CVE Vulnerability Catalog

In the Linux kernel, BPF LSM programs can currently attach to the xfrm_decode_session() hook, which may return an error, but security_skb_classify_flow() calls it from a void path and triggers BUG_ON() on error. The fix disables BPF attachment to this hook to prevent a system panic.

In the Linux kernel's netfilter subsystem (nf_conntrack_expect), the timer API for expectations has been replaced with a GC worker approach. This change addresses a race condition where an expectation could access a stale exp->master pointer after it was freed, and introduces the NF_CT_EXPECT_DEAD flag for safe reaping.

In the Linux kernel, the mlx5 driver for LAG and MPESW was missing a complete() call in the error path when mlx5_lag_get_devcom_comp() returned NULL. A process waiting for the work to finish could block indefinitely. The fix routes the early return through a 'complete' label to always wake the waiter.

A vulnerability in the Linux kernel Bluetooth SCO subsystem causes a deadlock in sco_sock_timeout(). The issue arises from acquiring the same lock (lock_sock) twice when the socket is closing while the timer runs asynchronously. The fix moves disable_delayed_work_sync() outside the locked section.

In the Linux kernel, KVM for ARM64 in nested virtualization mode, kvm_handle_vncr_abort() assumed that -EFAULT from kvm_translate_vncr() always indicates an abort. However, 'late' failures on the output of S1 translation are possible, e.g., a GFN outside memslots. The fix prepares an external abort before returning from kvm_translate_vncr() and removes the BUG_ON() in the fault injection path.

In the Linux kernel, netfilter xt_nat SNAT and DNAT target handlers assume IP-family conntrack state and can dereference a NULL pointer when instantiated from an unsupported family through nft_compat. A bridge-family compat rule can trigger a NULL-dereference in nf_nat_setup_info(). The fix rejects non-IP families in xt_nat_checkentry() so unsupported targets cannot be installed, while keeping NFPROTO_INET allowed.

In the Linux kernel, the intel-speed-select tool (tools/power/x86) daemon uses a fixed pidfile path under /tmp. A local unprivileged user can pre-create a symlink at that path and cause a root-run daemon instance to write into an attacker-chosen file. The fix opens the pidfile with O_NOFOLLOW and validates it with fstat() before locking/writing.

In the Linux kernel, a vulnerability was found in the CXL subsystem where CXL_HEADERLOG_SIZE was defined as 512 bytes, while the actual Header Log register size in the RAS Capability structure is 64 bytes. This caused an out-of-bounds read (by 448 bytes) during data copying, and in the CPER caller path led to leaking 448 bytes of kernel stack memory into the trace event ring buffer, readable by userspace via tracefs.

In the Linux kernel, the UFS core driver trace events in drivers/ufs/core/ufs_trace.h used a pointer to the hba structure in TP_printk(), which is not allowed because TP_printk() is executed when the trace file is read, potentially much later when the pointer may be stale. The fix saves the device name at the time the tracepoint is called and places it into the ring buffer, eliminating the risk of dereferencing a freed pointer.

A vulnerability in the Linux kernel's hwmon (OCC) subsystem involves a lock ordering inversion between the OCC mutex and sysfs callbacks during hwmon device unregistration. This can lead to a deadlock, as confirmed by lockdep reports. The issue was discovered via static analysis and manually reviewed.

In the Linux kernel, the MMC vub300 driver had a deadlock caused by recursive acquisition of cmd_mutex during USB device reset after a command response timeout. The fix defers the reset until the mutex is released.

In the Linux kernel, the DRM driver for Rockchip (dw_dp), dw_dp_remove() attempts to access driver data via platform_get_drvdata(), which can lead to a null pointer dereference if the bind() callback was not executed. The fix removes the unnecessary call to platform_get_drvdata() and instead references the target device structure via platform_device.

In the Linux kernel, the accel/amdxdna driver lacked NULL checks before using the management mailbox channel pointer. Cleanup functions could be called after the channel was destroyed, leading to NULL pointer dereference. Added checks to safely return instead.

In the Linux kernel, the HFS+ filesystem lacked validation of B-tree node size. A corrupted HFS+ image with an invalid node size could lead to reading uninitialized memory during mount. Added a sanity check based on the technical specification.

In the Linux kernel, the soc: xilinx driver had a race condition in event registration. Work structures were initialized after registration, which could lead to NULL pointer dereference if firmware triggered an event immediately. Fixed by initializing before registration.

In the Linux kernel, the soc: xilinx driver had an error in rx mailbox channel cleanup. Due to incorrect condition, the channel was not shut down or freed, leading to use-after-free. Fixed by checking rx_chan correctly.

In the Linux kernel, the scsi: hisi_sas driver lacked a slave_destroy interface, causing warnings during simultaneous link reset and module removal. The fix adds this interface to ensure proper link removal after workqueues are flushed.

In the Linux kernel, the crypto CCP driver (AMD) mishandled a zero-length certificate chain buffer during PDH export. Instead of treating it as a query for blob lengths, the kernel attempted to get the physical address of the ZERO_SIZE_PTR, triggering a BUG_ON() when CONFIG_DEBUG_VIRTUAL=y. This leads to a kernel oops and can be triggered by an unprivileged user via ioctl.

In the Linux kernel, the crypto: ccp/sev-dev-tsm driver had a NULL pointer dereference when pdev->bus is NULL. dsm_create() checked the condition but later used the pointer without checking, potentially causing a crash. Fixed by returning -ENODEV early.

In the Linux kernel, the media: atomisp: gc2235 driver had error handling bugs leading to use-after-free and memory leak. The fix replaces gc2235_remove() calls in error paths with explicit unwind labels that free only initialized resources.