CVE Vulnerability Catalog

In the Linux kernel, the CXL MCE notifier was registered per memory device and stored in struct cxl_memdev_state, even though it only needs region state. This caused lifetime issues leading to NULL dereferences and use-after-free in the MCE handler. The fix moves the notifier into struct cxl_region and registers it from cxl_region_probe() only for regions with an extended linear cache.

A use-after-free vulnerability exists in the Linux kernel's rfcomm_security_cfm() function in the Bluetooth RFCOMM subsystem. The function walks the session and DLC lists without holding rfcomm_mutex, allowing the krfcommd thread to concurrently free the same session and its DLCs. This results in a read of freed memory (KASAN: slab-use-after-free).

A use-after-free vulnerability exists in the Linux kernel's IPv4/IPv6 multicast forwarding path. When a multicast packet is not locally deliverable, the skb retains an skb->sk association set by bpf_sk_assign() or UDP early demux even though a socket reference is not guaranteed. After the prefetched socket is destroyed, a later skb free invokes sock_pfree() and dereferences the stale skb->sk.

In the Linux kernel, ip6_tnl_xmit() uses skb_realloc_headroom(), which replaces the caller-owned skb and keeps the replacement only in a local variable. If an error occurs after reallocation (e.g., non-NONE encap rejection in collect_md tunnels or ip6_tnl_encap() failure), the caller still holds the original skb pointer, leading to a double free of the skb.

In the Linux kernel, ip6gre_tnl_link_config_route() incorrectly accumulates the lower device's hardware header length into dev->hard_header_len for NBMA ip6gre tunnels. This results in an incorrect hardware header length for the tunnel, potentially causing packet transmission issues.

A NULL pointer dereference vulnerability exists in the Linux kernel's ipv6_rpl_srh_rcv() function, which reads idev->cnf.rpl_seg_enabled without checking whether idev from __in6_dev_get() is NULL. When the device MTU drops below IPV6_MIN_MTU, addrconf_ifdown() clears dev->ip6_ptr, and a packet that passed the earlier idev check can reach ipv6_rpl_srh_rcv() with a NULL pointer.

A vulnerability in the Linux kernel's Landlock mechanism related to whiteout object creation used by OverlayFS has been fixed. Creating whiteouts via mknod(2) with S_IFCHR and makedev(0,0), and via renameat2(2) with RENAME_WHITEOUT, was not properly restricted by Landlock permissions, allowing bypass of restrictions. The fix requires LANDLOCK_ACCESS_FS_MAKE_REG for both cases.

In the Linux kernel, __nd_label_validate() in libnvdimm/labels has an integer overflow. The nslot field (u32) is multiplied by the label size in 32-bit arithmetic, which can wrap around and bypass the bounds check, leading to an out-of-bounds write in nd_label_data_init().

In the Linux kernel, the super_1_load() function in the md module did not validate the range of sb->bblog_shift loaded from the on-disk superblock. This value (0-255) is used as a bit shift when computing sector and block counts, which with an invalid value can overflow a 64-bit variable and cause an error in badblocks_set() in block/badblocks.c.

In the Linux kernel, mptcp_token_join_cookie_init_state() fails to restore the local_id field from the saved cookie entry when rebuilding the request socket for an MP_JOIN handled under SYN cookies. The uninitialized field is then read by subflow_ulp_clone() and stored as the joined subflow's address-ID, which an off-path peer can influence by sending concurrent MP_JOIN SYNs.

In the Linux kernel, the nouveau/gem driver has a race in the non-uvmm path between the info lookup finding the vma and the gem close path closing the vma, leading to a use-after-free.

In the Linux kernel, svc_pool_for_cpu() can select a pool with no threads when a service runs fewer threads than it has pools (e.g., nfsd in pernode/percpu mode with fewer threads than NUMA nodes). A transport enqueued on such a pool is never picked up, causing the connection to hang indefinitely.

In the Linux kernel, sunrpc_destroy_cache_detail() only cancels the global cache_cleaner delayed_work when cache_list is empty, which never happens during per-netns teardown. This leads to a use-after-free where cache_clean() may still hold a dangling pointer to the freed cache_detail.

In the Linux kernel, __svc_create() ignored the return values of percpu_counter_init() when initializing three per-pool RPC statistics counters. When a per-CPU allocation fails (e.g., under memory pressure), the RPC service (nfsd, lockd, or NFS callback service) is started with uninitialized counters whose per-CPU pointer is NULL. This silently corrupts data in the current CPU's per-CPU area and causes /proc/fs/nfsd/pool_stats to return garbage.

In the Linux kernel, svc_rqst_free() frees rq_argp and rq_resp synchronously while deferring the rqstp struct free via kfree_rcu(). This creates a window where RCU readers can access already freed fields, leading to a use-after-free.

The Linux kernel fixed four coupled defects in the SUNRPC gssx XDR option-array decoder. The bugs caused a NULL dereference in the caller, a refcount leak on the decoded group_info, and a latent use-after-free.

A race condition exists in the Linux kernel sunrpc module. The /proc/net/rpc/use-gss-proxy entry is published by proc_create_data() before the sn->gssp_lock mutex is initialized via mutex_init(), allowing a writer to lock an uninitialized mutex.

In the Linux kernel, svc_rdma_free() in the svcrdma subsystem has a use-after-free due to operation ordering. rpcrdma_rn_unregister() is called after rdma_destroy_id(), leaving the sc_rn entry in the device's rd_xa after the cm_id is freed. A concurrent ib_unregister_device walk can dispatch svc_rdma_xprt_done() against the freed sc_cm_id. Additionally, the sc_cm_id dereference lacks a NULL check.

In the Linux kernel svcrdma module, when handling an ADDR_CHANGE event the replacement connection ID (cm_id) allocation fails, sc_cm_id still points to the old cm_id that the CM core is about to destroy. Any later dereference of sc_cm_id, such as the rdma_disconnect() call in svc_rdma_detach(), results in a use-after-free.

In the Linux kernel svcrdma module, individual Read segment lengths are validated at decode time, but nothing prevents a requester from sending multiple segments whose cumulative length exceeds the rq_pages array budget. When one segment fills the page array exactly, the runtime guard in svc_rdma_build_read_segment() is bypassed because len reaches zero, and a subsequent segment accesses the NULL sentinel slot at rq_pages[rq_maxpages], resulting in a NULL pointer dereference during DMA mapping.