CVE Vulnerability Catalog

In the Linux kernel, AF_XDP allows user space to change metadata flags after request processing. Rereading them during completion can make the kernel write a timestamp that was not requested when the packet was submitted. The fix clears the metadata pointer during request processing unless timestamp completion is requested.

In the Linux kernel, AF_XDP launch-time metadata extends beyond the first 16 bytes of struct xsk_tx_metadata. The vulnerability allows rejecting the request when the registered metadata area does not contain the complete field. The fix also snapshots validated flags for the generic transmit path to avoid inconsistent decisions if user space changes flags concurrently.

In the Linux kernel, the zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request. User space can change the metadata between those operations and bypass the original validation. The fix validates metadata in xsk_tx_metadata_request() and uses the resulting flags snapshot for every feature check.

In the Linux kernel, the bnge driver has a NULL pointer dereference vulnerability in the auxiliary device release function. If allocation of auxr_dev fails during auxiliary device setup, the error path calls auxiliary_device_uninit(), which eventually invokes bnge_aux_dev_release(). The release callback unconditionally dereferences aux_priv->auxr_dev->pdev, causing a NULL pointer exception.

In the Linux kernel, __skb_udp_tunnel_segment() has a potential use-after-free vulnerability. It gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb->head, the saved UDP header pointer becomes invalid.

In the Linux kernel, the sch_cake ACK filter contains a WARN_ON(1) that can be triggered by a malformed IP header. Depending on system configuration, this leads to spamming dmesg with warnings or a panic if panic_on_warn is set. The fix removes the WARN_ON because the code already correctly skips the offending packet.

In the Linux kernel, the vhost-scsi subsystem has a vulnerability due to missing validation of T10 PI scatterlist counts. A malformed request can claim protection bytes that cover or exceed the payload length, leading to a zero data SGL count reaching sg_alloc_table_chained(), which triggers BUG_ON(!nents).

A vulnerability in the Linux kernel's vhost-scsi allows feature changes after endpoint activation, leading to a kernel panic. Enabling T10-PI after setup leaves protection scatterlists uninitialized, triggering a BUG_ON in sg_alloc_table_chained().

In the Linux kernel, the openvswitch module's key_extract() function does not check the Ethernet header length before accessing it, which can lead to a kernel BUG in __skb_pull() for packets arriving on ARPHRD_NONE devices such as TUN. The fix is to call check_header() before accessing the Ethernet header.

A vulnerability was found in the Linux kernel's network filter mechanism (net/sched). The issue is a race condition during filter creation that can lead to use-after-free (UAF) in the cls_u32 class. The fix ensures rtnl_lock is always acquired when destroying locked classifiers.

In the Linux kernel, the DRM/Xe driver has a memory leak in exec_queue_set_hang_replay_state(). The q->replay_state is blindly overwritten, potentially leaking memory previously allocated by vmemdup_user(). The fix returns an error if q->replay_state is not empty.

In the Linux kernel, the mlx5e network driver has a vulnerability due to incorrect BQL reset on SQ re-activation. mlx5e_activate_txqsq() unconditionally calls netdev_tx_reset_queue(), zeroing BQL counters of channels with in-flight TX WQEs, leading to BUG_ON in dql_completed().

In the Linux kernel, the bnxt_en driver has a vulnerability causing data corruption. When EOP (end of frame padding) is enabled on the AGG ring, zero padding may overlap with the next segment's data, especially with Relaxed Ordering (RO) enabled. On older chips (P5 and older), RO is not automatically disabled, potentially overwriting valid data.

In the Linux kernel, the TCP Fast Open (TFO) implementation has an issue with max_qlen accounting during SO_REUSEPORT listener migration. After migration, the qlen counter is not correctly transferred, causing the limit of pending Fast Open requests to be exceeded.

In the Linux kernel, the netfilter nf_flow_table module has an issue with dst_entry reference leak. When a packet passing through flowtable hooks already has a ref-counted dst, calling skb_dst_set_noref() overwrites the pointer, causing a reference leak and triggering DEBUG_NET_WARN_ON_ONCE warnings.

In the Linux kernel, the net/ncsi module has a heap out-of-bounds read vulnerability. The ncsi_send_cmd_nl() function does not validate the payload length from the packet header, allowing an attacker with CAP_NET_ADMIN to read up to 64KB of kernel memory and leak information.

In the Linux kernel, the prestera driver lacks validation of the firmware header length. The prestera_fw_hdr_parse() function reads the header before checking that the firmware image contains that header, which could lead to out-of-bounds read.

A TOCTOU race condition was found in the Linux kernel's net/smc module. The smc_listen_out() function checks the socket state without holding the lock, then acquires it later, allowing a race with listener close. This can lead to kernel memory leaks due to unreleased references to the child socket.

In the Linux kernel's Thunderbolt network driver, a vulnerability was found in the teardown sequence: DMA rings are stopped and frame buffers freed before DMA paths are deactivated. This causes in-flight data to have nowhere to drain, so the 'pending' bit never clears, leading to timeouts and link failure.

In the Linux kernel, the s390/ism driver has a use-after-free vulnerability. During ism_dev_exit(), an interrupt handler may be active in parallel, accessing freed data structures, leading to memory safety violation.