CVE Vulnerability Catalog

In the Linux kernel, the tipc_l2_send_msg() function has a use-after-free (UAF) vulnerability. The issue arises because tipc_disable_l2_media() calls synchronize_net() while the media_ptr pointer is still valid, allowing concurrent RCU readers to obtain the device pointer after synchronization, and then the device can be freed while still in use.

In the Linux kernel's TCP for IPv6, the ip6_default_advmss() function can return IPV6_MAXPLEN (65535), which is interpreted as mss_clamp, allowing MSS to reach 65535. However, 0xFFFF is also used as a magic value GSO_BY_FRAGS, which can lead to a NULL pointer dereference during TCP packet segmentation.

In the Linux kernel's RDMA bnxt_re driver, the dpi variable is initialized only for the BNXT_RE_ALLOC_WC_PAGE case, but it is copied for all cases. Lack of initialization may lead to use of an uninitialized value.

In the Linux kernel's RDMA bnxt_re driver, the toggle page for SRQ is freed before firmware teardown completes, which could allow an NQ interrupt to write to an already-freed page. The fix moves the page free after bnxt_qplib_destroy_srq().

In the Linux kernel's RDMA bnxt_re driver, the toggle page for CQ is freed before firmware teardown completes, which could allow an NQ interrupt to write to an already-freed page. The fix moves the page free after bnxt_qplib_destroy_cq().

In the Linux kernel's RDMA bnxt_re driver, when dumping MR info using the rdma tool, the kernel pointer mr_hwq is displayed. There is no need to expose this value to the end user, so it has been removed.

In the Linux kernel's RDMA bnxt_re driver, there is a missing max slot check for SQ. The WQE mode variable must be validated against the maximum slots supported by HW (max 64K). Added max and min checks to fail if user supplied value is more than max or zero.

In the Linux kernel, in the RDMA/bnxt_re driver, the function bnxt_qplib_alloc_dpi returns success even when ioremap fails. Proper rollback is added for ioremap failure and -ENOMEM status is returned.

In the Linux kernel, in the RDMA/bnxt_re driver, applications can request multiple WC pages for the same ucontext, but only one WC page per ucontext is currently supported. A lock is added to avoid concurrent access and a check to fail repeated requests. Also, if the mmap entry insert fails for the WC, the Doorbell page index mapped for the WC page is freed.

In the Linux kernel, in the RDMA/irdma driver, the waitqueue and request_done flag are replaced with a completion. The previous use of the flag without proper memory barriers could lead to concurrency issues. Using a completion solves this problem in a purpose-built way.

In the Linux kernel, in enqueue_to_backlog(), there is a TOCTOU race related to the lockless netif_running() check. The check is moved inside the backlog lock, serializing it with the flush operation and preventing the use-after-free reported by syzbot.

In the Linux kernel, in the ksmbd module, same_client_has_lease() returns an opinfo pointer from ci->m_op_list after dropping ci->m_lock without taking a reference. This can lead to use-after-free during concurrent close. A reference is now taken and released after copying the lease state.

A race condition was found in the Linux kernel's 9p/RDMA driver (trans_rdma.c) affecting the rdma->state field. The field is modified without req_lock in recv_done() and p9_cm_event_handler(), while rdma_request() uses the lock. This can lead to lost state transitions, corrupted connection state machine, and use-after-free of RDMA request objects during teardown.

In the Linux kernel, in the staging rtl8723bs driver, the rtw_aes_decrypt function had an incorrect stainfo pointer check that returned _FAIL on a valid pointer. The guard is inverted to return _FAIL only on an invalid pointer.

In the Linux kernel, in the staging nvec driver, nvec_rx_completed() has a use-after-free bug. After calling nvec_msg_free(), the code still reads nvec->rx->data[0], which may be overwritten by a concurrent nvec_msg_alloc() call. The fix saves the message type byte before freeing and uses the saved value.

In the Linux kernel, in the soundwire subsystem, the sdw_add_element_group_count function had an out-of-bounds memory access in the for-loop when i == num. The fix adds a check for existing rate/lane entries before adding them, with no functional changes apart from this fix.

In the Linux kernel, in the PCI subsystem, pci_get_rom_size can crash due to out-of-bounds access to ROM space or misaligned data structure address. Added checks for image header and data structure address, and alignment checking, to prevent crashes on x86_64 and arm64.

In the Linux kernel, the mtk-adsp mailbox driver has a use-after-free vulnerability during device teardown. When SOF audio driver initialization fails, the snd_sof_dev object is freed, and a late interrupt can trigger a handler after the channel is freed, leading to access of freed memory. The fix uses disable_irq() and IRQF_NO_AUTOEN to prevent interrupts from firing at inappropriate times.

In the Linux kernel, the coresight platform subsystem has an issue where connection counters are incremented before successful memory allocation. If allocation fails, the counter remains incremented, and cleanup functions may dereference invalid pointers, causing a kernel panic. The fix moves counter increments after all allocations succeed.

In the Linux kernel, the most: video driver has a double free vulnerability during failed video device registration. The function comp_register_videodev() frees the video_device, but the error path in __video_register_device() also frees it, leading to a double free. The fix uses video_device_release_empty() during registration to avoid double freeing.