CVE Vulnerability Catalog

In the Linux kernel, the TCP Fast Open (TFO) implementation has an issue with max_qlen accounting during SO_REUSEPORT listener migration. After migration, the qlen counter is not correctly transferred, causing the limit of pending Fast Open requests to be exceeded.

In the Linux kernel, the netfilter nf_flow_table module has an issue with dst_entry reference leak. When a packet passing through flowtable hooks already has a ref-counted dst, calling skb_dst_set_noref() overwrites the pointer, causing a reference leak and triggering DEBUG_NET_WARN_ON_ONCE warnings.

A TOCTOU race condition was found in the Linux kernel's net/smc module. The smc_listen_out() function checks the socket state without holding the lock, then acquires it later, allowing a race with listener close. This can lead to kernel memory leaks due to unreleased references to the child socket.

In the Linux kernel's Thunderbolt network driver, a vulnerability was found in the teardown sequence: DMA rings are stopped and frame buffers freed before DMA paths are deactivated. This causes in-flight data to have nowhere to drain, so the 'pending' bit never clears, leading to timeouts and link failure.

In the Linux kernel, the s390/ism driver has a use-after-free vulnerability. During ism_dev_exit(), an interrupt handler may be active in parallel, accessing freed data structures, leading to memory safety violation.

In the Linux kernel, the net/atm module has a slab-out-of-bounds read vulnerability in vcc_setsockopt(). An ineffective optlen check allows bypassing validation, which could lead to reading beyond buffer boundaries.

In the Linux kernel, the at91sam9_wdt watchdog driver has a vulnerability where at91_ping() rearms the watchdog timer from its callback. Using timer_delete() neither waits for a running callback nor prevents rearming, potentially leading to access to freed memory during probe failure or driver removal.

In the Linux kernel, the net: tap driver has a vulnerability where in tap_get_user_xdp() the virtio-net header is parsed before assigning skb->dev. When the vhost TX path passes an XDP buffer with a GSO virtio-net header and protocol set to zero, dev_parse_header_protocol() can be called with skb->dev NULL, leading to a crash.

In the Linux kernel, the net: usb: ax88179_178a driver has a vulnerability where when the interface has NETIF_F_SG enabled and skb_linearize() fails in ax88179_tx_fixup(), the function returns NULL without freeing the skb. This leads to a memory leak on every TX frame whose linearization fails (e.g., under memory pressure).

In the Linux kernel, kbd_keycode() reads the port.tty pointer without acquiring a proper reference, racing with con_shutdown() and potentially causing use-after-free.

A vulnerability in the Linux kernel's zap_pte_range function during direct page table reclaim causes an incorrect flush address passed to pte_free_tlb. This leads to improper TLB (paging-structure-cache) flushing, potentially resulting in use-after-free or system crashes. The issue primarily affects architectures where flushing depends on the address, such as AMD with EFER.TCE or Intel with INVPCID.

In the Linux kernel, the IPVS estimator thread may continue after the calculation phase is disabled, leading to out-of-bounds writes and potential crashes.

In the Linux kernel, the packet subsystem's tpacket_snd() reads dev->hard_header_len independently for allocation and header construction, which can lead to buffer overflow during concurrent reconfiguration.

In the Linux kernel, the packet socket transmit path does not reset the MAC header for protocol-bound SOCK_RAW, SOCK_DGRAM, and SOCK_PACKET frames. In PACKET_QDISC_BYPASS mode, the frame reaches the driver with an unset MAC header, causing an out-of-bounds read.

In the Linux kernel, packet_set_ring() updates RX ring state under lock but publishes the tpacket receive mode after releasing it. This race can cause packet_poll() or packet_recvmsg() to access stale or NULL ring storage.

In the Linux kernel net/sched subsystem, overly deep qdisc hierarchies can cause excessive recursion and kernel stack exhaustion. The existing loop check does not cover the create-and-graft path, allowing hierarchy extension.

In the Linux kernel mac802154 subsystem, the beacon worker reads local->beacon_req under RCU but continues to use sdata and wpan_dev after leaving the RCU section. This can lead to use-after-free after interface teardown.

A vulnerability in the Linux kernel netfilter ebt_nflog module leads to a use-after-free condition. The issue arises from not holding a reference to the NFLOG logging module, allowing an ebtables rule to be invoked after per-net data has been freed by nfnetlink_log. An attacker could exploit this to corrupt kernel memory.

A use-after-free vulnerability was found in the Linux kernel's fib_nhc_update_mtu() function for IPv4. The issue stems from lack of synchronization between walking the PMTU exception table and updates, potentially leading to access to freed memory. An attacker could exploit this flaw to compromise system integrity.

In the Linux kernel's qcom-geni UART driver, there is an issue with flushing the TX DMA buffer during transmission, causing the UART to get stuck infinitely repeating corrupted TX DMA frames. The DMA-mode uart_ops lacks a flush_buffer callback, and the stop path is broken, leading to a hang.