold a dangling pointer to the freed cache_detail.

In the Linux kernel, __svc_create() ignored the return values of percpu_counter_init() when initializing three per-pool RPC statistics counters. When a per-CPU allocation fails (e.g., under memory pressure), the RPC service (nfsd, lockd, or NFS callback service) is started with uninitialized counters whose per-CPU pointer is NULL. This silently corrupts data in the current CPU's per-CPU area and causes /proc/fs/nfsd/pool_stats to return garbage.

In the Linux kernel, a race occurs during backchannel receive when the NFS callback service is being torn down. xprt_enqueue_bc_request() may skip enqueueing or freeing the request if xprt->bc_serv has already been cleared, leading to a leak or use-after-free.

In the Linux kernel, svc_rqst_free() frees rq_argp and rq_resp synchronously while deferring the rqstp struct free via kfree_rcu(). This creates a window where RCU readers can access already freed fields, leading to a use-after-free.

The Linux kernel fixed four coupled defects in the SUNRPC gssx XDR option-array decoder. The bugs caused a NULL dereference in the caller, a refcount leak on the decoded group_info, and a latent use-after-free.

A use-after-free vulnerability exists in the Linux kernel in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir within the sunrpc subsystem. The clnt->pipefs_sb field is not refreshed on mount events nor cleared on unmount, causing comparison against a stale pointer and skipped cleanup. As a result, pipefs dentries may point to a freed rpc_clnt, leading to use-after-free during subsequent rpc_info_open() or rpc_show_info() calls.

A vulnerability was fixed in the Linux kernel's SUNRPC gss_krb5_unwrap_v2() function, which read EC and RRC header fields out of bounds before validating the token length. Unsigned arithmetic underflow could trigger a ~UINT_MAX-byte memmove, and a zero-length buffer could cause a divide-by-zero. Four defense-in-depth guards were added to validate token and buffer lengths.