CVE Vulnerability Catalog

In the Linux kernel NFSv4/flexfiles module, two code paths assume the data server client has a session, which is not true for NFSv4.0 (clp->cl_session is NULL). This causes NULL dereferences in nfs4_init_ds_session() and ff_layout_async_handle_error_v4(), and a busy-loop in nfs4_renew_state() due to zero cl_lease_time.

In Linux kernel BPF/XDP subsystem, program checks were moved into dev_xdp_install() to prevent swapping a normal XDP program for an offloaded/device-bound one via BPF_LINK_UPDATE, which previously bypassed verification and allowed execution on the software path.

In the hinic3 network driver in Linux kernel, an issue was fixed related to skb linearization and error handling in skb_checksum_help(). The bug could lead to out-of-bounds DMA reads or IOMMU faults, and also to sending corrupted packets with incomplete checksums.

In the Linux kernel KCM (Kernel Connection Multiplexer) module, RCU protection was missing during execution of a BPF program in the strparser, which could trigger kernel warnings during BPF map operations. The fix holds the RCU lock while running the program.

In the virtio_net driver, the RX ring resize operation was fixed for when an AF_XDP socket is attached, preventing write past the end of the xsk_buffs array when the size grows. The fix properly resizes the array.

In the Linux kernel IPVS module, an integer overflow was fixed in the FTP helper that parses PASV/EPSV responses, which could wrap values and use incorrect port/address for data connections. The fix widens the port accumulator to u32 and rejects values above 65535 and address octets above 255.

In the Linux kernel hp-bioscfg module (platform/x86), a missing bounds check was fixed when parsing password encodings from ACPI packages, which could cause out-of-bounds reads and passing an invalid pointer to hp_convert_hexstr_to_str().

In the Linux kernel, the ntfs_ir_to_ib() function contains a heap out-of-bounds write. It copies entries from index_root into a freshly allocated index_block_size-byte buffer without verifying that the entries fit in the available space. The lack of a bounds check before memcpy allows writes past the end of the allocation.

In the Linux kernel, the NTFS filesystem did not reject setxattr of the reserved $LXUID, $LXGID, $LXMOD, and $LXDEV extended attributes from userspace. The fix requires CAP_SYS_ADMIN to modify these attributes.

In the Linux kernel NTFS module, ntfs_read_iomap_begin_resident() reads an MFT record without holding ni->mrec_lock, while other functions modify the same buffer under that lock. This causes a data race and allows reading torn attribute length and offset fields. The issue was fixed by holding mrec_lock from the resident iomap read lookup through iomap_end().

In the Linux kernel, gic_acpi_parse_iaffid() does not check the return value of get_logical_index(), which may be an error value when a MADT GICC entry does not correspond to a recognized logical CPU. This may result in out-of-bounds indexing of a per_cpu variable array and memory corruption.

In the Linux kernel, ntfs_decompress() has an off-by-one range check where dp_addr == dp_sb_end falls through to the symbol copy, writing one byte past the destination page. A corrupted compressed $DATA attribute can produce a bounded run of out-of-bounds writes when the file is read.

In the Linux kernel IPv6 multicast routing (ip6mr) subsystem, incoming packets attach a non-refcounted (NOREF) dst under RCU. When an ingress multicast packet misses MFC lookup, it is placed on the unresolved queue, escaping the receive-side RCU grace period. If the underlying route is deleted and freed and the MFC queue is later resolved with a wrong parent interface, ip6mr_cache_report() executes dst_clone() on the freed dst entry, triggering a use-after-free.

In the Linux kernel, the NFSv4.2 implementation has a LAYOUTSTATS send buffer exhaustion issue. The encode_layoutstats_maxsz macro budgets 256 bytes, but the flexfiles record can exceed that because the server controls the filehandle and address lengths. This can drive the encoder past the end of the send buffer and leave a mutex permanently held when xdr_reserve_space() returns NULL.

In the Linux kernel, the NFSv4/pnfs implementation keys the data server cache on the multipath address set alone, without including the NFS version. When two deviceids on the same address have different versions, they share a single nfs4_pnfs_ds, and whichever mirror connects first pins ds_clp to its own version. The other mirror is handed that client and selects rpc_call_ops for a version the connection does not speak, leading to a NULL dereference.

In the Linux kernel, a fix was made for safely accessing the chan->conn field in getsockopt/setsockopt functions for Bluetooth L2CAP. After a previous change, chan->conn retains a reference and remains non-NULL even after the associated hci_conn is deleted, but accessing its fields (e.g., hdev) is invalid and leads to a KASAN crash. The fix adds a check to verify that hci_conn is still alive, and holds l2cap_chan_lock() to avoid data races.

In the Linux kernel, a fix was made for the Bluetooth L2CAP issue where a new socket could be added to the parent accept queue after l2cap_sock_cleanup_listen() had run and the state was set to BT_CLOSED, leading to a use-after-free (UAF). The fix adds a check for sk_state == BT_LISTEN after acquiring the sk lock in l2cap_sock_new_connection_cb(), and further prevents data races.

A race condition exists in the Linux kernel Bluetooth L2CAP subsystem between l2cap_sock_cleanup_listen() and l2cap_sock_put_chan(). An unsynchronized read of the l2cap_pi(sk)->chan pointer may return NULL, leading to a null-ptr-deref and kernel crash. The issue is fixed by taking lock_sock() in l2cap_sock_kill().

In the Linux kernel, the btnxpuart Bluetooth driver's nxp_process_fw_dump() reads seq_num and buf_len from a firmware dump header struct at skb->data without verifying the ACL payload is long enough. A short frame with connection handle 0xfff reads both fields beyond the received data, and a buf_len of zero can end a dump early and reset the controller.

In the Linux kernel, the net/sched: sch_teql module has a vulnerability where teql_master_xmit() sets skb->dev to the slave device before calling ndo_start_xmit(), but does not restore it when transmission fails. This causes the packet with a stale skb->dev to be queued on the ARP queue, and after the slave device is deleted, a use-after-free (UAF) occurs.