CVE Vulnerability Catalog

In the Linux kernel, in the Btrfs filesystem, an issue with readahead on the relocation inode was fixed when the filesystem uses a RAID stripe tree (RST), which could cause ENOENT errors.

In the Linux kernel, a race condition was fixed in the OA TC6 network driver between reference pointers for TX packets. The issue involves managing two skb pointers for packets enqueued from the network stack.

In the Linux kernel, in the sc16is7xx serial driver, a TX FIFO corruption was fixed that could occur when a packet was received on channel A at almost the same time as a packet was about to be transmitted on channel B.

In the Linux kernel, RCU protection was added for the conventional zones bitmap of a disk (conv_zones_bitmap) in the block layer. This prevents invalid memory references during disk revalidation.

In the Linux kernel, a double accounting race was fixed in Btrfs when btrfs_run_delalloc_range() fails. The issue occurs when block size is smaller than page size and can lead to kernel crash.

In the Linux kernel, the BPF verifier now tracks the changes_pkt_data property for global functions. It invalidates packet pointers in the current state after calling certain helpers.

In the Linux kernel, the BPF verifier now checks the changes_pkt_data property for extension programs. It decides whether to invalidate all packet pointers in the current state based on this property.

In the Linux kernel, the Android Binder driver no longer stores a pointer to a VMA for later use outside the mmap_lock. This was unsafe because the pointer could reference freed memory.

In NTFS-3G through version 2026.2.25, a heap buffer overflow exists in the ntfs_ib_copy_tail() function in libntfs-3g/index.c. This vulnerability allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image.

In the Linux kernel, a vulnerability was found in the tracing mechanism where trace_event_file lacks reference counters. This can lead to use-after-free and kernel crash.

In the Linux kernel, a proper folio cleanup was fixed in Btrfs when cow_file_range() fails. The issue involved improper handling of dirty pages.

In NTFS-3G through version 2026.2.25, a heap buffer overflow in ntfs_index_walk_down() in libntfs-3g/index.c allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image.

In the Linux kernel, the JFS filesystem now checks for read-only mode before performing truncation in jfs_truncate_nolock(). This avoids errors related to writing to a read-only filesystem.

In the Linux kernel, the Bluetooth subsystem (hci_core) now disables works during hci_unregister_dev because the hci_dev is about to be freed and new submissions should not be allowed.

In the Linux kernel, in the RDMA/hns driver, a soft lockup issue under heavy CEQE load was fixed by moving CEQE handling to the BH (bottom half) context.

In the Linux kernel, in the NFS server (nfsd), a race between the laundromat thread and the free_stateid operation was fixed, which could lead to incorrect handling of expired delegations.

In the Linux kernel, an overflow in the ring-buffer's __rb_map_vma function was fixed, which occurred when calculating the number of pages (nr_pages). A check was added before the calculation to avoid the issue.

In the Linux kernel's drm/amdgpu/mes driver, a use-after-free issue exists. The fix removes the fence fallback timer to eliminate random errors.

In the Linux kernel's fork function, a race condition exists between fork and hugetlbfs file operations. The fix defers linking the file VMA until the VMA is fully initialized.

In NTFS-3G through version 2026.2.25, a heap buffer overflow exists in the ntfs_ib_cut_tail() function in libntfs-3g/index.c. This vulnerability allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.