CVE Vulnerability Catalog

In the Linux kernel, in the RDMA/mlx5 driver, MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT() linked event_sub into the list before initializing fields used in the error path, leading to NULL dereference and incorrect XA cleanup. The fix adds devx_key_in_sub_list() and calls subscribe_event_xa_dealloc() only for the last matching pending entry.

In the Linux kernel, in the RDMA/srpt driver, the immediate data length check did not check for integer overflow, allowing a malicious initiator to bypass bounds check and pass ~4GB length to sg_init_one(). The fix uses check_add_overflow().

In the Linux kernel, in drm_syncobj_find_fence() there is a memory leak because drm_syncobj_find() takes a reference to syncobj, but the early return does not drop the reference. The fix drops the reference before the early return.

In the Linux kernel, dm_poll_bio() passed polling flags unchanged to clones, which could cause long spinning and RCU CPU stall. The fix forces one-shot polling for target bios.

In the Linux kernel, in the tracing module, synthetic field helpers used strcat() to build names and commands in fixed buffers, which could lead to out-of-bounds write. The fix uses seq_buf and propagates -E2BIG when MAX_FILTER_STR_VAL is exceeded.

In the Linux kernel, the irdma_copy_user_pgaddrs function has an out-of-bounds write vulnerability. The issue occurs when palloc->total_cnt is zero, causing the loop to potentially go beyond the fixed size of the pgaddrmem array (4 elements) in the lvl==0 case. This can lead to buffer overflow.

In the Linux kernel, the RDMA HNS driver has a log flood issue after hns_roce_cmd_mbox() failure. When hardware is abnormal, unlimited error messages can cause log flood and even system crash.

A use-after-free (UAF) vulnerability was found in the Linux kernel's ALSA OSS sequencer subsystem. The issue occurs when SysEx data is processed and the sequencer port is closed before the event is dispatched, leading to use of freed memory. The patch extends the refcounting mechanism to protect resources until the event is dispatched.

In the Linux kernel's ALSA SEQ MIDI subsystem, a use-after-free and NULL pointer dereference vulnerability was found. The issue stems from missing synchronization between the event processing path and MIDI output teardown, which can lead to system crashes.

In the Linux kernel, the nvmet-tcp module has a memory leak in the error path. When a connection is closed during allocation, the page fragment cache is not drained, leading to memory leak on each failed connection.

In the Linux kernel, the nvmet-tcp module does not check the return value of nvmet_tcp_set_queue_sock(). If it fails, socket callbacks are not properly set, leading to queue and socket leakage.

A vulnerability was found in the Linux kernel's nvme-multipath driver. The nvme_ns_head structure has a flexible array current_path[] indexed by NUMA node ID. Memory allocation used num_possible_nodes, which on systems with sparse NUMA IDs (e.g., POWER9) leads to out-of-bounds access (slab-out-of-bounds).

In the Linux kernel, the nvme-pci driver has an out-of-bounds access in nvme_setup_descriptor_pools. On non-NUMA kernels, hctx->numa_node is -1, but the parameter is declared as 'unsigned', causing the index to become UINT_MAX and walk off the array, leading to a page fault.

In the Linux kernel, the cls_bpf module has unbounded recursion in cls_bpf_offload_cmd, which can lead to stack overflow. The issue occurs when tc_setup_cb_replace() fails and the rollback attempt also fails, causing recursive calls.

In the Linux kernel, the host1x module has an issue where BO cache entries cannot be freed. Cached mappings hold a reference to the buffer object, preventing its release, leading to memory leak.

In the Linux kernel, the gpu: host1x driver has been fixed to correctly check the return value of iommu_map_sgtable(). The function now returns ssize_t with negative values on error, not size_t with zero. Additionally, pin_job() was incorrectly assigning to 'int', which could cause overflows into negative values.

In the Linux kernel, the dax/kmem subsystem has been fixed to handle partial discontiguous resources during removal. When dev_dax_kmem_probe() partially succeeds but a subsequent range fails, dev_dax_kmem_remove() may attempt to remove a non-existent resource, leading to NULL pointer dereference.

In the Linux kernel, the RDMA/rxe driver has been fixed for a TOCTOU heap overflow in get_srq_wqe(). The function reads num_sge from the shared receive queue buffer mapped into userspace, validates it, but then re-reads the same field to calculate memcpy size, allowing a concurrent thread to modify it and cause a heap buffer overflow.

In the Linux kernel, the RDMA/rxe driver has been fixed for the non-SRQ receive path, where WQE fields were read directly from the shared queue buffer mapped into userspace. This allowed a malicious user to modify fields during processing, leading to out-of-bounds reads.

In the Linux kernel, the md/raid10 driver has been fixed to reset read_slot when reusing r10bio for discard. If the r10bio was previously used for a read, read_slot could be non-negative, causing the cleanup to skip bio_put() on repl_bio.