CVE Vulnerability Catalog

In the Linux kernel, the net/dibs module has a double-free and use-after-free (UAF) issue with dmb_clientid_arr. An interrupt handler can be active after dibs_dev_del() and still access the array. In case of failure in dibs_dev_add(), the array is freed twice.

In the Linux kernel, the X.25 protocol has a use-after-free vulnerability of the socket by its timers. Timers are armed with mod_timer() and cancelled with timer_delete(), so a pending timer holds no reference on the socket and a cancel does not wait for a callback already running on another CPU. x25_heartbeat_expiry() also rearms unconditionally, which can lead to use-after-free.

In the Linux kernel, the zerocopy_fill_skb_from_devmem() function lacks a check to prevent mixing net_iov and page-backed fragments in a single skb. Such mixing can cause a crash in the network stack.

In the Linux kernel, the ntb_netdev driver's ntb_netdev_rx_handler() hands the received skb to the network stack before allocating its replacement. If allocation fails, the buffer is not reposted, gradually depleting the RX queue and potentially stalling reception.

In the Linux kernel's netfilter bridge subsystem, a nftables ct zone rule can attach a conntrack template to an skb before nf_ct_bridge_pre() processes it. For non-IP EtherTypes, the function overwrites the conntrack state without releasing the template reference, causing memory leaks.

In the Linux kernel's netfilter nf_conntrack, TCP and SCTP paths can emit invalid-packet logs while holding ct->lock. If logging is routed to nfnetlink_log and conntrack export is enabled, a deadlock can occur.

In the Linux kernel's atlantic driver, during TX ring deinitialization, aq_vec_deinit() cleans only a limited number of descriptors and stops at hw_head, leaving many buffers (skb or xdp_frame) unreleased. This causes memory leaks on every interface down, and with page_pool can block its destruction.

In the Linux kernel's atlantic driver, aq_ring_rx_deinit() only walks the range [sw_head, sw_tail), skipping buffers that were consumed but not yet refilled. This causes leaks of pages and DMA mappings on every interface down.

A vulnerability in the Linux kernel's net/sched/act_ct module causes an sk_buff leak when header checks reject a packet. The function tcf_ct_handle_fragments() returns errors without freeing the skb, and the caller treats all non-zero returns as ownership transfer, leading to a memory leak. Reproduced on v7.2-rc6, each malformed packet leaks a 232-byte skbuff_head_cache object plus a 704-byte data buffer.

In the Linux kernel, a vulnerability was found in net/sched: act_gact and act_police. The fallback control action supplied by user space lacks range validation, allowing TC_ACT_CONSUMED (outside the UAPI range) to be set. This causes a memory leak (sk_buff and data buffer) for every packet traversing the filter, unbounded, including kernel-generated packets.

A vulnerability was found in the Linux kernel's OverlayFS filesystem. An unprivileged user can trigger a WARN_ON in ovl_fill_super(), potentially causing kernel tainting, log flooding, and even a system panic (if panic_on_warn is enabled). The issue stems from the ability to complete a mount from a different user namespace.

A vulnerability in the Linux kernel's binfmt_misc module allows an unprivileged process to trigger a WARN_ON() in bm_fill_super() by completing a mount context from a different user namespace. This can be exploited to flood kernel logs and potentially cause a system panic if panic_on_warn is enabled.

In the Linux kernel, the dibs module initializes the dibs->lock too late, only in dibs_dev_add(), while interrupts can occur earlier. This can lead to use of an uninitialized lock in interrupt handling.

In the Linux kernel, xdpf_clone() creates clones of XDP frames but does not sufficiently check whether data fits within the skb_shared_info tailroom. This can lead to data corruption when converting a clone to an skb.

A vulnerability in the Linux kernel's VXLAN driver arms the ageing timer on a down interface due to a missing netif_running() check. This leads to a use-after-free when the interface is deleted, as the timer is still queued on freed memory. An unprivileged user can trigger this in a new user and network namespace.

In the Linux kernel, in virtio vsock, the RX, TX, and event workers read their virtqueue before checking the run flag, which can lead to use of a deleted queue after device suspend/resume.

A vulnerability in the Linux kernel's vsock/virtio driver allows the RX worker to refill the queue after teardown, leading to a use-after-free and kernel panic. The issue occurs when work is queued after virtio_vsock_vqs_del() has been called.

A vulnerability in the Linux kernel's veth interface was found where skb length accounting was incorrect after XDP fragment adjustment, leading to copying data beyond the actual linear area, including kernel pointers, to userspace. Additionally, bpf_xdp_pull_data() could trigger SKB_LINEAR_ASSERT() due to improper tail pointer management.

In the Linux kernel, in TLS RX, during optimistic TLS 1.3 zero-copy attempt, the msg_iter pointer is not restored after a failed attempt, which can lead to overwriting data in the receiver's buffer.

In the Linux kernel, in TLS, when the sk_msg ring is full, the full_record flag is not set, which can lead to pointer wrap and overwriting entries, then to a system crash (NULL pointer dereference).