CVE Vulnerability Catalog

A use-after-free vulnerability exists in the Linux kernel RDMA/erdma driver. The AE QP fatal event and iWARP CM paths load QP pointers from dev->qp_xa and use them outside the xarray lock, so erdma_destroy_qp() can free QP resources while such a lookup is in flight. The fix adds erdma_qp_get_by_qpn() to acquire a kref under the xarray lock and removes the QP from the xarray before dropping the destroy-path reference.

In the Linux kernel, the ocfs2 (o2hb) subsystem has a use-after-free bug in the heartbeat region lifecycle. The region is published to the o2net handler table before its delayed works are initialized, and teardown does not fully drain in-flight o2net callbacks. This causes a race and use of freed memory (KASAN slab-use-after-free in __run_timers).

In the Linux kernel's IB/isert subsystem, a vulnerability exists where the final Login Response is sent before the session is registered. An initiator that issues a SCSI command immediately after receiving the response can cause it to be executed against a session with a NULL se_tpg pointer, leading to a NULL dereference and system crash.

In the Linux kernel, a vulnerability in IB/isert was resolved where full-feature receive buffers were posted before session registration. An initiator that did not wait for the final Login Response could cause a SCSI command to be executed against a session with a NULL se_tpg, leading to a kernel oops at target_submit. The fix moves buffer posting into isert_get_rx_pdu() and performs it before sending the response.

In the Linux kernel, the RDMA/siw module's siw_accept() looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP. The cleanup assumes the current call installed the association, but qp->cep can point to the CEP of an existing connection, leading to freeing the incoming CEP and a use-after-free.

In the Linux kernel, the kmod dups code uses RCU to ensure a kmod_dup_req instance is freed only after it is no longer referenced. However, parallel users in kmod_dup_request_exists_wait() do not enter an RCU read-side critical section, which can result in a use-after-free.

In the Linux kernel, the drm/amd/display driver's AMDGPU_DM_MAX_DISPLAY_INDEX constant is 31, suggesting a maximum of 32 connectors, but it is used like MAX_DISPLAY_COUNT. This causes an off-by-one relative to the DRM core, which supports a maximum of 32 connectors. The fix renames the constant and increases the HDCP per-connector array size to 32.

In the Linux kernel, the Renesas R-Car Gen2 PHY driver has a double of_node_put() in the error path during PHY creation. The for_each_child_of_node_scoped() macro automatically releases the node reference, and the explicit of_node_put() drops it twice. The fix removes the redundant call, letting the scoped cleanup handle it.

In the Linux kernel, the AMDGPU DRM driver for GFX6 lacks PFP (pre-fetch parser) usage on compute queues. On GFX6, compute queues use the same CP path as graphics but without draw command support. The fix adds PFP usage for register writes, pipeline sync, and after VM flush to prevent execution issues.

In the Linux kernel, the scsi: sd driver has incorrect error handling in sd_probe() when sd_large_pool_create() fails after a successful device_add(&sdkp->disk_dev). The out_free_index path calls kfree() on an already registered device and leaks the sysfs entry.

In the Linux kernel, in the btrfs filesystem on zoned disks, btree_csum_one_bio() zeroed the extent buffer's folios before submission, destroying the in-memory buffer while it might still be referenced, leading to extent tree corruption. The fix writes zeros from a shared zero page, leaving the buffer content untouched.

In the Linux kernel, in Bluetooth L2CAP, the hci_conn::l2cap_data field is accessed without locks in l2cap_disconn_ind, potentially leading to use-after-free if l2cap_conn is deleted concurrently. The fix uses proto_lock to guard l2cap_data.

In the Linux kernel, in Bluetooth hci_conn, the SCO setup context is allocated with a NULL destroy callback, leading to memory leaks when an entry is cancelled. Additionally, the context stores a bare hci_conn pointer, potentially leading to use-after-free. The fix holds the connection and releases it from a destroy callback.

In the Linux kernel, a vulnerability in AppArmor's verify_tags() function allows an integer overflow in the bounds check, enabling an out-of-bounds read when loading a crafted policy. The issue is reachable by an unprivileged user in a nested user namespace if unprivileged_userns_apparmor_policy=1 is enabled.

A locking issue exists in the Linux kernel's iommu/dma subsystem around the msi_page_list. When multiple devices assigned to a VM via the legacy VFIO type1 container share the same IOMMU domain (e.g. ARM SMMU with IOMMU_RESV_SW_MSI), concurrent calls to iommu_dma_get_msi_page() can corrupt that list. The fix restores the static msi_prepare_lock.

In the Linux kernel's iommu/vt-d subsystem, there is an issue with clearing the Present bit before tearing down a copied context entry. Zeroing the entry while Present is still set leaves a window where hardware can fetch a torn entry, leading to unpredictable behavior or spurious faults.

In the Linux kernel's iommu/vt-d subsystem, on device probe failure, scalable-mode context entries are not torn down before freeing the PASID table. This can lead to the IOMMU referencing freed memory. The fix performs teardown before freeing the table, similar to the device release path.

In the Linux kernel's iommu/vt-d subsystem, during DMA alias teardown, the function intel_context_flush_no_pasid() uses an incorrect SID (always the device's requester ID instead of the alias). This causes context cache entries for aliases not to be invalidated, potentially leading to the IOMMU using freed memory.

A vulnerability was fixed in the Linux kernel's netfilter nft_ct module related to custom expectation support. The previous implementation could corrupt the expectations list through stale pointers after conntrack extension reallocation. The fix moves expectation handling to an internal conntrack helper and introduces the nf_conntrack_helper_release() function.

In the Linux kernel's NFS subsystem, when the client fails to record a delegation received from the server, it does not send DELEGRETURN. This causes the server to believe the client still holds the delegation, leading to issues with delegation recall and loops in the client's state manager. The fix returns the delegation in these error paths.