CVE Vulnerability Catalog

In the Linux kernel's netfilter bridge subsystem, a nftables ct zone rule can attach a conntrack template to an skb before nf_ct_bridge_pre() processes it. For non-IP EtherTypes, the function overwrites the conntrack state without releasing the template reference, causing memory leaks.

In the Linux kernel's netfilter nf_conntrack, TCP and SCTP paths can emit invalid-packet logs while holding ct->lock. If logging is routed to nfnetlink_log and conntrack export is enabled, a deadlock can occur.

In the Linux kernel's atlantic driver, during TX ring deinitialization, aq_vec_deinit() cleans only a limited number of descriptors and stops at hw_head, leaving many buffers (skb or xdp_frame) unreleased. This causes memory leaks on every interface down, and with page_pool can block its destruction.

In the Linux kernel's atlantic driver, aq_ring_rx_deinit() only walks the range [sw_head, sw_tail), skipping buffers that were consumed but not yet refilled. This causes leaks of pages and DMA mappings on every interface down.

A vulnerability in the Linux kernel's net/sched/act_ct module causes an sk_buff leak when header checks reject a packet. The function tcf_ct_handle_fragments() returns errors without freeing the skb, and the caller treats all non-zero returns as ownership transfer, leading to a memory leak. Reproduced on v7.2-rc6, each malformed packet leaks a 232-byte skbuff_head_cache object plus a 704-byte data buffer.

In the Linux kernel, a vulnerability was found in net/sched: act_gact and act_police. The fallback control action supplied by user space lacks range validation, allowing TC_ACT_CONSUMED (outside the UAPI range) to be set. This causes a memory leak (sk_buff and data buffer) for every packet traversing the filter, unbounded, including kernel-generated packets.

A vulnerability was found in the Linux kernel's OverlayFS filesystem. An unprivileged user can trigger a WARN_ON in ovl_fill_super(), potentially causing kernel tainting, log flooding, and even a system panic (if panic_on_warn is enabled). The issue stems from the ability to complete a mount from a different user namespace.

A vulnerability in the Linux kernel's binfmt_misc module allows an unprivileged process to trigger a WARN_ON() in bm_fill_super() by completing a mount context from a different user namespace. This can be exploited to flood kernel logs and potentially cause a system panic if panic_on_warn is enabled.

In the Linux kernel, the dibs module initializes the dibs->lock too late, only in dibs_dev_add(), while interrupts can occur earlier. This can lead to use of an uninitialized lock in interrupt handling.

In the Linux kernel, xdpf_clone() creates clones of XDP frames but does not sufficiently check whether data fits within the skb_shared_info tailroom. This can lead to data corruption when converting a clone to an skb.

A vulnerability in the Linux kernel's VXLAN driver arms the ageing timer on a down interface due to a missing netif_running() check. This leads to a use-after-free when the interface is deleted, as the timer is still queued on freed memory. An unprivileged user can trigger this in a new user and network namespace.

In the Linux kernel, in virtio vsock, the RX, TX, and event workers read their virtqueue before checking the run flag, which can lead to use of a deleted queue after device suspend/resume.

A vulnerability in the Linux kernel's vsock/virtio driver allows the RX worker to refill the queue after teardown, leading to a use-after-free and kernel panic. The issue occurs when work is queued after virtio_vsock_vqs_del() has been called.

A vulnerability in the Linux kernel's veth interface was found where skb length accounting was incorrect after XDP fragment adjustment, leading to copying data beyond the actual linear area, including kernel pointers, to userspace. Additionally, bpf_xdp_pull_data() could trigger SKB_LINEAR_ASSERT() due to improper tail pointer management.

In the Linux kernel, in TLS RX, during optimistic TLS 1.3 zero-copy attempt, the msg_iter pointer is not restored after a failed attempt, which can lead to overwriting data in the receiver's buffer.

In the Linux kernel, in TLS, when the sk_msg ring is full, the full_record flag is not set, which can lead to pointer wrap and overwriting entries, then to a system crash (NULL pointer dereference).

A use-after-free vulnerability was found in the TIPC module of the Linux kernel. The tipc_node_link_down() function reads the link pointer before acquiring the lock, which can lead to dereferencing freed memory during concurrent link deletion. The issue was fixed by moving the pointer read inside the lock.

In the Linux kernel, in the SMB client, cifs_try_adding_channels() can use-after-free an interface when channel creation fails and the interface list is refreshed concurrently.

In the Linux kernel KVM/SVM subsystem, a synchronization issue was found with the owner and mirror lists. Concurrent move and copy operations of encryption context can corrupt the list or cause an incorrect kvm_put_kvm() call.

In the Linux kernel eventfs subsystem, a use-after-free vulnerability was found in eventfs_remove_rec(). During recursive removal, the list iterator may read a pointer after memory is freed, leading to security issues.