CVE Vulnerability Catalog

In the mt76 driver, there is a race in RXDMAD_C buffer recycling. These buffers come from page pools tied to a different NAPI, so direct recycling can race with the owning NAPI, leading to errors.

In the Linux kernel, mt7996_mac_reset_work() in the mt76 wifi driver (mt7996) parked the tx worker and disabled the RX/TX NAPIs before taking dev->mt76.mutex. Since mt76_worker_disable()/_enable() are plain kthread park/unpark, not refcounted, and __mt76_set_channel() toggles the same worker and the MT76_RESET bit under the mutex, an L1 SER racing a channel switch could leave the worker unparked and MT76_RESET cleared while the reset path resets the DMA rings, corrupting descriptors or tokens.

In the Linux kernel, btf_distill_func_proto() accepts function arguments up to 16 bytes, so a 128-bit scalar such as __int128 reaches the x86 trampoline with arg_size == 16. The current implementation assumes an __int128 argument only needs one register, so the register save area is under-allocated and save_args() overwrites adjacent stack slots.

In the mt76 wifi driver (mt7915), the TWT flow is added to dev->twt_list before sending the agreement to the firmware, but the error path leaves it linked while flowid_mask is never set. The flow slot can then be reused and memset while still on the list, corrupting twt_list, and station removal leaves a dangling entry behind.

In the mt76 wifi driver (mt7915), after mt7915_register_ext_phy() succeeded, a failure of the main PHY mt7915_init_debugfs() or mt7915_coredump_register() unwound through free_phy2, which called ieee80211_free_hw() on the ext PHY hw while it was still registered with mac80211, since mt76_unregister_device() only unregisters the main hw.

In the Linux kernel for arm64, the ptrace subsystem has an issue with keeping 'orig_x0' in sync with x0 on syscall entry. A previous fix failed to update 'orig_x0' during SECCOMP_RET_TRACE, allowing a tracer to modify the syscall argument without being subjected to seccomp or audit checking.

In the Linux kernel's cfg80211 there is a missing stop of PMSR measurements before tearing down P2P and NAN interfaces. Functions cfg80211_stop_p2p_device() and cfg80211_stop_nan() do not call cfg80211_pmsr_wdev_down(), which can leave stale requests in the driver and cause inconsistencies.

In the Linux kernel's coreboot driver there is a missing validation of table bounds. coreboot_table_probe() replaces the platform resource length with values supplied by firmware, which can lead to overflow in 32-bit size addition or mapping memory beyond the resource via a malformed table.

In the Linux kernel's PCI dwc ep driver, a vulnerability exists where the MSI path lacks a flush equivalent to the MSI-X path before unmapping the iATU entry. This can cause posted MSI writes to be dropped or misrouted when the iATU entry is unmapped.

In the Linux kernel's HID subsystem, a vulnerability exists where hid_device_io_start() allows reports to run concurrently with probe. If probe subsequently fails, __hid_device_probe() releases driver resources and clears hdev->driver without excluding those report callbacks, leading to use-after-free, e.g., in hidraw_report_event().

In the Linux kernel, blk-cgroup has a race between policy activation and blkg destruction. When switching an IO scheduler, blkcg_activate_policy() may race with concurrent blkcg deletion, leading to use-after-free and memory leak issues. Additionally, blkg_free_workfn() frees pd before removing the blkg from q->blkg_list, allowing allocation of a new pd for a blkg being destroyed.

In the Linux kernel, blk-cgroup's blkcg_activate_policy() can race with concurrent blkcg deletion when switching IO schedulers, leading to a use-after-free in rcu_accelerate_cbs. The issue occurs when a blkg is being destroyed while blkcg_activate_policy() tries to get a reference to it.

In the Linux kernel, the ublk module's import_ubuf() can fail if the address range provided by the userspace ublk server is outside the allowed user address space. In that case, an uninitialized struct iov_iter is passed to ublk_copy_user_pages().

In the Linux kernel, a vulnerability in the OCFS2 filesystem was found due to missing validation of inline extended attribute (xattr) bounds in the inode block. Corrupted metadata can lead to out-of-bounds memory access (use-after-free) during getxattr() or listxattr() calls.

In the Linux kernel, the ocfs2 filesystem's ocfs2_validate_xattr_block() checks the xattr block header but does not verify that a non-indexed block's xh_count and entry offsets fit inside the block. Indexed buckets likewise reach list/get consumers without an entry-bounds check, leading to use-after-free in ocfs2_xattr_list_entries().

In the Linux kernel, in sleepable BPF programs a spin lock can be the only RCU protection for a kptr. After the final bpf_spin_unlock() the verifier leaves the pointer valid, allowing another CPU to free the object before use, causing a use-after-free (e.g. in __bpf_get_task_stack()).

In the Linux kernel, the drm/omap DSI driver copied the ISR table to allow unregistering interrupt handlers. Since stack-allocated objects are passed to these ISRs, there is a use-after-free risk if IRQs are unregistered while being handled.

A vulnerability was found in the Linux kernel's BPF verifier. When handling load-acquire operations where source and destination registers are the same, the verifier does not properly check the pointer type, allowing access to unconverted kernel objects, potentially leading to data leaks or type confusion.

In the Linux kernel, the RDMA/erdma driver's EQ handlers look up CQs from dev->cq_xa and invoke callbacks outside the xarray lock. erdma_destroy_cq() can erase the CQ and free its queue buffer and doorbell record while a previously scheduled EQ handler is still using it, causing a use-after-free.

A use-after-free vulnerability exists in the Linux kernel RDMA/erdma driver. The AE QP fatal event and iWARP CM paths load QP pointers from dev->qp_xa and use them outside the xarray lock, so erdma_destroy_qp() can free QP resources while such a lookup is in flight. The fix adds erdma_qp_get_by_qpn() to acquire a kref under the xarray lock and removes the QP from the xarray before dropping the destroy-path reference.