CVE Vulnerability Catalog

In the Linux kernel, the net/mlx5 (LAG) module has an off-by-one error in mlx5_lag_create_single_fdb() during error rollback. The cleanup loop starts at index i, which can operate on uninitialized state or double-tear-down a rule. The fix changes the loop start to i - 1 so only successfully-installed entries are undone.

In the Linux kernel, the mlx5e (TC) driver has a vulnerability causing a kernel crash when cleaning up peer flows in a LAG configuration. The issue occurs when mlx5_lag_get_dev_seq() returns an error, leading to invalid memory access. The fix skips peer processing when the LAG sequence lookup fails.

In the mlx5e driver for Mellanox network cards, a vulnerability was found involving zero-sized buffer allocation for HV VHCA stats. The buffer is allocated before channel initialization when the channel count is zero, resulting in ZERO_SIZE_PTR instead of NULL. After channels open and hypervisor reporting is enabled, a memset operation on this pointer causes a page fault at address 0x10.

In the mlx5e driver for Mellanox network cards, a race condition was found during HV VHCA stats agent registration. The asynchronous control path may run before work structure and agent pointer initialization, leading to NULL pointer dereference or kernel data structure corruption.

In the Linux kernel, the mlx5e driver (for Mellanox/NVIDIA network cards) has a race condition when publishing new entries in the priv->channel_stats[] array. Due to missing memory barriers, on weakly-ordered architectures (ARM, PowerPC, RISC-V) a reader may see an updated stats_nch counter but not yet fully visible array entries, leading to a NULL pointer dereference. The issue was observed on BlueField-3 DPU platforms (arm64) during netdev statistics queries over netlink.

A vulnerability in the Linux kernel affects Microchip network drivers (sparx5, lan969x) related to the shared Super VCAP block. VCAP instances are not independent but were locked separately, causing races during concurrent access. An attacker can use debugfs to read rules outside rtnl, leading to corruption of hardware entries.

In the Linux kernel's qede driver, there is an off-by-one error in BD ring consumption when skb building fails. The functions qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a NULL return from qede_build_skb(), leading to excessive BD consumption and desynchronization of the BD ring, which can corrupt DMA page reference counts and cause SLUB freelist corruption.

In the Linux kernel's net/sched: act_pedit module, there is a TOCTOU vulnerability leading to a heap out-of-bounds write during TC offload. A race between sizing a flow_rule buffer and filling it can allow an attacker with CAP_NET_ADMIN to write controlled content beyond the allocated memory region.

A vulnerability in the Linux kernel's Bluetooth 6lowpan module was found, where lowpan_enable_set() schedules work on a system queue without tracking it, allowing a race during module exit. The work can run after resources are closed, leading to use-after-free.

A use-after-free vulnerability was found in the Linux kernel's Bluetooth 6LoWPAN module, caused by missing L2CAP connection reference during debugfs write operations. This allows a race condition where a concurrent disconnect can free the connection object while it is still being accessed.

In the Linux kernel Bluetooth (MGMT) subsystem, a use-after-free vulnerability exists during advertisement monitor addition. Improper ownership handling between the MSFT add path and management command completion can lead to use of freed memory, as shown by a KASAN report.

In the Linux kernel's Bluetooth ISO subsystem, there is a vulnerability related to improper handling of ISO_END/CONT packets. Incorrect handling can lead to memory leak of conn->rx_skb, kernel panic on skb_put, or acceptance of too short ISO_END packets.

A vulnerability in the Linux kernel Bluetooth L2CAP subsystem causes an identifier (ident) leak for commands without a response. Specifically, repeated L2CAP_LE_CREDITS packets exhaust the 1-255 ident range, leading to packets with invalid ident 0 and permanent channel stall for LE CoC.

In the Linux kernel's accel/amdxdna driver, there is a vulnerability leading to a deadlock during PM resume in hwctx_sync_debug_bo(). The function invokes a hardware callback while holding xdna->dev_lock, which can cause a deadlock when the device is suspended.

In the Linux kernel's accel/amdxdna driver, there is a use-after-free vulnerability due to a race in VMA access. The functions aie2_populate_range() and amdxdna_umap_release() access a saved VMA pointer that may have already been freed, leading to potential use-after-free.

In the Linux kernel's net/tls module, there is an issue in tls_sw_read_sock() that causes empty TLS application data records to block subsequent data records. Empty records (allowed in TLS 1.3) are not consumed, leading to an infinite loop and connection stall.

In the Linux kernel's liquidio driver, there is an issue with caching VF pci_dev pointers without proper reference counting, potentially leading to use-after-free when handling FLR requests.

In the Linux kernel's accel/amdxdna module, there is a race condition in amdxdna_umap_release() that can lead to use-after-free when aie2_populate_range() runs concurrently.

In the Linux kernel's v3d graphics driver, there is a missing validation of the indirect buffer handle in v3d_get_cpu_indirect_csd_params(), which can lead to NULL pointer dereference when the CSD job runs.

In the Linux kernel's net/sched cake module, there is an issue with handling negative overhead values that can cause packet length to wrap to a large value, disrupting rate accounting.