CVE Vulnerability Catalog

In the Linux kernel, the net/smc module's smc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys() read the part of a v2 message that does not fit into the 44-byte smc_llc_msg union, bounding themselves by the buffer size rather than what arrived. On a link with a shared v2 receive buffer, a 44-byte DELETE_RKEY_V2 declaring 255 rkeys reaches rkey[9..254] in leftover data and passes them to smc_rtoken_delete(), potentially deleting a registered rtoken. The fix copies the tail into the queue entry and declares inline rkeys as a union member.

In the Linux kernel, the net/smc module's smc_rx_splice() hands RMB pages to a pipe and takes a socket reference per entry so the smc_sock stays alive until the reader finishes. The connection does not: a concurrent close runs smc_conn_free(), which releases the receive buffer back to the link group pool. smc_rx_pipe_buf_release() tests sk_state before taking the socket lock; the state can change between the test and the lock, and smc_rx_update_cons() then dereferences conn->rmb_desc and walks conn->lgr, which smc_conn_free() has already released — a use-after-free. The fix takes the socket lock first and tests conn->freed instead.

In the Linux kernel's net/smc subsystem, smc_conn_free() unregisters the connection only while the link group is still on its device list and never sets conn->killed. In the window between unlinking the group and killing its connections, the device can re-arm the receive tasklet after tasklet_kill() has returned, leading to a use-after-free.

In the Linux kernel, IP tunnel devices derive their advertised needed_headroom from lower output devices. A stack of user-created devices can make the derived value exceed the range representable by 16-bit skb header offsets, so once IP output reserves it, skb head expansion can wrap those offsets.

In the Linux kernel, skb_tx_error() completes the zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, while skb_zcopy_downgrade_managed() clears SKBFL_MANAGED_FRAG_REFS — both in skb_shinfo(), which every clone shares. With an Open vSwitch clone (OVS_ACTION_ATTR_RECIRC) this strips the marker from a packet still being forwarded and a later local ESP delivery decrypts in place over frags it does not own privately.

In the Linux kernel, a vulnerability exists in the mfd: qnap-mcu driver. The qnap_mcu_exec() function publishes an on-stack buffer (rx) to the receive path, which can write to it after a command timeout or write failure when the stack frame is no longer valid. This leads to stack memory corruption and potential arbitrary code execution.

In the Linux kernel ALSA bcd2000 driver, the USB resource cleanup function freed URB structures without clearing the pointers. An open rawmidi substream could access freed memory (use-after-free) after device disconnect, leading to kernel memory corruption.

The pcxhr_probe() function in the Linux kernel requests pcxhr_threaded_irq() before initializing mgr->lock, even though the threaded handler takes that mutex. An early interrupt can therefore run against uninitialized mutex state during probe.

In the Linux kernel, the dm-pcache module does not validate geometry fields (n_segs and segment id) from on-disk cache_info metadata. cache_segs_init() iterates n_segs times, indexing cache->segments[] sized to the device geometry. Since metadata is only CRC-protected with a public seed, whoever supplies the cache device (CAP_SYS_ADMIN) can provide an oversized n_segs or out-of-range id, causing out-of-bounds read and write. The fix rejects invalid values before use.

In the Linux kernel, the dm-pcache module does not bound the kset key_num field or intra-segment bounds. key_num drives cache_kset_crc() and the replay loop in cache_replay(), and since only magic and a fixed-seed CRC are checked, an invalid key_num can read past the PCACHE_KSET_KEYS_MAX buffer. Additionally, a key's offset and length in cache_key_decode() are taken verbatim, allowing reads past the segment and leaking data to user space. The fix adds validation of key_num and key bounds.

In the Linux kernel, the dm-pcache module does not bound the seg_off offset in cache_pos_decode(), which takes persisted key_tail and dirty_tail values from the cache device. A seg_off at or past the segment data_size, controllable by whoever supplies the device (CAP_SYS_ADMIN), reads past the segment data. The fix rejects a decoded seg_off that is not below the segment data_size.

In the Linux kernel, the dm-pcache module in cache_replay(), the writeback worker, and the GC worker bounds the tail-kset read length by PCACHE_SEG_SIZE - seg_off, the raw segment size rather than the data region. A tail near the segment end reads past the segment data into the following control area. The fix clamps the read to cache_seg_remain(), the data region.

In the Linux kernel, kset_replay() in dm-pcache has a use-after-free and invalid segment operations. When a key's seg_gen is stale, cache_key_put(key) frees the key memory but key->cache_pos.cache_seg is then accessed as an argument to cache_seg_get(). Additionally, for expired invalid keys, setting the cache->seg_map bit and calling cache_seg_get() is unreasonable.

In the Linux kernel, i3c_device_get_supported_xfer_mode() dereferences dev->desc without holding bus->lock, which is not allowed. The function only needs the master controller associated with the device's bus, so it should use dev->bus, which is always valid for the device's lifetime.

In the Linux kernel, adi_i3c_master_probe() requests the IRQ and unmasks REG_IRQ_PENDING_CMDR before initializing the IBI state, transfer queue list, and transfer queue lock. A pending CMDR interrupt can run adi_i3c_master_irq() and take an uninitialized lock, as reported by Lockdep.

In the Linux kernel, i3c_master_unregister_i3c_devs() clears i3cdev->dev->desc before calling device_unregister(). During unregister, i3c_device_uevent() and a racing modalias_show() can observe a NULL desc and fall back to an uninitialized stack struct, leaking kernel stack contents. A use-after-free may also occur from writing desc after the device is released.

In the Linux kernel, the Renesas I3C driver uses an asynchronous model: it prepares a struct renesas_i3c_xfer, enqueues it, and waits for completion. If completion times out, the waiting thread dequeues and frees the transfer; a later interrupt may access freed memory, causing crashes.

In the Linux kernel, the rtl8xxxu wifi driver has a use-after-free bug involving the rx_urb_wq workqueue. rtl8xxxu_stop() does not cancel rx_urb_wq, so a worker can run after rtl8xxxu_disconnect() frees the priv structure, causing a use-after-free. The issue occurs under active RX traffic followed by a disconnect.

In the Linux kernel, the mwifiex Wi-Fi driver fails to detach the caller-provided data buffer from a still-current synchronous command when the wait is interrupted. A late firmware response can then write through a stale stack pointer, causing kernel stack corruption and a panic.

In the Linux kernel, the rtlwifi driver (rtl8192du) uses the QoS TID from the 802.11 header as an index into sta_entry->tids[] in rtl92du_tx_fill_desc(). Since ieee80211_get_tid() returns a value in the range 0..15 while the array only has MAX_TID_COUNT (9) entries, a TID greater than 8 indexes past the aggregation state array.