CVE Vulnerability Catalog

In the Linux kernel, the V3D DRM driver (drm/v3d) has a vulnerability due to lack of serialization of timeout handlers for different hardware queues (BIN, RENDER, TFU, CSD). Since the reset is global, concurrent timeout handling can lead to inconsistent job credit counts, resulting in GPU hang and UI freeze.

A use-after-free vulnerability was found in the Linux kernel's perf subsystem, related to improper sibling event detachment from a group. When a sibling event is detached (e.g., during CPU hot-unplug), its group_leader pointer remains pointing to the old leader, which may be freed, leading to dereferencing freed memory during a PERF_IOC_FLAG_GROUP ioctl. The issue was reproduced by running the perf event fuzzer, CPU hotplug, and a stress workload concurrently.

A race condition between event_define_fields() and update_event_fields() in the Linux kernel was found during concurrent module loading. Lack of event_mutex protection for the event field list in trace_event_update_all() can lead to a kernel panic.

In the Linux kernel fbdev driver, the bit_cursor() function did not validate the glyph index read from the screen buffer, which could lead to an out-of-bounds memory read. The issue was reported by Syzkaller and affects the write path to /dev/vcsa.

In the Linux kernel, ring_buffer_subbuf_order_set() frees buffer pages, which is not allowed when resizing is disabled. A non-consuming reader is at risk of use-after-free in rb_advance_iter(). The function now returns -EBUSY when resize_disabled is set, matching ring_buffer_resize() behavior.

In the Linux kernel, a NULL pointer dereference occurs in the tracing module when removing events from the module cache. A module-specific event filter such as ':mod:foo' is cached with a NULL pointer when the module is not loaded. A later attempt to remove a specific match from the same module passes this NULL to strcmp(), causing a NULL pointer dereference.

A subtle race condition in the Linux kernel's huge_zero_folio implementation can cause the huge_zero_pfn to be overwritten with an invalid sentinel value by the shrinker, leading to misidentification of the huge zero page as a regular THP folio. This may result in incorrect splitting and handling of the huge zero folio.

In the Linux kernel, smc_rx_splice() has a lifetime imbalance issue for splice entries. The function passes pages to splice_to_pipe() before taking references, which can lead to use-after-free due to refcount underflow.

In the Linux kernel, in6_dev_get() can resurrect an inet6_dev object after it has been freed. It reads dev->ip6_ptr under RCU and then unconditionally increments its refcount. If device teardown clears the pointer and drops the last reference between these operations, the increment can resurrect an object whose RCU free has already been queued, leading to use-after-free.

In the Linux kernel, the net/dibs module has a double-free and use-after-free (UAF) issue with dmb_clientid_arr. An interrupt handler can be active after dibs_dev_del() and still access the array. In case of failure in dibs_dev_add(), the array is freed twice.

In the Linux kernel, the X.25 protocol has a use-after-free vulnerability of the socket by its timers. Timers are armed with mod_timer() and cancelled with timer_delete(), so a pending timer holds no reference on the socket and a cancel does not wait for a callback already running on another CPU. x25_heartbeat_expiry() also rearms unconditionally, which can lead to use-after-free.

In the Linux kernel, the zerocopy_fill_skb_from_devmem() function lacks a check to prevent mixing net_iov and page-backed fragments in a single skb. Such mixing can cause a crash in the network stack.

In the Linux kernel, the ntb_netdev driver's ntb_netdev_rx_handler() hands the received skb to the network stack before allocating its replacement. If allocation fails, the buffer is not reposted, gradually depleting the RX queue and potentially stalling reception.

In the Linux kernel's netfilter bridge subsystem, a nftables ct zone rule can attach a conntrack template to an skb before nf_ct_bridge_pre() processes it. For non-IP EtherTypes, the function overwrites the conntrack state without releasing the template reference, causing memory leaks.

In the Linux kernel's netfilter nf_conntrack, TCP and SCTP paths can emit invalid-packet logs while holding ct->lock. If logging is routed to nfnetlink_log and conntrack export is enabled, a deadlock can occur.

In the Linux kernel's atlantic driver, during TX ring deinitialization, aq_vec_deinit() cleans only a limited number of descriptors and stops at hw_head, leaving many buffers (skb or xdp_frame) unreleased. This causes memory leaks on every interface down, and with page_pool can block its destruction.

In the Linux kernel's atlantic driver, aq_ring_rx_deinit() only walks the range [sw_head, sw_tail), skipping buffers that were consumed but not yet refilled. This causes leaks of pages and DMA mappings on every interface down.

A vulnerability in the Linux kernel's net/sched/act_ct module causes an sk_buff leak when header checks reject a packet. The function tcf_ct_handle_fragments() returns errors without freeing the skb, and the caller treats all non-zero returns as ownership transfer, leading to a memory leak. Reproduced on v7.2-rc6, each malformed packet leaks a 232-byte skbuff_head_cache object plus a 704-byte data buffer.

In the Linux kernel, a vulnerability was found in net/sched: act_gact and act_police. The fallback control action supplied by user space lacks range validation, allowing TC_ACT_CONSUMED (outside the UAPI range) to be set. This causes a memory leak (sk_buff and data buffer) for every packet traversing the filter, unbounded, including kernel-generated packets.

A vulnerability was found in the Linux kernel's OverlayFS filesystem. An unprivileged user can trigger a WARN_ON in ovl_fill_super(), potentially causing kernel tainting, log flooding, and even a system panic (if panic_on_warn is enabled). The issue stems from the ability to complete a mount from a different user namespace.