CVE Vulnerability Catalog

In the Linux kernel, the s390/cio subsystem has a use-after-free (UAF) vulnerability during driver matching. The match() function is called without holding the device lock, allowing unprotected access to the driver_override field.

In the Linux kernel, in the s390/ap subsystem, a potential use-after-free (UAF) occurs during AP mask updates. __ap_revise_reserved() accesses the driver_override field without locking, racing with driver_override_store().

In the Linux kernel, the fsl-mc bus has a use-after-free (UAF) vulnerability during driver matching. The match() function is called without holding the device lock, allowing unprotected access to the driver_override field.

In the rtlwifi driver in the Linux kernel, there is a use-after-free (UAF) vulnerability due to an unfinished irq_prepare_bcn_tasklet. When the card is detached or initialization fails, ieee80211_hw is freed, but the tasklet may still be running, leading to access to freed memory.

In the Linux kernel, the s390 BPF JIT subsystem lacks zero extension for BPF program return values and kfunc arguments. According to the s390x ABI, callers must zero-extend unsigned arguments and callees must zero-extend unsigned return values, which is currently not implemented.

A bug in the Linux kernel's pte_frag_destroy function for PowerPC causes a 'Bad page state' error when freeing PTE table fragments. The issue occurs when pt_frag_refcount reaches zero but the 'active' flag on the folio is not cleared before pagetable_free(), leading to a kernel panic during process exit.

In the mt76 (mt7915) WiFi driver in the Linux kernel, a use-after-free bug was found in mt7915_mac_dump_work(). During PCI device detachment, crash_data is freed before pending work is canceled, leading to dereference of freed memory.

In the Linux kernel's mt76 (mt7996) WiFi driver, a use-after-free bug occurs during PCI chip detachment. The mt7996_mac_dump_work() function may dereference already freed crash_data because dump_work is not canceled before memory deallocation.

In the Linux kernel, dev_map_redirect_multi() for DEVMAP_HASH used unsafe hlist_for_each_entry_safe() instead of RCU-safe hlist_for_each_entry_rcu(). On weakly-ordered architectures (ARM64, POWER), this can lead to observing a partially-constructed node.

In the Linux kernel, a vulnerability in BPF leaves the offload->prog pointer stale after JIT compilation with constant blinding, pointing to a freed program. This causes a page fault when the network namespace is destroyed.

In the Linux kernel's BPF subsystem, adjust_reg_min_max_vals() incorrectly tracks register delta when src_reg == dst_reg (e.g., rX += rX). Modifying dst_reg before reading src_reg sets an incorrect delta, causing a verifier-vs-runtime mismatch.

In the Linux kernel, a vulnerability was found in the qdisc_pkt_len_segs_init() function, which did not ensure that GSO packet headers are in the skb->head buffer. This can cause errors in network drivers that expect headers in this buffer. Added proper checking and early rejection of malicious packets.

In the Linux kernel, a vulnerability was found in the BPF verifier regarding ld_{abs,ind} instructions in subprograms. The verifier did not simulate the failure path of packet data load, which could lead to incorrect analysis. Added simulation of both success and failure paths, similar to tail calls.

In the Linux kernel, in the BPF subsystem, a use-after-free (UAF) occurs when filling info for offloaded maps or programs. bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns() use get_net() on a netdev's netns that may already be destroyed.

In the Linux kernel, the bcmgenet driver has a bug leaking free buffer descriptors (free_bds) when reclaiming the TX queue. Dropped frames are not returned to the pool, potentially leading to resource exhaustion.

In the Linux kernel, the open-coded task_vma BPF iterator has a use-after-free (UAF) vulnerability. The iterator reads task->mm locklessly and does not call mmget(), allowing the mm_struct to be freed during concurrent process exit.

In the Linux kernel's BPF subsystem, a vulnerability was found due to inconsistent ID mapping for scalar registers with the BPF_ADD_CONST flag. The regsafe() function fails to verify that underlying base IDs are consistent with existing mappings, potentially leading to incorrect verifier state pruning.

In the Linux kernel, in BPF sock_ops programs, when the destination register is the same as the source, the SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() macros fail to zero the destination register in the !fullsock / !locked_tcp_sock path. This leads to stack out-of-bounds read and kernel pointer leak.

In the Linux kernel, the use of RDS/IB is now restricted to the initial network namespace. The RDS/IB code does not work correctly in other namespaces, which could lead to errors or unexpected behavior.

In the Linux kernel, an out-of-bounds read occurs in pcpu_init_value when copying data from a CGROUP_STORAGE map to a pcpu map with the same value size not rounded up to 8 bytes. The issue arises when the source has less than 8 bytes and the copy is rounded up.