CVE Vulnerability Catalog

In the Linux kernel, the xfrm (ESP-in-TCP) module has an issue with packets that have no ingress device. When the ingress device is removed, dev_get_by_index_rcu() returns NULL, leading to a NULL dereference in the XFRM input path. The fix drops such packets.

A deadlock vulnerability was found in the Linux kernel's xfrm NAT keepalive mechanism. The nat_keepalive_work() function walks the state table while holding xfrm_state_lock, then acquires x->lock in its callback, conflicting with the delete path that takes these locks in reverse order, causing an AB-BA deadlock. The fix splits the walk into two phases: first collect candidate states with references, then process them without nesting locks.

In the Linux kernel's AH6 (IPsec) subsystem, there is an out-of-bounds read vulnerability. The ipv6_rearrange_rthdr() function assumes that the segments_left field in the routing header does not exceed the number of addresses described by hdrlen. However, for raw IPv6 HDRINCL packets, a packet with hdrlen=2 (describing one address) and segments_left=255 can be sent, causing the address pointer to move 4064 bytes backwards and passing a 4064-byte length to memmove(), leading to out-of-bounds access. The fix adds validation of this invariant before modifying the header.

In the Linux kernel's xfrm_state_construct() function, there is a memory leak related to the authentication algorithm. The attach_auth_trunc() function can allocate memory for x->aalg but does not set x->props.aalgo when the selected algorithm has no sadb_alg_id (e.g., cmac(aes)). Then xfrm_state_construct() treats the zero value of x->props.aalgo as no algorithm and calls attach_auth(), which overwrites the x->aalg pointer and loses the original allocation. The fix checks whether x->aalg is already attached instead of inferring from x->props.aalgo.

A use-after-free vulnerability was found in the Linux kernel's bridge multicast code for master VLANs. During master VLAN deletion, the BR_VLFLAG_MCAST_ENABLED flag is not cleared under lock, allowing readers (bridge transmit path) to re-arm the multicast context after it has been deinitialized and freed, leading to access of freed memory.

In the Linux kernel, a vulnerability in the AF_PACKET subsystem related to TX_RING buffers has been fixed. The issue was that skb descriptors held a raw pointer to a ring frame, which could point to a no-longer-existing vmalloc mapping after pg_vec was freed. The fix defers the reference release until after timestamp and frame status writes, and adds an additional check before ring replacement.

In the Linux kernel's IPv6 Segment Routing (seg6) module, during IPIP decapsulation (End.DX4, End.DT4), the IPv4 control block (IPCB) is not cleared. This causes IPv4 to use stale IP6CB data, leading to an out-of-bounds read in __ip_options_echo() and potential memory corruption (KASAN: slab-out-of-bounds).

In the Linux kernel's batman-adv module, there is an out-of-bounds read vulnerability. The batadv_tvlv_call_handler() function sets the network_header and transport_header fields in the sk_buff structure based on a received multicast TVLV, without checking whether the end offset is representable in a 16-bit field. If the offset exceeds the range, skb_set_transport_header() truncates it, causing the transport header to precede the network header, and skb_network_header_len() returns a large u32 value. The batadv_mcast_forw_packet() function then accepts an oversized multicast tracker and accesses memory beyond the skb data. The fix adds the skb_set_transport_header_careful() function and rejects unrepresentable TVLVs.

In the Linux kernel's vxlan module, there is a vulnerability involving an invalid pointer during FDB flush operations. When a filtered bulk flush removes all remotes from an FDB entry, the last remote is unlinked in vxlan_fdb_dst_destroy() and only afterwards the parent FDB entry is destroyed. During this interval, an RCU reader can find the parent entry, and first_remote_rcu() applies list_entry_rcu() to the empty list head, producing an invalid remote pointer that the receive learning path can read from and write to. The fix leaves the last remote linked and asks the caller to destroy the entire FDB entry.

In the Linux kernel's netfilter/nf_tables subsystem, there is a race condition in queueing object notifications from the packet path. The nft_obj_notify() function, called from the packet path (e.g., via nft_quota_obj_eval), adds notifications to the notify_list without proper locking, which can lead to a use-after-free of sk_buff. The issue appeared after commit 67cc570edaa0, which changed how notifications are sent.

In the Linux kernel's crypto virtio module, there is an out-of-bounds read vulnerability. The virtio_crypto_dataq_akcipher_callback() function sets the result length from the device-reported response length without bounding it to the destination buffer, which was allocated for the original request length. sg_copy_from_buffer() then reads that many bytes from the destination buffer; a backend reporting a larger length over-reads adjacent kernel heap into the caller's scatterlist (an out-of-bounds read). The fix clamps the reported length to the originally requested destination length.

In the Linux kernel, the crypto_rng interface was removed from the qcom-rng driver because it was redundant and buggy. The driver exposed the same hardware through two separate interfaces, which could lead to concurrent register access and generation of incorrect random values. The hwrng interface remains active and is the one that matters.

In the Linux kernel, the crypto_rng interface was removed from the sun8i-ce driver because it was unused and redundant. The driver had a use-after-free vulnerability in its ->generate() function due to improper handling of DMA operation shutdown. hwrng support remains intact.

In the Linux kernel, the crypto_rng interface was removed from the sun8i-ss driver because it was unused and redundant. The driver had a use-after-free vulnerability in its ->generate() function and a buffer overread bug in the line memcpy(ctx->seed, d + dlen, ctx->slen). hwrng support remains.

In the Linux kernel, the crypto: qce driver has an AAD buffer underallocation bug in qce_aead_ccm_prepare_buf_assoclen(). The buffer can be smaller than the length later programmed into the DMA scatterlist, leading to out-of-bounds read by QCE hardware during CBC-MAC computation. The fix adds the maximum AAD header length before alignment.

In the Linux kernel, the crypto: mxs-dcp driver's mxs_dcp_aes_block_crypt() uses sg_dma_len() without mapping the source scatterlist with dma_map_sg() first. This can lead to incorrect data length during encryption/decryption when CONFIG_NEED_SG_DMA_LENGTH=y. The fix uses the original scatterlist length.

In the Linux kernel, a spin lock was added to usb_wakeup_notification() to prevent a race condition with dereferencing freed memory. The issue could occur when the xHCI driver called this function from an IRQ, racing with hub_disconnect().

In the Linux kernel, the ALSA: usb-audio driver has an out-of-bounds write vulnerability in snd_usbmidi_novation_output(). A malicious USB device can advertise wMaxPacketSize=1, leading to a negative transfer length and writing beyond the buffer. The fix adds a check that the endpoint can hold the header plus at least one payload byte.

In the Linux kernel, a vulnerability in the ALSA usb-audio driver involves incomplete cleanup after a system-resume error. A failed resume can leave the sound card unusable until reboot, and the suspended-interface counter becomes inconsistent, affecting subsequent suspend/resume cycles.

In the Linux kernel, the USB: serial: option driver has a slab out-of-bounds read vulnerability in the interrupt URB callback. The interrupt buffer is allocated based on wMaxPacketSize, and when a device sends a short packet, the code reads beyond the allocated buffer. The fix adds missing bounds checks before accessing data.