CVE Vulnerability Catalog

In the Linux kernel, the mlx5e network driver has a vulnerability due to incorrect BQL reset on SQ re-activation. mlx5e_activate_txqsq() unconditionally calls netdev_tx_reset_queue(), zeroing BQL counters of channels with in-flight TX WQEs, leading to BUG_ON in dql_completed().

In the Linux kernel, the bnxt_en driver has a vulnerability causing data corruption. When EOP (end of frame padding) is enabled on the AGG ring, zero padding may overlap with the next segment's data, especially with Relaxed Ordering (RO) enabled. On older chips (P5 and older), RO is not automatically disabled, potentially overwriting valid data.

In the Linux kernel, the TCP Fast Open (TFO) implementation has an issue with max_qlen accounting during SO_REUSEPORT listener migration. After migration, the qlen counter is not correctly transferred, causing the limit of pending Fast Open requests to be exceeded.

In the Linux kernel, the netfilter nf_flow_table module has an issue with dst_entry reference leak. When a packet passing through flowtable hooks already has a ref-counted dst, calling skb_dst_set_noref() overwrites the pointer, causing a reference leak and triggering DEBUG_NET_WARN_ON_ONCE warnings.

In the Linux kernel, the net/ncsi module has a heap out-of-bounds read vulnerability. The ncsi_send_cmd_nl() function does not validate the payload length from the packet header, allowing an attacker with CAP_NET_ADMIN to read up to 64KB of kernel memory and leak information.

In the Linux kernel, the prestera driver lacks validation of the firmware header length. The prestera_fw_hdr_parse() function reads the header before checking that the firmware image contains that header, which could lead to out-of-bounds read.

A TOCTOU race condition was found in the Linux kernel's net/smc module. The smc_listen_out() function checks the socket state without holding the lock, then acquires it later, allowing a race with listener close. This can lead to kernel memory leaks due to unreleased references to the child socket.

In the Linux kernel's Thunderbolt network driver, a vulnerability was found in the teardown sequence: DMA rings are stopped and frame buffers freed before DMA paths are deactivated. This causes in-flight data to have nowhere to drain, so the 'pending' bit never clears, leading to timeouts and link failure.

In the Linux kernel, the s390/ism driver has a use-after-free vulnerability. During ism_dev_exit(), an interrupt handler may be active in parallel, accessing freed data structures, leading to memory safety violation.

In the Linux kernel, the net/atm module has a slab-out-of-bounds read vulnerability in vcc_setsockopt(). An ineffective optlen check allows bypassing validation, which could lead to reading beyond buffer boundaries.

In the Linux kernel, the SCTP protocol has a use-after-free vulnerability. sctp_make_heartbeat_ack() caches a pointer to the transport without taking a reference, and when the transport is removed, a queued control chunk may retain a dangling pointer, leading to memory corruption.

In the Linux kernel, the at91sam9_wdt watchdog driver has a vulnerability where at91_ping() rearms the watchdog timer from its callback. Using timer_delete() neither waits for a running callback nor prevents rearming, potentially leading to access to freed memory during probe failure or driver removal.

A vulnerability in the Linux kernel's rqspinlock mechanism was found, where the queue tail is not reset when an ABBA deadlock is detected. This can cause a thread to wait indefinitely for a next waiter that never arrives, leading to intermittent or permanent system stalls.

In the Linux kernel, the ltc4282 hwmon driver has a vulnerability where negative current values are cast directly to u64, leading to large positive values and then overflow and random values after division. These values are then clamped to the maximum limit instead of zero.

In the Linux kernel, the net: tap driver has a vulnerability where in tap_get_user_xdp() the virtio-net header is parsed before assigning skb->dev. When the vhost TX path passes an XDP buffer with a GSO virtio-net header and protocol set to zero, dev_parse_header_protocol() can be called with skb->dev NULL, leading to a crash.

In the Linux kernel, the Input: evdev driver has a vulnerability where the user-supplied event type index in EVIOCGMASK / EVIOCSMASK ioctls is used to index arrays in evdev_get_mask_cnt() and evdev_get_mask(). Speculative execution may mispredict bounds checks and perform out-of-bounds loads.

In the Linux kernel, the ALSA usb-audio driver has an out-of-bounds write vulnerability when handling inbound USB transfers of Format Type II. The issue is caused by incorrect calculation of the transfer buffer size, which is one packet too small, leading to writes beyond the allocated memory.

In the Linux kernel, the usb: misc: usbio driver has a vulnerability where in usbio_bulk_msg() the EMSGSIZE check compares ibuf_len (receive buffer size) with txbuf_len (transmit endpoint size) instead of rxbuf_len. When these sizes differ, the check is incorrect.

In the Linux kernel's cxacru driver for USB ATM devices, a vulnerability was found due to improper URB management. During an error in cxacru_cm(), the active rcv_urb is not killed, which can lead to a warning in usb_submit_urb() and potential system stability issues.

In the Linux kernel, the usb: gadget: f_ncm driver has a vulnerability where the variable ndp_index is declared as signed, but it stores the return value of get_ncm(), which is unsigned. A malicious host can supply a large offset that overflows the signed ndp_index, making it negative, which bypasses sanity checks and leads to an out-of-bounds read when calculating the address of the NDP block.