CVE Vulnerability Catalog

In the Linux kernel's RDMA/rxe subsystem, a vulnerability exists where rxe_rereg_user_mr() reassigns the PD pointer before validating access flags. If validation fails, the MR remains in an inconsistent state, leading to a use-after-free of the PD memory.

In the Linux kernel RDMA/rxe subsystem, mr_check_range() has an integer overflow vulnerability that allows a remote unauthenticated client to bypass memory range validation and trigger out-of-bounds access, causing a kernel oops. The fix rewrites the check in an overflow-safe form, returning -EINVAL for crafted requests.

In the Linux kernel xfrm subsystem, during bundle creation, a missing reference to net_device leads to a use-after-free when a concurrent interface deletion occurs. The fix reads dst->dev via dst_dev_rcu() and keeps the RCU read-side critical section active until xfrm_fill_dst() takes the required references.

In the Linux kernel firmware arm_scpi subsystem, scpi_dvfs_get_info() does not check the upper bound of the OPP count read from SCP firmware, which can lead to out-of-bounds read and incorrect sizing of the allocated OPP table. The fix rejects both zero and too-large OPP counts, returning -EINVAL.

In the Linux kernel clk scpi subsystem, scpi_dvfs_recalc_rate() does not check the upper bound of the DVFS index returned by dvfs_get_idx(), which can lead to out-of-bounds read and treating garbage as clock frequency. The fix treats indexes greater than or equal to the OPP count as invalid and returns 0.

In the Linux kernel RDMA/rxe subsystem, the HMM_PFN_WRITE check has been restored in ODP write paths. A previous fix removed the access permission test, allowing an unprivileged user to modify read-only pages (e.g., file cache) via RDMA operations, similar to Dirty COW. The fix requires HMM_PFN_WRITE for all write operations, preventing overwriting read-only files.

In the Linux kernel, the RDMA/rxe module contains a use-after-free vulnerability. The rxe_get_mcg() function publishes a newly allocated multicast group in the mcg_tree before the backing Ethernet multicast address is programmed via rxe_mcast_add(). If rxe_mcast_add() returns an error, the group is freed but remains in the tree, leading to a use-after-free when the same MGID is later looked up.

In the Linux kernel RDMA/core subsystem, ib_get_eth_speed() does not check the registration state of the net_device before invoking the ethtool callback, which can lead to use-after-free during interface unregistration. The fix adds a NETREG_REGISTERED check under RTNL and returns -ENODEV for devices being unregistered.

In the Linux kernel's IB/iser subsystem, a vulnerability allows a remote invalidation of an unregistered direction to cause a null pointer dereference and a general protection fault. The issue affects write commands whose data is sent entirely as immediate data, leaving the descriptor rdma_reg[ISER_DIR_OUT].desc NULL, while iser_check_remote_inv() passes it to iser_inv_desc(), which reads sig_protected from an invalid address.

A use-after-free vulnerability exists in the Linux kernel's IB/isert module. isert_send_done() defers completion handling for certain control PDUs to the isert_comp_wq workqueue, but nothing orders that work against connection teardown, so the queued work can run against memory freed by isert_wait_conn() and iscsit_close_connection().

In the Linux kernel RDMA/bnxt_re subsystem, bnxt_re_init_dcb_wq() ignores a failed allocation of the workqueue, leading to a call to queue_work() on a NULL pointer by the async DCB handler. The fix likely adds an allocation error check.

In the Linux kernel RDMA/rtrs subsystem, a guard was added against null pointer dereference. On error in init_path(), the cleanup code could call event tracing with kobj->name being NULL, causing a crash. A check was added to ensure the name is not NULL before copying.

In the Linux kernel RDMA/mad subsystem, a receive buffer leak was found when PKey enforcement fails. ib_mad_complete_recv() initializes rmpp_list but calls ib_mad_enforce_security() before linking the buffer, and on failure nothing is freed. A remote node can repeatedly send MADs with wrong PKey, causing memory leak.

In the Linux kernel RDMA/erdma subsystem, IRQ-safe XArray helpers are now used for QP and CQ tables. Previously, operations from EQ interrupts could deadlock with create-path updates when an interrupt arrived while holding the plain xa_lock.

In the Linux kernel RDMA/rtrs-clt subsystem, a CQ pool leak was fixed when connect is interrupted. The client borrows CQ credits in the ADDR_RESOLVED handler before connection, and on error create_cm() may not release them, leading to leak and potential WARN_ON during pool cleanup.

In the Linux kernel wifi virt_wifi driver, an skb leak was fixed when the simulated link is disconnected. virt_wifi_start_xmit() returned NET_XMIT_DROP without freeing the skb, causing memory leak for every packet sent while disconnected.

In the Linux kernel wifi brcmfmac (cyw) driver, a fix was made to pass PMKID to firmware if present. Previously, auth_status was not zeroed, causing stack data leak to firmware, and missing PMKID caused firmware to cache garbage PMKID and deny subsequent association requests with correct PMKID.

In the Linux kernel wifi libipw subsystem, a vulnerability was fixed by rejecting too-short beacon and probe responses. Parsing functions assumed a full 36-byte prefix, but receive paths only guarantee a 24-byte header. Length calculation wrapped and caused out-of-bounds read.

In the Linux kernel wifi libipw subsystem, a vulnerability was fixed by rejecting too-short association responses. libipw_handle_assoc_resp() reads fields from a 30-byte prefix, but receive paths only guarantee a 24-byte header. Length calculation wraps and causes out-of-bounds read.

In the Linux kernel IB/IPoIB subsystem, a fix was made to avoid restoring OPER_UP after multicast flush. Previously, the flag was temporarily cleared and restored, causing a race with ipoib_ib_dev_down(). After interface down, the flag could be set again, leading to deadlock in destroy_workqueue(). A dedicated IPOIB_FLAG_MCAST_FLUSH flag was introduced.