CVE Vulnerability Catalog

In the Linux kernel, the ravb driver can dereference an invalid PTP clock because the PTP clock is unavailable before the first open, and registration failures can leave an error pointer in priv->ptp.clock. Querying the clock index can then cause a NULL or error pointer dereference.

In the Linux kernel, the ravb Ethernet driver's PTP interrupt handler ravb_ptp_interrupt() can race with ravb_ptp_stop(), passing the clock pointer to ptp_clock_event() while ptp_clock_unregister() is freeing it, leading to a use-after-free. The fix uses READ_ONCE()/WRITE_ONCE() for lockless access, atomically detaches the clock with xchg() before disabling PTP interrupts, and synchronizes IRQs before unregistering.

In the Linux kernel, the Thunderbolt driver's tb_xdomain_alloc_in_hopid() passes the wanted HopID as the lower bound to ida_alloc_range(), so a taken ID is not an error and the allocator returns the next free one. tbnet_connected_work() treats any other ID as a failure and returns without releasing the allocated ID, leaving it live for the rest of the XDomain connection. The fix releases the ID when it is not the one requested.

In the Linux kernel, every failure path in the Thunderbolt driver's tbnet_connected_work() undoes its own work and returns without clearing login_sent, so the connection still looks established. The next tbnet_tear_down() repeats a teardown that already happened: it stops already-stopped rings (dev_WARN(), fatal under panic_on_warn) and releases net->remote_transmit_path even on the HopID mismatch path where this connection never owned that ID. The fix clears login_sent on those paths.

In the Linux kernel, the NTB ntb_transport module's ntb_transport_tx_enqueue() was meant to drop packets submitted while the QP link is down, but it only returned 0 without consuming the packet. Zero means success, so ntb_netdev reports NETDEV_TX_OK and forgets the skb — nothing queued or freed it, leaking one skb per transmit racing a link-down. The fix returns -ENOLINK, restoring the contract that a non-zero return leaves the buffer owned by the caller.

In the Linux kernel, the NTB ntb_transport module's ntb_process_tx() handles an oversized buffer by calling tx_handler() with a NULL data pointer and returning success. ntb_netdev therefore neither frees the skb in its completion callback nor takes its enqueue error path, leaking it. The fix rejects oversized buffers in ntb_transport_tx_enqueue() before acquiring a queue entry and returns -EMSGSIZE.

In the Linux kernel, a flaw exists in net/smc where the peer rkey counts in SMC-Rv2 LLC messages are not bounded. On links with a device having max_recv_sge == 1, smc_llc_save_add_link_rkeys() reads the v2 extension beyond the allocated buffer, causing a slab-out-of-bounds read. This occurs on every SMC-Rv2 link addition regardless of what the peer sends.

In the Linux kernel, the net/smc module's smc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys() read the part of a v2 message that does not fit into the 44-byte smc_llc_msg union, bounding themselves by the buffer size rather than what arrived. On a link with a shared v2 receive buffer, a 44-byte DELETE_RKEY_V2 declaring 255 rkeys reaches rkey[9..254] in leftover data and passes them to smc_rtoken_delete(), potentially deleting a registered rtoken. The fix copies the tail into the queue entry and declares inline rkeys as a union member.

In the Linux kernel, the net/smc module's smc_close_stream_wait() calls smc_tx_prepared_sends() inside its sk_wait_event() condition, which is evaluated once with the socket lock released. smcd_buf_detach() clears conn->sndbuf_desc from smc_conn_kill() under lock_sock(), so a link group terminating while a socket waits leaves the helper dereferencing NULL, faulting out of close(). The fix samples the pointer once in the helper and reports nothing prepared while it is unset.

In the Linux kernel, the net/smc module's smc_switch_conns() takes a reference on the SMC socket before dropping lgr->conns_lock so the connection stays alive while the CDC slot is fetched. The err_out label only drops the wr_tx link reference, so this early exit returns without the matching sock_put(). A leaked sk_refcnt means the smc_sock is never destroyed, its buffers stay allocated, and the network namespace reference is never released, preventing netns teardown. The fix restructures so a single sock_put() covers both outcomes.

In the Linux kernel, the net/smc module's smc_rx_splice() hands RMB pages to a pipe and takes a socket reference per entry so the smc_sock stays alive until the reader finishes. The connection does not: a concurrent close runs smc_conn_free(), which releases the receive buffer back to the link group pool. smc_rx_pipe_buf_release() tests sk_state before taking the socket lock; the state can change between the test and the lock, and smc_rx_update_cons() then dereferences conn->rmb_desc and walks conn->lgr, which smc_conn_free() has already released — a use-after-free. The fix takes the socket lock first and tests conn->freed instead.

In the Linux kernel, smc_llc_srv_add_link() in the net/smc subsystem contains a use-after-free flaw. The add_llc pointer references a queue entry that is freed by smc_llc_flow_qentry_del() and then used by smc_llc_save_add_link_rkeys() on a link without a shared v2 receive buffer. The issue has been fixed.

In the Linux kernel's net/smc subsystem, three connection state flags (killed, freed, out_of_sync) are single-bit bitfields sharing one byte of struct smc_connection. Because they are not written under a common lock, storing one flag performs a read-modify-write that corrupts the neighbouring bits, causing a race and inconsistent connection state.

In the Linux kernel's net/smc subsystem, smc_conn_free() unregisters the connection only while the link group is still on its device list and never sets conn->killed. In the window between unlinking the group and killing its connections, the device can re-arm the receive tasklet after tasklet_kill() has returned, leading to a use-after-free.

In the Linux kernel, IP tunnel devices derive their advertised needed_headroom from lower output devices. A stack of user-created devices can make the derived value exceed the range representable by 16-bit skb header offsets, so once IP output reserves it, skb head expansion can wrap those offsets.

In the Linux kernel, skb_tx_error() completes the zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, while skb_zcopy_downgrade_managed() clears SKBFL_MANAGED_FRAG_REFS — both in skb_shinfo(), which every clone shares. With an Open vSwitch clone (OVS_ACTION_ATTR_RECIRC) this strips the marker from a packet still being forwarded and a later local ESP delivery decrypts in place over frags it does not own privately.

A vulnerability exists in the Linux kernel's IPv6 segment routing (SRv6) handling. The decap_and_validate() function fails to reset the IPv6 control block (IP6CB) after decapsulation, allowing an unprivileged user to trigger a slab-out-of-bounds read in ip6_protocol_deliver_rcu().

In the Linux kernel, a vulnerability exists in the mfd: qnap-mcu driver. The qnap_mcu_exec() function publishes an on-stack buffer (rx) to the receive path, which can write to it after a command timeout or write failure when the stack frame is no longer valid. This leads to stack memory corruption and potential arbitrary code execution.

In the Linux kernel, memory allocated for the sm501_devdata structure in sm501_pci_probe() and sm501_plat_probe() is not freed by the corresponding remove functions sm501_pci_remove() and sm501_plat_remove(). This causes a memory leak on each device removal.

In the Linux kernel, the ALSA driver for USB 6fire devices (snd_usb_6fire) allowed usb6fire_comm_receiver_handler() to forward a MIDI event using a device-supplied length byte without any bound check. A malicious or faulty device could supply a length of 0xFF, causing a 255-byte read from a 64-byte buffer (out-of-bounds read). The issue occurs on device plug-in, and bytes beyond the buffer may be exposed to userspace via the rawmidi interface.