CVE Vulnerability Catalog

The Linux kernel has an issue in __dev_change_net_namespace() where conflicting alternative names (altnames) of network devices are not removed when changing network namespaces. This leads to a warning in cfg80211_pernet_exit() when removing a non-root namespace if two devices share the same altname. The vulnerability occurs when a device in init_net has a conflicting altname with a device in the dying namespace.

A vulnerability was fixed in the Linux kernel's net/rds module. The rds_tcp_reset_callbacks() function quiesced the transmit path by waiting for RDS_IN_XMIT to be sampled clear instead of taking the lock, which on weakly ordered architectures could allow the transmit path to run concurrently with the reset of cp_xmit_* state.

In the Linux kernel, a flaw was fixed in net/rds where rds_conn_shutdown() only sampled the RDS_IN_XMIT and RDS_RECV_REFILL flags as clear instead of acquiring their locks. On weakly ordered architectures, the transmit path could re-acquire the bit and run concurrently with connection teardown, causing a race and state corruption. The fix acquires both fastpath locks before transport shutdown and releases them after rds_conn_path_reset().

In the Linux kernel, nvme_scan_ns_list() drops stale namespaces in each gap of the reported NSID list one NSID at a time, calling nvme_find_get_ns() in each iteration. Since NSIDs are 32-bit, a sparse NSID space can make a single gap spin the loop billions of times with nothing to remove, leading to a soft lockup. The fix renames nvme_remove_invalid_namespaces() to nvme_remove_nsid_range() with an open (start, end) NSID range, bounding the work by the namespaces actually present.

In the Linux kernel, the bcmasp network driver's bcmasp_xmit() only set txcb->last = true for the final fragment of an SKB, leaving the field untouched for non-final fragments. If a descriptor slot was reused while still holding a stale true from a previous SKB, bcmasp_tx_reclaim() could prematurely free the sk_buff while its remaining fragments were still in flight.

In the Linux kernel, the mlxsw spectrum_ptp driver's PTP garbage-collection workqueue called napi_gro_receive() outside the NAPI poll context. This caused concurrent mutation of the NAPI GRO list by the GC workqueue and the NAPI thread on another CPU, leading to list corruption and a kernel panic. The fix introduces an ingress-delivery helper that uses netif_receive_skb() instead of napi_gro_receive().

In the Linux kernel, the BPF verifier incorrectly predicted the outcome of pointer vs zero comparisons in JMP32 instructions, failing to distinguish BPF_JMP from BPF_JMP32 comparisons. This led to incorrect inference that a jump is always taken.

A vulnerability in the Linux kernel DSA bcm_sf2 driver regarding unbounded CFP rule dump by caller's buffer size was fixed. The function bcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap without consulting nfc->rule_cnt, allowing out-of-bounds access. The flaw is reachable without CAP_NET_ADMIN.

In the Linux kernel, the nfp ethernet driver dumps ntuple rules into a caller-provided buffer without checking its size. nfp_net_get_fs_loc() writes every entry of nn->fs.list into rule_locs[] while ignoring cmd->rule_cnt, so a user without CAP_NET_ADMIN can call ETHTOOL_GRXCLSRLALL with fewer slots than there are rules and run past the allocation; a rule_cnt of 0 leaves a NULL pointer that gets dereferenced.

In the Linux kernel, the DSA mv88e6xxx driver dumps policy rules into a caller-provided buffer without checking its size. mv88e6xxx_get_rxnfc() uses rxnfc->rule_cnt as the write index, clobbering the input value that indicates how many slots the caller had room for, so a user without CAP_NET_ADMIN can call ETHTOOL_GRXCLSRLALL with fewer slots than there are rules and run past the allocation; a rule_cnt of 0 leaves a NULL pointer that gets dereferenced.

A vulnerability in the Linux kernel's VXLAN driver allows dynamic FDB entries to reference a nexthop ID, which is invalid and can lead to list corruption, race conditions, and use-after-free. The fix rejects such entries during creation and update.

In the Linux kernel, an RTM_NEWQDISC request could make clsact bind a populated shared ingress block during ->init(), publishing an embedded mini_Qdisc to lockless readers. If the same request had an invalid TCA_RATE, estimator setup failed after ->init(), and the unwind synchronously freed the containing qdisc while tc_run() might still hold it, leading to a use-after-free.

In the Linux kernel iommu/amd driver, amd_iommu_pdom_id_alloc() returns an int (domain ID or negative errno), but amd_iommu_alloc_domain_nested() stores the result in the u32 field gdom_info->hdom_id, discarding the sign. As a result, -ENOSPC becomes 0xffffffe4 and the "<= 0" test never fires, so the nested domain is set up with an unallocated ID. The fix keeps the value in an int, tests it, and stores it only after validation.

In the Linux kernel, the vdpa_sim_blk module has a bug where out-of-range sector starts are accepted. vdpasim_blk_check_range() logs an invalid start sector but continues validating the request; the subsequent unsigned capacity subtraction can underflow and let an out-of-range buffer offset reach the data path. This leads to an out-of-bounds write (VIRTIO_BLK_T_OUT, VIRTIO_BLK_T_WRITE_ZEROES) or out-of-bounds read (VIRTIO_BLK_T_IN).

In the Linux kernel, the vdpa_sim_net module has a bug where the TX pull result is not checked before the RX copy. vringh_iov_pull_iotlb() returns a signed byte count; a failed TX pull is currently added to the unsigned byte counter and then passed as a size_t length to receive_filter() and vringh_iov_push_iotlb(). A negative error can therefore become a large length in the RX path.

A flaw was found in the Linux kernel's namespace listing mechanism (listns), where legitimize_ns() takes a reference on the namespace before may_list_ns() checks permissions. On the denied path, dropping the last reference to a mount namespace occurs inside an RCU read-side critical section, which can sleep there and trigger a kernel warning.

In the Linux kernel, the hinic driver has a heap buffer overflow in the mailbox segment validation. The last segment can carry a full 48-byte payload, causing a 16-byte write beyond the 2048-byte receive buffer. The fix limits the last segment length to the remaining buffer space.

In the Linux kernel, the stmmac driver has an issue with TX descriptor availability for TSO traffic. The estimation of free descriptors is inaccurate, potentially leading to writing past available descriptors and corrupting the TX ring. The fix adds a function to compute the exact number of descriptors needed.

A race condition exists in the Linux kernel's __slab_try_return_freelist() function in mm/slab. The function incorrectly assumed that if freelist is NULL and cmpxchg succeeds, no other CPU has freed an object to the slab, leading to a classic ABA problem and list corruption. This results in a kernel panic and denial of service (DoS).

In the Linux kernel, the IPv6 subsystem has a use-after-free vulnerability in the fib6 walker iterator during sequence stop. A walker can be moved to the FWS_U state, which is incorrectly treated as unlinked, leading to the seq object being freed while still on the fib6_walkers list, and later route deletions use the freed walker.