CVE Vulnerability Catalog

In the Linux kernel, the super_1_load() function in the md module did not validate the range of sb->bblog_shift loaded from the on-disk superblock. This value (0-255) is used as a bit shift when computing sector and block counts, which with an invalid value can overflow a 64-bit variable and cause an error in badblocks_set() in block/badblocks.c.

In the Linux kernel, mptcp_token_join_cookie_init_state() fails to restore the local_id field from the saved cookie entry when rebuilding the request socket for an MP_JOIN handled under SYN cookies. The uninitialized field is then read by subflow_ulp_clone() and stored as the joined subflow's address-ID, which an off-path peer can influence by sending concurrent MP_JOIN SYNs.

In the Linux kernel, the nouveau/gem driver has a race in the non-uvmm path between the info lookup finding the vma and the gem close path closing the vma, leading to a use-after-free.

In the Linux kernel, svc_pool_for_cpu() can select a pool with no threads when a service runs fewer threads than it has pools (e.g., nfsd in pernode/percpu mode with fewer threads than NUMA nodes). A transport enqueued on such a pool is never picked up, causing the connection to hang indefinitely.

In the Linux kernel, sunrpc_destroy_cache_detail() only cancels the global cache_cleaner delayed_work when cache_list is empty, which never happens during per-netns teardown. This leads to a use-after-free where cache_clean() may still hold a dangling pointer to the freed cache_detail.

In the Linux kernel, __svc_create() ignored the return values of percpu_counter_init() when initializing three per-pool RPC statistics counters. When a per-CPU allocation fails (e.g., under memory pressure), the RPC service (nfsd, lockd, or NFS callback service) is started with uninitialized counters whose per-CPU pointer is NULL. This silently corrupts data in the current CPU's per-CPU area and causes /proc/fs/nfsd/pool_stats to return garbage.

In the Linux kernel, svc_rqst_free() frees rq_argp and rq_resp synchronously while deferring the rqstp struct free via kfree_rcu(). This creates a window where RCU readers can access already freed fields, leading to a use-after-free.

The Linux kernel fixed four coupled defects in the SUNRPC gssx XDR option-array decoder. The bugs caused a NULL dereference in the caller, a refcount leak on the decoded group_info, and a latent use-after-free.

A race condition exists in the Linux kernel sunrpc module. The /proc/net/rpc/use-gss-proxy entry is published by proc_create_data() before the sn->gssp_lock mutex is initialized via mutex_init(), allowing a writer to lock an uninitialized mutex.

In the Linux kernel, svc_rdma_free() in the svcrdma subsystem has a use-after-free due to operation ordering. rpcrdma_rn_unregister() is called after rdma_destroy_id(), leaving the sc_rn entry in the device's rd_xa after the cm_id is freed. A concurrent ib_unregister_device walk can dispatch svc_rdma_xprt_done() against the freed sc_cm_id. Additionally, the sc_cm_id dereference lacks a NULL check.

In the Linux kernel svcrdma module, when handling an ADDR_CHANGE event the replacement connection ID (cm_id) allocation fails, sc_cm_id still points to the old cm_id that the CM core is about to destroy. Any later dereference of sc_cm_id, such as the rdma_disconnect() call in svc_rdma_detach(), results in a use-after-free.

In the Linux kernel svcrdma module, individual Read segment lengths are validated at decode time, but nothing prevents a requester from sending multiple segments whose cumulative length exceeds the rq_pages array budget. When one segment fills the page array exactly, the runtime guard in svc_rdma_build_read_segment() is bypassed because len reaches zero, and a subsequent segment accesses the NULL sentinel slot at rq_pages[rq_maxpages], resulting in a NULL pointer dereference during DMA mapping.

In the Linux kernel's ath6kl wifi driver, ath6kl_cfg80211_connect_event() subtracts fixed IE offsets from assoc_req_len and assoc_resp_len (both u8) without a lower bound. When the length is smaller than the offset, the u8 wraps to about 250, and cfg80211_connect_result()/cfg80211_roamed() treat that wrapped value as the IE length and copy that many bytes from the small assoc_info buffer to user space via nl80211, disclosing adjacent slab memory.

In the Linux kernel's mt76 wifi driver (mt7925), the pending mlo_pm_work is not cancelled in reset, suspend, and unregister paths. If the device is reset, suspended, or unregistered within that window, the pending work can still run and access already freed vif/bss data or send MCU commands while the firmware is unavailable.

In the Linux kernel's media staging/ipu7 driver, isys_register_devices() registers the V4L2 async notifier, but the probe error path (isys_probe()) only calls isys_unregister_devices(), which does not unregister or clean up the notifier. As a result, the notifier stays on the global notifier_list while the enclosing struct ipu7_isys is freed by devres, leading to list corruption and a use-after-free the next time the list is walked.

In the Linux kernel scheduler (sched/core), core scheduling's pick_next_task() breaks when a ->pick_task() implementation can release the rq lock. The selection state derived on entry is only valid while the lock is held continuously; once a pick can drop the lock, an interleaving selection can invalidate it, leading to an incorrect committed pick or skewed forceidle accounting.

In the Linux kernel scheduler (sched/core), core scheduling's pick_next_task() operates on all sibling rqs under one acquisition of the shared core-wide lock. When a ->pick_task() releases the rq lock, every sibling __lock is momentarily free, letting __sched_core_flip(false) complete mid-selection and rebind rq_lockp() under it. The selection resumes on split locks, touching sibling state it no longer protects, and __schedule() finally releases a lock that was never taken while leaking the one that was.

In the Linux kernel, the RISC-V KVM implementation has an integer overflow in the PMU event info array size calculation. The guest-controlled num_events value is multiplied by sizeof(*einfo) and stored in a 32-bit integer, causing truncation for large values and allocation of an undersized buffer. The subsequent loop iterates over the original num_events, resulting in out-of-bounds reads and writes.

In the Linux kernel, the qede driver (QLogic FastLinQ NIC) has a bug where memory pressure causes a NULL pointer dereference while processing TPA continuation fragments. Because tpa_info->buffer.data is not assigned in qede_tpa_start(), a "ghost" buffer with a valid DMA mapping but a NULL data pointer is pushed back into the Rx ring, causing a kernel panic in qede_fill_frag_skb().

In the Linux kernel, the RDMA/cxgb4 driver's c4iw_remove() can free ctx->dev while the queued reg_work (which registers the RDMA device) is still pending or running. This leaves c4iw_register_device() accessing the freed device.