CVE Vulnerability Catalog

A vulnerability in the Linux kernel's binfmt_misc mechanism allows an 'F' entry to pin its own instance, causing a superblock deadlock and memory leak. An attacker can exploit this flaw to cause a denial of service (DoS) and permanently consume user namespace charges.

A vulnerability in the Linux kernel's binfmt_misc mechanism causes a user namespace reference leak when a mount operation fails. Due to improper superblock lifecycle handling, an unprivileged user can intentionally trigger mount failures and exhaust memory by accumulating unreleased namespaces.

A vulnerability was found in the Linux kernel's huge page splitting mechanism in mm/huge_memory. After splitting a folio, the code still accessed the mapping structure (i_mmap_rwsem) after the split folios were unlocked and freed, leading to a use-after-free. This occurs especially during memory failure handling for poisoned tails of shmem folios.

A use-after-free (UAF) vulnerability was found in the Linux kernel during system suspend (S3) or hibernation (S4). The page reporting work (page_reporting_process) was scheduled on the global system_wq, which lacks the WQ_FREEZABLE flag, leaving it active during suspend and causing access to deleted virtqueues, leading to a crash. The fix switches to system_freezable_wq, which is frozen before device drivers destroy their virtqueues.

In the Linux kernel, the bridge module has a bug in br_multicast_leave_group() that can lead to a use-after-free after deleting a port group during fast-leave multicast handling.

A use-after-free vulnerability has been found in the Linux kernel's pktgen module. The issue involves a race between network device renaming and removal of the /proc entry, which can lead to accessing freed memory by the kpktgend thread.

In the Linux kernel, the UML vector driver has a use-after-free bug in vector_mmsg_rx() when a packet with an invalid header is discarded. The freed skb remains in the buffer, leading to double-free and potential exploitation.

In the Linux kernel, the uprobes mechanism has a NULL pointer dereference bug in hprobe_expire() when forking a process with a pending uretprobe. This can cause a kernel oops.

In the Linux kernel, the veth interface has a vulnerability in handling frag_list skbs before running XDP. Frag_list skbs can have data_len set but empty frags[], leading to bogus XDP fragment metadata and a crash in AF_XDP copy mode.

In the Linux kernel, the vxlan module's route_shortcircuit() function reads the neighbour hardware address n->ha without holding the seqlock, which can lead to torn reads or partially updated MAC addresses.

In the Linux kernel, the vxlan module's vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get() functions use pskb_may_pull() instead of pskb_network_may_pull(), which does not account for the MAC header offset and can leave part of the network header in non-linear frags.

In the Linux kernel, the vxlan module's route_shortcircuit() function uses pskb_may_pull() instead of pskb_network_may_pull(), which does not account for the MAC header offset and can lead to reading beyond the pulled linear buffer when accessing IP header fields.

In the Linux kernel, the ublk module's ublk_ctrl_add_dev() function does not reset driver-owned dev_info fields such as ->state and ->ublksrv_pid after copying data from userspace. This can lead to crashes (oops) when deleting a device or to incorrect behavior.

In the Linux kernel, the tracing module's trace_module_add_events() function ignores the return value of __register_event() and unconditionally calls __add_event_to_tracers(). If event registration fails, it can lead to a use-after-free.

In the Linux kernel, the scsi_debug module's resp_report_zones() function has an underflow vulnerability in alloc_len calculations, which on 32-bit systems can lead to an out-of-bounds write and kernel panic.

In the Linux kernel, the SCTP module's sctp_assoc_add_peer() function increments the 16-bit transport_count, which can wrap to zero after adding 65,536 unique peers. This can lead to an out-of-bounds write in SCTP diagnostics (sock_diag).

In the Linux kernel, a vulnerability was found in the PCH GPIO driver where pch_irq_type() uses a regular spinlock (spinlock_t) in a context requiring a raw spinlock (raw_spinlock_t). On PREEMPT_RT systems, a regular spinlock is an rtmutex-based sleeping lock, leading to an invalid sleep in atomic context and a kernel BUG.

In the Linux kernel, the s390/qeth module lacks a CAP_NET_ADMIN check for private ioctls (SIOCDEVPRIVATE), allowing unprivileged users to invoke these commands.

In the Linux kernel, in the s390/zcrypt subsystem, a speculative memory read possibility was found. The user-controlled domain value is used as an array index after bounds checking, but without a speculation barrier. The missing array_index_nospec() call was added to prevent speculative execution.

A use-after-free vulnerability was found in the Linux kernel's Open vSwitch module. The issue occurs when attaching a newly created meter: attach_meter() can make the meter visible to other CPUs but still fail afterwards. On failure, ovs_meter_cmd_set() frees the meter without waiting for RCU readers, leading to use-after-free.