CVE Vulnerability Catalog

In the Linux kernel, the ACPI processor module's IOAPIC hotplug lookup parses both MADT and _MAT records without full bounds validation. The MADT walk used a subtable's declared length to advance the cursor after only locating a generic header, and the _MAT path likewise passed a generic header to the IOAPIC helper.

In the Linux kernel on RISC-V with CONFIG_CFI_CLANG enabled, tailcalls in BPF cause kernel stack corruption. Due to double counting the kcfi instruction, the jump skips an extra 4 bytes and misses stack pointer adjustment. The fix removes this double inclusion.

In the Linux kernel, the RDMA/core subsystem has a potential use-after-free in ib_destroy_cq_user(). rdma_restrack_del() is invoked too late, leaving the CQ accessible through restrack while vendor-specific resources are already being freed.

In the Linux kernel, the RDMA/core subsystem has a potential use-after-free in ib_destroy_srq_user(). rdma_restrack_del() is invoked too late, leaving the SRQ accessible through restrack while vendor-specific resources are already being freed.

In the Linux kernel, the RDMA/core subsystem has a potential use-after-free in ib_free_cq(). rdma_restrack_del() is invoked too late, leaving the CQ accessible through restrack while vendor-specific resources are already being freed.

In the Linux kernel, the RDMA/core subsystem has a potential use-after-free in ib_dealloc_pd_user(). rdma_restrack_del() is invoked too late, leaving the PD accessible through restrack while vendor-specific resources are already being freed.

In the Linux kernel, the thermal intel int3400 driver's evaluate_odvp() creates per-ODVP sysfs files before the thermal zone and later probe resources are registered. The unwind path only calls cleanup_odvp() from the late sysfs failure path, so failures after evaluate_odvp(), including thermal_tripless_zone_device_register() failures, leave the ODVP files and storage behind. The fix moves ODVP cleanup to the common ART/TRT unwind path and clears cached ODVP pointers.

In the Linux kernel, the RDMA/erdma driver's erdma_destroy_qp(), erdma_destroy_cq(), erdma_dereg_mr(), and erdma_destroy_ah() return early when erdma_post_cmd_wait() fails, leaking queue buffers, MTTs, doorbells, and STAG, QPN, CQN, and AHN identifiers.

In the Linux kernel, a WARNING occurs in bpf_tracing_link_release because the verifier blindly sets 'tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX'. This corrupts the trampoline and causes failure to restore the prog's nop insn.

In the Linux kernel, set_user_buf_size() in the RDMA/mlx5 driver computes the QP buffer size by left-shifting user-supplied rq.wqe_cnt and rq.wqe_shift values as signed integers. A sufficiently large rq.wqe_cnt causes signed integer overflow, yielding a small or negative buf_size, causing ib_umem_get() to map a buffer smaller than the hardware will actually write into.

In the Linux kernel, the iommu/tegra241-cmdqv component has a synchronization flaw between the error interrupt handler (ISR) and VINTF initialization/deinitialization. Missing memory ordering and synchronization can lead to a NULL pointer dereference or use-after-free during a concurrent error. The vulnerability is fixed by using smp_store_release/smp_load_acquire barriers and synchronize_irq().

In the Linux kernel, the iommu/tegra241-cmdqv driver's __tegra241_cmdqv_probe() used devm_krealloc() to grow @smmu, which freed the original pointer upon relocation. A failure after that returned NULL, and the caller dereferenced the freed @smmu on its fallback path.

In the Linux kernel, the iommu/tegra241-cmdqv driver's tegra241_vintf_init_vsid() mapped a guest vSID to a single physical Stream ID from master->streams[0], only warning when the device did not have exactly one stream. A device with several streams had only its first mapped, and a device with none made master->streams a ZERO_SIZE_PTR, causing an out-of-bounds read.

In the Linux kernel, the RDMA/rxe module has a use-after-free (UAF) in the ODP init error-handling path. When rxe_odp_init_pages() fails, mr->umem is not reset to NULL, causing a later ib_umem_release() call to read already-freed fields.

In the Linux kernel, the nilfs2 filesystem has an out-of-bounds read when parsing the super-root block. The super-root inode metadata size is trusted before nilfs_read_inode_common() is called, allowing a malformed filesystem image to read past the super-root block.

In the Linux kernel, the ath12k Wi-Fi driver does not enforce a minimum length for the WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT structure, and the firmware-supplied num_vdevs field is used as a loop bound without validation. This can cause an out-of-bounds read. The fix adds a TLV policy entry and a helper to bound num_vdevs.

In the Linux kernel, the ath11k Wi-Fi driver does not enforce a minimum length for the WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT structure, and the firmware-supplied num_vdevs field is used as a loop bound without validation. This can cause an out-of-bounds read. The fix adds a TLV policy entry and a helper to bound num_vdevs.

In the Linux kernel, the last error path in rtl_pci_probe() skips cleanup functions due to a wrong goto label. Additionally, successful calls to rtl_init_rfkill(), ieee80211_register_hw(), and rtl_debug_add_one() are not reverted.

In the Linux kernel, mhi_register_controller() adds the controller device before creating the optional trigger_edl sysfs file. If sysfs_create_file() fails, the error path only drops the device reference and leaves the device registered.

In the Linux kernel, REQ_NOWAIT support in md personalities that can block internally is fundamentally incomplete. For writes, one mirror may succeed while another returns -EAGAIN, so md cannot distinguish queue pressure from a real device failure, potentially leaving mirrors with divergent data.