CVE Vulnerability Catalog

In the Linux kernel, netfilter xt_hashlimit has a vulnerability due to uninitialized access to the burst field in the union of the dsthash_ent structure when XT_HASHLIMIT_RATE_MATCH mode is used by fewer than two rules referring to the same hashtable. Additionally, this mode is rejected for revisions less than 3.

In the Linux kernel, RDS/TCP has a use-after-free vulnerability in rds_tcp_laddr_check(). The function obtains a pointer to an IPv6 interface, drops the RCU lock, and then uses that pointer in ipv6_chk_addr(), which can lead to reading freed memory if the interface is deleted.

In the Linux kernel's nexthop module, there is a race condition during nexthop replacement. The functions fib6_check_nh_list() and __nexthop_replace_notify() walk the f6i_list without holding the nh->lock, while IPv6 RTM_NEWROUTE/RTM_DELROUTE operations mutate that list under the same lock. This leads to a use-after-free condition that could be exploited for code execution or system crash.

In the Linux kernel's nexthop module, there is a race condition in the nh_rt_cache_flush() function, which walks the f6i_list without holding the nh->lock. IPv6 route add/delete operations mutate that list under the lock and can free fib6_info entries, leading to a use-after-free. An attacker could exploit this to escalate privileges or cause a system crash.

A vulnerability in the Linux kernel's AF_XDP causes a buffer leak when dropping multi-buffer packets in xsk_drop_skb(). In three scenarios (overflow error, invalid TX descriptor, socket close), TX descriptors are consumed but buffer addresses are not published to the CQ, causing userspace to lose track of them. The fix triggers the skb destructor to submit addresses to the CQ and moves address assignment before the overflow check.

In the Linux kernel's XSK (AF_XDP) module, there is a vulnerability in the xsk_build_skb() function related to multi-buffer logic in the generic transmit path. When packets are too large (descriptor count exceeds MAX_SKB_FRAGS) or contain an invalid descriptor, continuation descriptors are silently lost and cannot be reused. The fix introduces the xdp_sock::drain_cont flag to drain them to the Cq queue.

In the Linux kernel, a vulnerability was found in the XSK zero-copy Tx batch processing path. Invalid descriptors can cause UMEM frame loss or completion ordering violations, leading to incorrect Tx queue behavior.

In the Linux kernel's libiscsi (SCSI) library, there is a vulnerability involving stale-data leak into the sense buffer. The iscsi_scsi_cmd_rsp() function copies sense data from a SCSI response, but the bounds check does not account for the 2-byte sense length prefix. A target can return a response with datalen equal to senselen, causing a read up to two bytes past the data and copying them into the sense buffer, which is returned to userspace.

In the Linux kernel, the libiscsi_tcp module lacked a check on the data segment size in SCSI responses, which could lead to overflow of the conn->data buffer (8192 bytes) by a malicious iSCSI server. The vulnerability affects the ISCSI_OP_SCSI_CMD_RSP path, where the data segment (sense/response data) was copied without proper bounds.

In the Linux kernel SCSI libsas subsystem, there is a deadlock during host adapter resume and a race condition in the hisi_sas driver related to disk wake-up. The issue appeared after a change that skipped draining the event workqueue, causing disks to send I/O to a suspended controller and get disabled. The fix moves the PHYE_RESUME_TIMEOUT notification after the workqueue drain, eliminating the deadlock and restoring safe resume behavior.

In the Linux kernel, the ath12k driver had an out-of-bounds error in ath12k_mac_dp_peer_cleanup(), where indexing the free_ml_peer_id_map bitmap used peer_id with the ATH12K_PEER_ML_ID_VALID bit (BIT(13)) set, leading to writes beyond the bitmap memory (256 bits). This caused memory corruption and exhaustion of ML peer IDs.

In the Linux kernel, the hwmon nct6775-core driver for the NCT6116 chip used an incorrect number of temperature registers (six instead of three), leading to an out-of-bounds read (KASAN). The fix sets the number of registers to three and removes the unnecessary array.

In the Linux kernel, the hwmon lm90 driver is vulnerable to reading sysfs attributes before driver registration is complete, which can lead to a NULL pointer dereference in lm90_report_alarms(). The fix schedules work only after data->hwmon_dev is set.

In the Linux kernel, the hwmon nzxt-smart2 driver had an output buffer not aligned to DMA boundaries, which on architectures with non-coherent caches (e.g., ARM, MIPS) led to memory corruption during DMA mapping. The fix aligns the buffer to ARCH_DMA_MINALIGN.

In the Linux kernel network stack, when peer entry allocation (inet_getpeer_v4/v6) fails, functions sending ICMP/NDISC Redirects sent packets without rate limiting, potentially leading to a packet storm. The fix prevents sending redirects when peer is NULL.

In the Linux kernel, the hwmon nct6775-core driver for the NCT6116 chip has weight register arrays with only 3 elements, but the driver iterates up to 5 PWM channels, leading to out-of-bounds reads (KASAN) and invalid hardware register access. The fix extends the arrays with zeroed fields to mark unsupported registers.

In the Linux kernel, the forcedeth driver has a use-after-free vulnerability in nv_remove(), where per-CPU txrx_stats are freed before unregistering the network device, potentially leading to access to freed memory. The fix moves the free after unregister_netdev().

In the Linux kernel, the hwmon adt7470 driver, setting auto_update_interval to 0 via sysfs causes the update thread to loop tightly, leading to continuous CPU usage and flooding the I2C bus. The fix raises the lower limit of the interval to 500 ms.

In the Linux kernel, the adt7470 hwmon driver has a divide-by-zero TOCTOU vulnerability in fan speed read. If fan data becomes zero between the validity check and conversion, a race with a concurrent update can cause a crash.

In the Linux kernel, the rtase driver has a double free of multi-frag skb on DMA map failure. When the head buffer DMA mapping fails after fragments are mapped, the error path frees the skb twice, leading to a crash.