CVE Vulnerability Catalog

In the Linux kernel, generic XDP fragment adjustment leaves skb->len stale, causing skb_headlen() to be larger than the actual linear area. In the UDP receive path, this can copy data beyond the linear area to userspace.

In the Linux kernel Open vSwitch, when updating a flow with a UFID that misses and falls back to key lookup, the preallocated reply may be too small. This can cause -EMSGSIZE and trigger BUG_ON in the update path.

In the Linux kernel net/sched subsystem, overly deep qdisc hierarchies can cause excessive recursion and kernel stack exhaustion. The existing loop check does not cover the create-and-graft path, allowing hierarchy extension.

In the Linux kernel inet_frag_create(), the fragment queue timer is armed before the queue is published in the hash table. If the fragment timeout is zero or negative, the timer can run before publication, causing a race and leaving a stale hash node.

In the Linux kernel mac802154 subsystem, the beacon worker reads local->beacon_req under RCU but continues to use sdata and wpan_dev after leaving the RCU section. This can lead to use-after-free after interface teardown.

A vulnerability in the Linux kernel netfilter ebt_nflog module leads to a use-after-free condition. The issue arises from not holding a reference to the NFLOG logging module, allowing an ebtables rule to be invoked after per-net data has been freed by nfnetlink_log. An attacker could exploit this to corrupt kernel memory.

In the Linux kernel bridge MRP subsystem, br_mrp_alloc_test_skb() builds MRP test frames on an skb from dev_alloc_skb(), which does not clear the linear data area. In the MRA ring-role branch, three bytes remain uninitialized in every MRP_Test frame.

A vulnerability in the Linux kernel futex mechanism involves a race condition during robust futex exit. The previous fix (ca16d5bee598) was insufficient, allowing lost wakeup notifications when another thread re-acquired the futex via the fast path. This could cause waiting threads to sleep forever on a free futex.

In the Linux kernel, fib_nlmsg_size() incorrectly estimated nexthop space assuming every gateway is encoded as an IPv4 RTA_GATEWAY attribute. IPv4 routes can also carry an IPv6 gateway, which is dumped as RTA_VIA, leading to undersized skb allocation and -EMSGSIZE errors, and with panic_on_warn set, a kernel panic.

A use-after-free vulnerability was found in the Linux kernel's fib_nhc_update_mtu() function for IPv4. The issue stems from lack of synchronization between walking the PMTU exception table and updates, potentially leading to access to freed memory. An attacker could exploit this flaw to compromise system integrity.

In the Linux kernel's qcom-geni UART driver, there is an issue with flushing the TX DMA buffer during transmission, causing the UART to get stuck infinitely repeating corrupted TX DMA frames. The DMA-mode uart_ops lacks a flush_buffer callback, and the stop path is broken, leading to a hang.

In the Linux kernel's 8250_dma driver, serial8250_release_dma() terminates RX DMA and releases the channel but leaves rx_running set. On port reopen, the stale state causes a NULL channel to be passed to dmaengine_pause(), leading to a kernel Oops.

A vulnerability in the Linux kernel serial driver 8250_of for the NXP LPC32xx UART was found. The UART can report an RX timeout interrupt while the FIFO is empty, which is never cleared. This causes an interrupt storm that can livelock the CPU on single-core ARM926 systems.

In the Linux kernel's amba-pl011 driver, RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel both timers.

In the Linux kernel's staging rtl8723bs driver, rtw_get_wpa_ie() reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short trailing IE.

In the Linux kernel's staging rtl8723bs driver, WMM_param_handler() copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read for a short WMM IE.

In the Linux kernel's staging rtl8723bs driver, the WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg_txt buffer, potentially causing overflow or underfill.

In the Linux kernel's staging rtl8723bs driver, rtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and reads the 802.11 frame control field without checking that a base 802.11 header remains, potentially causing out-of-bounds reads or insufficient data.

In the Linux kernel's fastrpc module, there is a potential race condition during buffer unmap operations. The buffer is removed from the list only after the unmap operation, which can cause issues when multiple threads invoke unmap concurrently. The fix moves the list removal before the unmap, re-adding the buffer if unmap fails.

In the Linux kernel's fastrpc module, the fl->lock is not held when moving memory mappings after an interrupted invoke. The list_del() and list_add_tail() operations run without this lock, which can cause races with other operations on the mmaps list. The fix adds the lock around the move.