CVE Vulnerability Catalog

In the Linux kernel ice driver, there is a resource leak of CTRL VSI when resetting all VFs with FDIR filters enabled. The ice_reset_all_vfs() function only invalidates CTRL VSIs but does not free them, leading to resource leak. The fix uses ice_vf_ctrl_vsi_release() instead of ice_vf_ctrl_invalidate_vsi(), aligning with the behavior of ice_reset_vf().

In the Linux kernel msc313 RTC driver, there is a NULL pointer dereference in the shared IRQ handler during probe. msc313_rtc_probe() calls devm_request_irq() with IRQF_SHARED and passes &pdev->dev as the cookie, but platform_set_drvdata() is called later. If another device on the same IRQ line triggers the handler in that window, the handler does dev_get_drvdata() on the cookie, gets NULL, and dereferences priv->rtc_base in interrupt context. The fix passes priv as the cookie directly so the handler reads it from dev_id without the lookup.

In the Linux kernel BPF mechanism, conntrack lookup and allocation kfuncs take an opts pointer and an opts__sz argument. The verifier checks only the memory range described by opts__sz, but the wrappers unconditionally write opts->error whenever the internal helper returns an error. For an invalid size smaller than the end of opts->error, that write can land outside the verifier-checked range. The fix keeps returning NULL for invalid arguments, but only reports the error through opts->error when the supplied size includes the field.

In the Linux kernel, the ksmbd (SMB server) module has a use-after-free vulnerability in the conn->preauth_info structure during concurrent SMB2 NEGOTIATE requests. One thread can free the memory while another thread in the response send path still uses it, leading to a use-after-free read (confirmed by KASAN).

In the Linux kernel IPv4 FIB, when CONFIG_IP_MULTIPLE_TABLES is enabled but no rule is added, fib_lookup() performs route lookup directly on two tables. Since the first lookup does not properly bail out, the result of an error route in the merged local/main table could be overwritten by another route in the default table. The fix corrects this inconsistent behavior so that the error route is respected.

A race condition was found in the Linux kernel's md/raid5 subsystem during stripe batch breaking. The issue involves R5_Overlap flag operations, potentially causing a process to hang (wait_on_bit) due to a missed wake-up. The fix expands the protected zone and reorders batch_head pointer updates to prevent concurrent access.

A vulnerability was found in the Linux kernel's netfilter nf_nat module, involving the use of an invalid nat_net pointer after a failed nf_nat_init(). This leads to an out-of-bounds read (slab-out-of-bounds), which could be exploited by a local user to cause a system crash or potentially escalate privileges.

A vulnerability in the Linux kernel's netfilter (nf_conncount) causes incorrect packet drops for valid connections when using connlimit in soft-limiting scenarios. The issue occurs when a new connection reuses a socket in TIME_WAIT state, where the connection tracking entry is mistakenly treated as confirmed, leading to a zeroed active connection count and false rejection of traffic. The fix replaces the loopback interface check with protocol-agnostic state checks (IPS_ASSURED), allowing early-confirmed setup packets to be properly evaluated and counted.

In the Linux kernel netfilter flowtable, the function nf_flow_ip4_tunnel_proto() does not validate the iph->ihl field before using it to compute the header size, which can lead to out-of-bounds access with malformed IP headers. The fix adds a sanity check for the ihl field and uses iph->protocol instead of the hardcoded IPPROTO_IPIP constant when setting ctx->tun.proto, and references ctx->tun.hdr_size when updating ctx->offset.

In the Linux kernel, the nft_compat layer fails to reject non-bridge targets in ebtables emulation. xtables targets return verdicts incompatible with ebtables, which may lead to incorrect behavior.

In the Linux kernel, the ge_put_enum_double() function in ASoC SDCA lacks validation of the index value before use. This may lead to an out-of-bounds read of the values buffer.

In the Linux kernel, the DSA driver sja1105 rounds up the PTP perout pin duration to at least 1 tick to avoid division by zero in future_base_time().

In the Linux kernel, the SCTP protocol has memory leaks of err_chunk in INIT handling. In several code paths, the allocated chunk is not freed, leading to memory leaks.

In the Linux kernel, on s390/mm there is an issue with the _PAGE_UNUSED bit. This bit is not cleared in some pte-setting paths, which may lead to guest memory corruption.

In the Linux kernel, the DSA driver mxl862xx has a use-after-free of DSA ports in crc_err_work. The work may run after ports are freed, leading to dereferencing freed memory.

In the Linux kernel, in the octeontx2-af subsystem, an incorrect condition checking whether any LFs (Logical Functions) have been assigned to a PF/VF was fixed. The patch addresses validation of the maximum number of LFs set via the devlink command.

In the Linux kernel, the mvneta driver (Marvell Armada 370/XP/38x) has a vulnerability causing permanent masking of per-CPU interrupts after resume from suspend. If suspend occurs while NAPI poll is pending, the interrupt is never re-enabled, leading to complete loss of network connectivity.

In the Linux kernel, in the geneve subsystem, a vulnerability was fixed where geneve_gro_complete() did not check the gs->gro_hint flag, allowing an attacker to supply a crafted packet with a hint option, leading to an out-of-bounds read (KASAN: slab-out-of-bounds). The fix involves honoring the gs->gro_hint flag in the complete path as well.

In the Linux kernel, in the geneve subsystem, a vulnerability was fixed where geneve_gro_complete() did not validate the inner network offset, which could lead to an out-of-bounds read. The fix adds a check that the computed offset does not exceed the recorded inner network header.

In the Linux kernel, in the sungem subsystem, a double-free of resources during error handling in gem_init_one() was fixed. Previously, when register_netdev() failed, gem_remove_one() was called, and then the same resources were freed again, leading to a double-free.