CVE Vulnerability Catalog

This CVE record has been rejected or withdrawn by its CVE Numbering Authority. It does not contain a confirmed vulnerability or technical details.

This CVE record has been rejected or withdrawn by its CVE Numbering Authority. It does not contain a confirmed vulnerability or technical details.

A use-after-free vulnerability exists in the Linux kernel's icc_get() and of_icc_get_by_index() functions. When memory allocation for path->name fails, the error path calls kfree(path) without removing the path's requests from the req_list, leaving dangling pointers that can be dereferenced later. The fix replaces kfree(path) with icc_put(path) and ensures the icc_lock mutex is released before calling icc_put().

In the Linux kernel, ipmb_write() in the IPMI driver read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes, and a length smaller than the SMBus header underflows the block write length.

In the Linux kernel, ipmi_add_smi() creates the nr_users and nr_msgs files before trying to create the maintenance_mode file. If that last creation fails, the error path removes only nr_users before dropping the final reference to the interface, leaving the nr_msgs sysfs attribute registered in the freed interface.

A NULL pointer dereference vulnerability exists in the Linux kernel ipmi_si driver. When IPMI interface registration fails (e.g., BMC does not respond correctly to the Get Device ID command), shutdown_smi() frees si_sm and sets the pointer to NULL, but the in_shutdown flag is not set. The asynchronous redo_bmc_reg work item can then retry communication with the already-cleaned interface, causing start_kcs_transaction() to be called with a NULL pointer and resulting in a kernel crash.

In the Linux kernel, if an error occurs during startup of an IPMI interface, it may have scheduled work to run. The work needs to be canceled before the interface can be freed, which was missing in the ipmi:msghandler module.

In the Linux kernel, afiucv_hs_rcv() (net/iucv) selected an AF_IUCV socket based solely on four 8-byte name fields in the transport header, without checking the ingress net_device. This allowed a frame arriving on any netdev, including one in another network namespace, to be delivered to an AF_IUCV socket. The fix skips any socket whose hs_dev does not match the ingress device.

In the Linux kernel, xdp_convert_zc_to_xdp_frame() clones an XSK packet into an order-0 page and advertises PAGE_SIZE as its frame size, allowing the copied frame to occupy the page tail needed by skb_shared_info. This causes the skb to overlap skb_shared_info or be placed beyond the allocated page, resulting in a KASAN slab-out-of-bounds in skb_gro_receive.

A use-after-free vulnerability exists in the Linux kernel's SLIP driver within the sl_sync() function. The slip_devs[] array stores bare net_device pointers without taking references, and entries are freed outside rtnl_lock() protection, allowing access to freed memory during slip_open().

In the Linux kernel, tun_get_user() in the TUN/TAP driver uses tun->align both as skb headroom and to decide how much packet data to keep linear. When align exceeds the usable space in a one-page skb head, SKB_MAX_HEAD(align) underflows, the result becomes negative, and after assignment to a size_t it causes skb->data to be placed outside the allocated head. OVS can propagate an oversized headroom request from another port to TUN or TAP.

In the Linux kernel, the DSA driver for Realtek switches used gpiod_set_value() instead of gpiod_set_value_cansleep() in rtl83xx_reset_assert() and rtl83xx_reset_deassert() to control the reset GPIO. When the reset GPIO is provided by a sleeping controller such as an I2C I/O expander, gpiod_set_value() triggers a kernel warning. The issue affects kernels v6.9+ that contain these helper functions.

In the Linux kernel, the bnxt driver's SW USO path can return early with NETDEV_TX_BUSY even though txr->kick_pending was previously set to 1. In that case the driver writes some BDs but never writes the doorbell, causing the TX queue to stall because the device does not know it should perform the TX and generate the completion that would wake the queue.

A bug in the Linux kernel's IPA driver (net: ipa) caused the modem TX queue to stall permanently after runtime resume. ipa_start_xmit() unconditionally stopped the TX queue before calling pm_runtime_get(), relying on a wake scheduled by runtime resume to restart it. However, that wake work ran too early — before the device power state reached RPM_ACTIVE — so the queue was never restarted and transmit stalled permanently.

In the Linux kernel, the L2TP netlink handlers for tunnel create/modify and session create/modify send multicast notifications after the live operation has completed. A failure to allocate, encode, or multicast the notification is returned as the command result even though the operation already committed, which can cause callers to retry and accumulate live objects.

In the Linux kernel, mctp_route_lookup() uses rt->dev without holding a reference, and mctp_route_lookup_single() returns the route under RCU only. The route's device can be torn down concurrently, leading to a use-after-free in mctp_dev_saddr() when reading rt->dev->addrs[0], reachable by an unprivileged local AF_MCTP user without CAP_NET_RAW. In the same window mctp_dev_hold() increments a refcount that has already reached zero.

In the Linux kernel, the openvswitch module has a use-after-free vulnerability involving the flow->mask pointer during flow deletion (CMD_DEL). The mask pointer is freed via RCU, but ovs_flow_cmd_fill_info() uses it after the flow is removed from the table without first taking the RCU read lock. This creates a race condition and can cause a kernel crash (KASAN slab-use-after-free) in the window between removal and info filling.

In the Linux kernel, phylink_inband_caps() only checks whether the PCS returned by mac_select_pcs is NULL, but mac_select_pcs can also return an error pointer. This causes phylink_pcs_inband_caps() to dereference ops from the phylink_pcs struct despite the error, leading to a kernel panic.

In the Linux kernel, the ravb driver can dereference an invalid PTP clock because the PTP clock is unavailable before the first open, and registration failures can leave an error pointer in priv->ptp.clock. Querying the clock index can then cause a NULL or error pointer dereference.

In the Linux kernel, the ravb Ethernet driver's PTP interrupt handler ravb_ptp_interrupt() can race with ravb_ptp_stop(), passing the clock pointer to ptp_clock_event() while ptp_clock_unregister() is freeing it, leading to a use-after-free. The fix uses READ_ONCE()/WRITE_ONCE() for lockless access, atomically detaches the clock with xchg() before disabling PTP interrupts, and synchronizes IRQs before unregistering.