CVE Vulnerability Catalog

In the Linux kernel devlink_nl_reload_doit() function, there is a net namespace reference leak. When the requested namespace differs from the current one and the reload action is not DRIVER_REINIT, the function returns -EOPNOTSUPP without releasing the reference obtained by devlink_netns_get().

In the Linux kernel's mlx5 driver, a vulnerability exists where the firmware tracer creation function can return either NULL or ERR_PTR. The return value is stored without a check, and during core dump generation, an invalid pointer is dereferenced, causing a kernel panic.

In the Linux kernel amdxdna_insert_pages() function in the accel/amdxdna driver, there is a BUG_ON vulnerability. The vm_flags_mod() call sets VM_MIXEDMAP and clears VM_PFNMAP, allowing an unprivileged process to call madvise(MADV_DONTNEED) on a mapped GEM object, and subsequent memory access triggers BUG_ON in vmf_insert_pfn_prot() due to pfn_valid(pfn) and VM_MIXEDMAP.

A vulnerability in the Linux kernel's BPF conntrack kfuncs was found, where the opts argument can point to a shared map value. Inconsistent reads of the netns_id field during acquisition and release of network namespace references can lead to reference imbalance, potentially destroying a live namespace and crashing the system.

A use-after-free vulnerability was found in the Linux kernel's bpf_iter_tcp_established_batch() for TCP_NEW_SYN_RECV sockets. The request_sock is published on the ehash chain before its refcount is set, and the BPF iterator uses plain sock_hold() instead of refcount_inc_not_zero(), leading to a race that overwrites the refcount and causes use-after-free.

A vulnerability in the Linux kernel's vhost_iotlb mechanism allows IOTLB entries to be allocated beyond the configured limit, leading to uncontrolled memory consumption. Affected components include vhost, vDPA, VDUSE, and vhost-vDPA devices that may create tables with zero or no limits. The fix enforces the limit and rejects invalid values.

In the Linux kernel, a vulnerability in the vdpa/mlx5 driver leads to a slab-out-of-bounds read. The issue is caused by incorrect calculation of the input buffer size in create_direct_keys(), resulting in reading 16 bytes beyond the allocated region.

A type confusion vulnerability was found in the Linux kernel's hwmon driver for PMBus devices. The pmbus_notify() function incorrectly casts different attribute types to sensor_device_attribute, which may lead to an out-of-bounds read or incorrect mask matching during alerts. The fix changes the attribute structures and sets the index to -1 for attributes that do not trigger notifications.

In the Linux kernel, AF_XDP accepts a TX metadata length as small as eight bytes, but every supported request needs flags plus at least one eight-byte field. Such short metadata can let the kernel read beyond the registered area.

In the Linux kernel, AF_XDP allows user space to change metadata flags after request processing. Rereading them during completion can make the kernel write a timestamp that was not requested when the packet was submitted. The fix clears the metadata pointer during request processing unless timestamp completion is requested.

In the Linux kernel, AF_XDP launch-time metadata extends beyond the first 16 bytes of struct xsk_tx_metadata. The vulnerability allows rejecting the request when the registered metadata area does not contain the complete field. The fix also snapshots validated flags for the generic transmit path to avoid inconsistent decisions if user space changes flags concurrently.

In the Linux kernel, the zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request. User space can change the metadata between those operations and bypass the original validation. The fix validates metadata in xsk_tx_metadata_request() and uses the resulting flags snapshot for every feature check.

In the Linux kernel, the bnge driver has a NULL pointer dereference vulnerability in the auxiliary device release function. If allocation of auxr_dev fails during auxiliary device setup, the error path calls auxiliary_device_uninit(), which eventually invokes bnge_aux_dev_release(). The release callback unconditionally dereferences aux_priv->auxr_dev->pdev, causing a NULL pointer exception.

In the Linux kernel, __skb_udp_tunnel_segment() has a potential use-after-free vulnerability. It gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb->head, the saved UDP header pointer becomes invalid.

In the Linux kernel, the sch_cake ACK filter contains a WARN_ON(1) that can be triggered by a malformed IP header. Depending on system configuration, this leads to spamming dmesg with warnings or a panic if panic_on_warn is set. The fix removes the WARN_ON because the code already correctly skips the offending packet.

In the Linux kernel, the vhost-scsi subsystem has a vulnerability due to missing validation of T10 PI scatterlist counts. A malformed request can claim protection bytes that cover or exceed the payload length, leading to a zero data SGL count reaching sg_alloc_table_chained(), which triggers BUG_ON(!nents).

A vulnerability in the Linux kernel's vhost-scsi allows feature changes after endpoint activation, leading to a kernel panic. Enabling T10-PI after setup leaves protection scatterlists uninitialized, triggering a BUG_ON in sg_alloc_table_chained().

In the Linux kernel, the openvswitch module's key_extract() function does not check the Ethernet header length before accessing it, which can lead to a kernel BUG in __skb_pull() for packets arriving on ARPHRD_NONE devices such as TUN. The fix is to call check_header() before accessing the Ethernet header.

A vulnerability was found in the Linux kernel's network filter mechanism (net/sched). The issue is a race condition during filter creation that can lead to use-after-free (UAF) in the cls_u32 class. The fix ensures rtnl_lock is always acquired when destroying locked classifiers.

In the Linux kernel, the DRM/Xe driver has a memory leak in exec_queue_set_hang_replay_state(). The q->replay_state is blindly overwritten, potentially leaking memory previously allocated by vmemdup_user(). The fix returns an error if q->replay_state is not empty.