CVE Vulnerability Catalog

In the Linux kernel, the SCSI core subsystem reads the shost->eh_noresume flag twice in one error handling iteration, which can lead to unmatched runtime PM get and put calls, causing a usage count underflow.

In the Linux kernel, the perf subsystem's perf_event_open() accepts events in the EXIT state as group leaders, which can lead to use-after-free when the leader is closed and a new sibling retains a pointer to the freed event.

In the Linux kernel's SCTP protocol, the COOKIE_ECHO state restoration does not properly validate AUTH fields (RANDOM, HMACS, CHUNKS) originating from peer-controlled cookie bytes. Forged lengths or identifiers can lead to out-of-bounds reads and even a write past a buffer, potentially enabling local privilege escalation.

In the Linux kernel for RISC-V, the ZBB-optimized strnlen loop may read one word past the count boundary when the start address is aligned and count is a multiple of word size. This can cause a page fault if the next page is unmapped.

In the Linux kernel's ovpn module, key slot crypto freeing is performed from an RCU callback, which is unsafe because crypto_free_aead can sleep (e.g., for hardware implementations). The fix defers the freeing to a workqueue where sleeping is allowed.

In the Linux kernel's rseq mechanism, rseq_grant_timeslice_extension() calls hrtimer_rearm_deferred_tif() with interrupts enabled, while __hrtimer_rearm_deferred() expects interrupts disabled. This can lead to a livelock and is caught by lockdep.

A vulnerability in the Linux kernel netfilter ipset module involves a race condition between list:set garbage collection and set swap operations. The issue causes a reference count decrement on a set whose reference has already moved to another index, leading to a BUG_ON and kernel panic.

In the Linux kernel's IPVS module, ip_vs_nat_icmp() does not revalidate the ihl field after reading from skb fragments, which can lead to out-of-bounds access. A local process can change the ihl field, causing issues in ip_send_check() calls.

In the Linux kernel, the netfilter flowtable module has a vulnerability where the original-direction tuple node is published before the reply node, allowing the garbage collector to observe and free a flow while it is still being installed. This can lead to slab-use-after-free in the flowtable/rhashtable path, detected by KASAN.

In the Linux kernel, the bnxt driver has a deadlock vulnerability when canceling the IRQ affinity notifier. The notifier restarts the queue under the netdev instance lock, and cancellation waits for the callback, causing a deadlock.

In the Linux kernel, ipvlan interfaces do not inherit needed_headroom and needed_tailroom from the physical device, which can lead to insufficient space reservation for headers and trailers. This results in buffer overflows, headroom underflows, or KASAN slab-use-after-free crashes.

In the Linux kernel, macvlan interfaces do not inherit needed_headroom and needed_tailroom from the lower device, which can lead to insufficient space reservation for headers and trailers. This results in buffer overflows, headroom underflows, or KASAN slab-use-after-free crashes.

In the Linux kernel, the veth interface has a bug in veth_poll that uses an incorrect queue index to wake the peer TX queue. Without an XDP program, the index remains 0, which can lead to a permanent stall of the TX queue and loss of transmission.

In the Linux kernel, the ngbe driver has a NULL pointer dereference vulnerability when enabling interrupts in non-MSI-X mode. In such mode, wx->msix_entry is not allocated, and calling NGBE_INTR_MISC leads to a crash.

In the Linux kernel, the net/sched act_api module has a TOCTOU vulnerability leading to NULL pointer dereference on a->goto_chain. A concurrent operation can clear the pointer between two reads, causing a NULL dereference.

In the Linux kernel, the net/sched cls_u32 module has a slab-out-of-bounds read vulnerability in u32_bind_class(). The function does not check whether the object is an hnode, leading to invalid memory access.

In the Linux kernel, the regmap sdw-mbq module has a vulnerability of calling an unset readable_reg callback. When the callback is not set, calling it leads to a NULL pointer dereference, potentially causing a system crash.

In the Linux kernel, the am65-cpsw-nuss driver has a bug in extracting the port ID from the source tag. It uses the full 16 bits, while only the lower 8 bits represent the port ID, which can lead to out-of-bounds memory access and system crash.

In the Linux kernel, the cls_bpf module did not verify that a device-bound (offloaded) eBPF program is bound to the same network interface to which the classifier is being attached. This allowed attaching a program intended for device A to device B, and after deleting device A it caused a system panic.

In the Linux kernel, in the L2TP modules (pppol2tp and l2tp_dfs), there is a reference leak for tunnels and sessions when closing seq_file files before reaching end-of-file. References stored in private data are not dropped, leading to memory leaks.