CVE Vulnerability Catalog

In the Linux kernel RDMA/rtrs subsystem, a guard was added against null pointer dereference. On error in init_path(), the cleanup code could call event tracing with kobj->name being NULL, causing a crash. A check was added to ensure the name is not NULL before copying.

In the Linux kernel RDMA/mad subsystem, a receive buffer leak was found when PKey enforcement fails. ib_mad_complete_recv() initializes rmpp_list but calls ib_mad_enforce_security() before linking the buffer, and on failure nothing is freed. A remote node can repeatedly send MADs with wrong PKey, causing memory leak.

In the Linux kernel RDMA/erdma subsystem, IRQ-safe XArray helpers are now used for QP and CQ tables. Previously, operations from EQ interrupts could deadlock with create-path updates when an interrupt arrived while holding the plain xa_lock.

In the Linux kernel RDMA/rtrs-clt subsystem, a CQ pool leak was fixed when connect is interrupted. The client borrows CQ credits in the ADDR_RESOLVED handler before connection, and on error create_cm() may not release them, leading to leak and potential WARN_ON during pool cleanup.

In the Linux kernel wifi virt_wifi driver, an skb leak was fixed when the simulated link is disconnected. virt_wifi_start_xmit() returned NET_XMIT_DROP without freeing the skb, causing memory leak for every packet sent while disconnected.

In the Linux kernel wifi brcmfmac (cyw) driver, a fix was made to pass PMKID to firmware if present. Previously, auth_status was not zeroed, causing stack data leak to firmware, and missing PMKID caused firmware to cache garbage PMKID and deny subsequent association requests with correct PMKID.

In the Linux kernel wifi libipw subsystem, a vulnerability was fixed by rejecting too-short beacon and probe responses. Parsing functions assumed a full 36-byte prefix, but receive paths only guarantee a 24-byte header. Length calculation wrapped and caused out-of-bounds read.

In the Linux kernel wifi libipw subsystem, a vulnerability was fixed by rejecting too-short association responses. libipw_handle_assoc_resp() reads fields from a 30-byte prefix, but receive paths only guarantee a 24-byte header. Length calculation wraps and causes out-of-bounds read.

In the Linux kernel IB/IPoIB subsystem, a fix was made to avoid restoring OPER_UP after multicast flush. Previously, the flag was temporarily cleared and restored, causing a race with ipoib_ib_dev_down(). After interface down, the flag could be set again, leading to deadlock in destroy_workqueue(). A dedicated IPOIB_FLAG_MCAST_FLUSH flag was introduced.

In the Linux kernel wifi cfg80211 subsystem, a fix was made to not get the radio mask for netdev-less wdevs. cfg80211_calculate_bi_data() calls rdev_get_radio_mask() with wdev->netdev, which can be NULL and crashes in mac80211. The order of checks was inverted to avoid this.

In the Linux kernel, cfg80211_classify8021d() did not check the IP header size before reading the DS field. A frame that looks like IP but is too short caused a read of uninitialized memory (detected by KMSAN).

In the Linux kernel, dma_chan_put() unconditionally dropped the device reference while dma_chan_get() only took it on the slow path. This caused a kref underflow on every fast-path get/put pair.

In the Linux kernel, dma_chan_put() and dma_release_channel() contained a use-after-free. When dma_device_put() dropped the last reference, dma_device_release() could free the dma_device and its channels while dma_chan_put() still read chan->device->owner.

In the Linux kernel, dma_device_release() unlinked the device and freed it without an RCU grace period. Concurrent RCU readers in dma_issue_pending_all() could access the device after it was freed.

In the Linux kernel, cfg80211 freed a driver-owned scan request when an interface went down during a scan. The driver still believed it owned the request, leading to a use-after-free in scan_done().

In the Linux kernel, __cfg80211_bss_update() grouped hidden BSS entries with entries from probe responses lacking beacon elements. A later beacon with a hidden SSID triggered WARN_ON_ONCE in cfg80211_combine_bsses().

In the Linux kernel, cfg80211_update_assoc_bss_entry() filtered entries by BSS type when removing stale entries. An entry with a different capability bit (e.g. IBSS) remained, causing WARN_ON(!cmp) in cfg80211_rehash_bss().

In the Linux kernel, when joining an IBSS only the BSSID/channel was recorded in the event and the BSS entry was looked up during processing. This was racy (e.g. a new scan with NL80211_SCAN_FLAG_FLUSH could remove it), causing a warning in __cfg80211_ibss_joined().

In the Linux kernel, mac80211 could start a ROC (remain-on-channel) while a scan was in progress. This led to a warning in ieee80211_start_next_roc() during scan completion.

In the Linux kernel, mac80211 tried to offload TC setup on AP_VLAN interfaces, which are purely virtual. Since the AP interface may not always be known and could change, offload should not be performed.