CVE Vulnerability Catalog

In the Linux kernel, ipmb_write() in the IPMI driver read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes, and a length smaller than the SMBus header underflows the block write length.

In the Linux kernel, ipmi_add_smi() creates the nr_users and nr_msgs files before trying to create the maintenance_mode file. If that last creation fails, the error path removes only nr_users before dropping the final reference to the interface, leaving the nr_msgs sysfs attribute registered in the freed interface.

In the Linux kernel, if an error occurs during startup of an IPMI interface, it may have scheduled work to run. The work needs to be canceled before the interface can be freed, which was missing in the ipmi:msghandler module.

In the Linux kernel, afiucv_hs_rcv() (net/iucv) selected an AF_IUCV socket based solely on four 8-byte name fields in the transport header, without checking the ingress net_device. This allowed a frame arriving on any netdev, including one in another network namespace, to be delivered to an AF_IUCV socket. The fix skips any socket whose hs_dev does not match the ingress device.

A use-after-free vulnerability exists in the Linux kernel's SLIP driver within the sl_sync() function. The slip_devs[] array stores bare net_device pointers without taking references, and entries are freed outside rtnl_lock() protection, allowing access to freed memory during slip_open().

In the Linux kernel, tun_get_user() in the TUN/TAP driver uses tun->align both as skb headroom and to decide how much packet data to keep linear. When align exceeds the usable space in a one-page skb head, SKB_MAX_HEAD(align) underflows, the result becomes negative, and after assignment to a size_t it causes skb->data to be placed outside the allocated head. OVS can propagate an oversized headroom request from another port to TUN or TAP.

In the Linux kernel, the bnxt driver's SW USO path can return early with NETDEV_TX_BUSY even though txr->kick_pending was previously set to 1. In that case the driver writes some BDs but never writes the doorbell, causing the TX queue to stall because the device does not know it should perform the TX and generate the completion that would wake the queue.

A bug in the Linux kernel's IPA driver (net: ipa) caused the modem TX queue to stall permanently after runtime resume. ipa_start_xmit() unconditionally stopped the TX queue before calling pm_runtime_get(), relying on a wake scheduled by runtime resume to restart it. However, that wake work ran too early — before the device power state reached RPM_ACTIVE — so the queue was never restarted and transmit stalled permanently.

In the Linux kernel, mctp_route_lookup() uses rt->dev without holding a reference, and mctp_route_lookup_single() returns the route under RCU only. The route's device can be torn down concurrently, leading to a use-after-free in mctp_dev_saddr() when reading rt->dev->addrs[0], reachable by an unprivileged local AF_MCTP user without CAP_NET_RAW. In the same window mctp_dev_hold() increments a refcount that has already reached zero.

In the Linux kernel, the openvswitch module has a use-after-free vulnerability involving the flow->mask pointer during flow deletion (CMD_DEL). The mask pointer is freed via RCU, but ovs_flow_cmd_fill_info() uses it after the flow is removed from the table without first taking the RCU read lock. This creates a race condition and can cause a kernel crash (KASAN slab-use-after-free) in the window between removal and info filling.

In the Linux kernel, the ravb driver can dereference an invalid PTP clock because the PTP clock is unavailable before the first open, and registration failures can leave an error pointer in priv->ptp.clock. Querying the clock index can then cause a NULL or error pointer dereference.

In the Linux kernel, the ravb Ethernet driver's PTP interrupt handler ravb_ptp_interrupt() can race with ravb_ptp_stop(), passing the clock pointer to ptp_clock_event() while ptp_clock_unregister() is freeing it, leading to a use-after-free. The fix uses READ_ONCE()/WRITE_ONCE() for lockless access, atomically detaches the clock with xchg() before disabling PTP interrupts, and synchronizes IRQs before unregistering.

In the Linux kernel, every failure path in the Thunderbolt driver's tbnet_connected_work() undoes its own work and returns without clearing login_sent, so the connection still looks established. The next tbnet_tear_down() repeats a teardown that already happened: it stops already-stopped rings (dev_WARN(), fatal under panic_on_warn) and releases net->remote_transmit_path even on the HopID mismatch path where this connection never owned that ID. The fix clears login_sent on those paths.

In the Linux kernel, the NTB ntb_transport module's ntb_process_tx() handles an oversized buffer by calling tx_handler() with a NULL data pointer and returning success. ntb_netdev therefore neither frees the skb in its completion callback nor takes its enqueue error path, leaking it. The fix rejects oversized buffers in ntb_transport_tx_enqueue() before acquiring a queue entry and returns -EMSGSIZE.

In the Linux kernel, the net/smc module's smc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys() read the part of a v2 message that does not fit into the 44-byte smc_llc_msg union, bounding themselves by the buffer size rather than what arrived. On a link with a shared v2 receive buffer, a 44-byte DELETE_RKEY_V2 declaring 255 rkeys reaches rkey[9..254] in leftover data and passes them to smc_rtoken_delete(), potentially deleting a registered rtoken. The fix copies the tail into the queue entry and declares inline rkeys as a union member.

In the Linux kernel, the net/smc module's smc_rx_splice() hands RMB pages to a pipe and takes a socket reference per entry so the smc_sock stays alive until the reader finishes. The connection does not: a concurrent close runs smc_conn_free(), which releases the receive buffer back to the link group pool. smc_rx_pipe_buf_release() tests sk_state before taking the socket lock; the state can change between the test and the lock, and smc_rx_update_cons() then dereferences conn->rmb_desc and walks conn->lgr, which smc_conn_free() has already released — a use-after-free. The fix takes the socket lock first and tests conn->freed instead.

In the Linux kernel's net/smc subsystem, smc_conn_free() unregisters the connection only while the link group is still on its device list and never sets conn->killed. In the window between unlinking the group and killing its connections, the device can re-arm the receive tasklet after tasklet_kill() has returned, leading to a use-after-free.

In the Linux kernel, IP tunnel devices derive their advertised needed_headroom from lower output devices. A stack of user-created devices can make the derived value exceed the range representable by 16-bit skb header offsets, so once IP output reserves it, skb head expansion can wrap those offsets.

In the Linux kernel, skb_tx_error() completes the zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, while skb_zcopy_downgrade_managed() clears SKBFL_MANAGED_FRAG_REFS — both in skb_shinfo(), which every clone shares. With an Open vSwitch clone (OVS_ACTION_ATTR_RECIRC) this strips the marker from a packet still being forwarded and a later local ESP delivery decrypts in place over frags it does not own privately.

In the Linux kernel, a vulnerability exists in the mfd: qnap-mcu driver. The qnap_mcu_exec() function publishes an on-stack buffer (rx) to the receive path, which can write to it after a command timeout or write failure when the stack frame is no longer valid. This leads to stack memory corruption and potential arbitrary code execution.