CVE Vulnerability Catalog

In the Linux kernel's libceph module, a monmap with zero monitors was treated as valid, potentially leading to a client crash. The fix rejects such monmaps during decoding.

In the Linux kernel's libceph module, debugfs files were removed after the monitor client teardown, potentially leading to a use-after-free. The fix removes debugfs files before stopping the OSD and monitor clients.

In the Linux kernel's AMT module, delayed works could access the freed amt_dev structure after device removal. The fix uses disable_delayed_work_sync() in amt_dev_stop() to prevent re-queueing of works.

In the Linux kernel's forget_cached_acl() function, the ACL_DONT_CACHE state is not preserved, which for filesystems that opted out of ACL caching (e.g., FUSE) can lead to returning stale ACL values. The issue arises because forget_all_cached_acls() calls in FUSE code do not account for this state and remove it.

In the Linux kernel's fscrypt module, in find_or_insert_direct_key(), there is a missing comparison of the super_block pointer, causing entries in the global fscrypt_direct_keys table to be shared between different super_blocks. This can lead to a use-after-free when a key is evicted after the super_block's lifetime ends.

In the Linux kernel's fscrypt module, fscrypt_get_devices() uses dynamic allocation for an array of block device pointers, which can fail, especially during key eviction under direct reclaim. The unhandled failure leads to a use-after-free.

In the Linux kernel's iomap module, the functions ifs_set_range_dirty() and ifs_set_range_uptodate() have an out-of-bounds write vulnerability in bitmap_set() when the range length is zero. An underflow in last_blk calculation leads to huge values, causing a write beyond the allocated memory.

In the Linux kernel's slip module, slip_receive_buf() reads and writes through the rbuff pointer without holding the sl->lock, while sl_realloc_bufs() can change the buffer size. An MTU change can lead to an out-of-bounds write or use-after-free.

In the Linux kernel's geneve module, the function geneve_changelink() does not check for CAP_NET_ADMIN in the device's network namespace (dev_net(dev)), allowing a caller with privileges only in one namespace to modify a geneve device whose underlay operates in another namespace.

In the Linux kernel's net/af_iucv subsystem, there is a NULL pointer dereference vulnerability in afiucv_hs_callback_syn(). When child socket allocation fails, nsk is NULL, and the connection-refused path unconditionally calls iucv_sock_kill(nsk), leading to a crash. The fix only calls iucv_sock_kill() when a child socket was successfully allocated.

In the Linux kernel's net/iucv subsystem, there is a use-after-free vulnerability in handling severed iucv_path connections. The message_q queue holds raw pointers to the iucv_path, which is freed when the connection is severed, but notifications remain queued. Later recvmsg() uses the freed path, leading to a bug. The fix drops queued notifications when the path is severed.

A vulnerability in the Linux kernel net/sched subsystem: qdisc_get_rtab() and qdisc_put_rtab() mutate the global qdisc_rtab_list and a non-atomic refcnt without locking, which is unsafe when called without RTNL (e.g., via cls_flower). This leads to a race condition, use-after-free, and double-free of the qdisc_rate_table structure.

In the Linux kernel's PTP subsystem for s390, there is a missing facility check. The physical clock is registered without verifying that facility 28 is installed and that PTFF QAF confirms PTFF QPT availability. The fix adds the missing check.

In the Linux kernel RBD driver, a positive result code in a reply to an object map update is not reset to zero, which can trigger an assertion and crash the system. The fix resets the positive result code to zero and adds a WARN_ON_ONCE.

In the Linux kernel gve driver, a page allocation failure during Rx buffer refill can cause a permanent queue stall. The fix introduces a recovery timer that periodically reschedules NAPI when the buffer count falls below a threshold.

In the Linux kernel ice driver, missing validation of ptype in ice_parser_profile_init allows a malicious VF to write past the bitmap, causing a page fault. The fix rejects out-of-range ptype values.

In the Linux kernel mac802154 llsec subsystem, missing validation of frame length relative to authentication tag length leads to passing a huge value to AEAD and out-of-bounds read. The fix rejects frames shorter than the tag.

In the Linux kernel, pppoe_sendmsg() saves a pointer to the PPPoE header before calling dev_hard_header(), which may reallocate the skb head and invalidate the pointer. Under certain conditions, this can lead to a write through a stale pointer into freed memory. The fix reloads the pointer after device header creation.

A vulnerability in the Linux kernel's rtase driver can cause TX hangs due to hardware packet parsing errors. Incomplete IPv4, IPv6, TCP, or UDP headers, as well as PTP packets with short transport data, may trigger this issue. The driver applies workarounds such as dropping malformed packets and padding transport data.

In the Linux kernel, in tcp_v4_send_ack() and tcp_v6_send_response(), when constructing standalone TCP responses with TCP-AO options, the alignment padding bytes after the MAC are left uninitialized and may be transmitted. The fix initializes only the padding in the TCP-AO branches before hashing the header.