CVE Vulnerability Catalog

In the Linux kernel, the NTFS ntfs_non_resident_attr_shrink() function called runlist helpers requiring the runlist write lock without holding it while freeing clusters and truncating the runlist, creating a race. Additionally, ntfs_attr_map_cluster() could leave inconsistent state if a mapping update failed. The fix serializes these operations with the runlist lock and adds rollback handling.

In the Linux kernel ALSA subsystem, snd_pcm_timer_init() registered the PCM timer before setting timer->private_data. During a brief window, a concurrent reader could reach the timer via /proc/asound/timers or snd_timer_open() and invoke callbacks that dereference a NULL pointer. The fix moves the private_data assignment before registration.

In the Linux kernel, the drm/msm/dp driver's msm_dp_display_atomic_disable() unconditionally wrote DP_STATE_CTRL_PUSH_IDLE and waited for an idle pattern even when the main link had never been enabled (e.g., after failed link training). This caused a PUSH_IDLE pattern timeout and dropped the controller's runtime-PM reference without taking the link down. On Snapdragon X2 Elite (glymur) SoCs, this led TrustZone to force-stop the SOCCP and ADSP remote processors and the machine reset silently.

In the Linux kernel, the ALSA driver for 6fire USB devices contains an out-of-bounds write in usb6fire_pcm_in_urb_handler(). A device can report an isochronous packet length less than 4 bytes, causing an integer underflow (wrap) in the subtraction and leading to a memset() with a huge size on a 4832-byte buffer. Even without the wrap, at 88.2/96 kHz the 4-in/6-out scaling causes the buffer to be exceeded.

In the Linux kernel virt_wifi driver, virt_wifi_newlink() transferred operstate before registering the network device. If registration failed (e.g. due to an invalid name), free_netdev() freed the object while it remained on lweventlist, causing a use-after-free in a later linkwatch_fire_event(). The fix moves the transfer after netdev_upper_dev_link().

In the Linux kernel's drm/xe/shrinker component, a bug was found where __xe_shrinker_walk() walks the SYSTEM and TT LRUs without a runtime PM reference. Shrinking a buffer object outside system memory invalidates its GPU mappings, which requires the device to be resumed — while runtime suspended this trips an assertion warning and the TLB invalidation returns -ENODEV.

In the Linux kernel DRM vc4 driver, vc4_kms_load() called drm_kms_helper_poll_init() without a matching fini. After driver unbind, the scheduled output poll work ran on the freed drm_device, causing a use-after-free. The fix uses the managed drmm_kms_helper_poll_init().

In the Linux kernel ALSA HDA subsystem, the PCM open tracepoint was invoked before a stream was assigned. When stream assignment failed due to exhausted hardware streams, the tracepoint payload accessed an unassigned stream tag. The fix moves the tracepoint after the NULL check.

A memory leak was found in the Linux kernel's ath11k Wi-Fi driver. When the firmware crashes, ath11k_mac_peer_cleanup_all() failed to free arsta->rx_stats and tx_stats resources, causing kernel memory leaks (kmemleak). The fix extracts arsta cleanup into a new ath11k_mac_station_cleanup() function and calls it from both locations.

In the Linux kernel seg6, decap_and_validate() did not set the IPSKB_L3SLAVE flag in IPCB for IPv4 during IPIP decapsulation, although it did so for IPv6. As a result, SRv6 packets decapsulated on a VRF-enslaved interface did not reach local sockets as expected. The fix sets IPSKB_L3SLAVE for IPv4.

In the Linux kernel DSA driver mxl862xx, there is an issue with stats polling during teardown. The poll may run on freed port memory, and a re-arm after cancellation can queue work after sync has completed.

In the Linux kernel bcmgenet driver, configured hardware filter rules are lost on every interface up because list initialization in bcmgenet_hfb_init() drops all rules.

In the Linux kernel IPv4 ICMP, icmp_route_lookup() does not reject RTN_UNREACHABLE input routes, which can trigger a WARN_ON_ONCE() in ip_rt_bug() when sending ICMP packets.

In the Linux kernel, the skfp FDDI network driver has a NULL pointer dereference vulnerability when setting the MAC address on a down interface. skfp_ctl_set_mac_address() calls ResetAdapter() without checking netif_running(), leading to access to uninitialized transmit queues and a kernel oops.

In the Linux kernel network bridge, br_mst_set_state() calls switchdev_port_attr_set() while holding rcu_read_lock(), which may sleep in RCU context and cause potential issues.

A race condition exists in the Linux kernel's tcp_v6_do_rcv() function between checking the TCP_LISTEN socket state and calling skb_clone_and_charge_r(). A concurrent close() can change the state from TCP_LISTEN to TCP_CLOSE, causing the function to be called without locking and triggering a warning in inet_sock_destruct(). The issue affects IPv6 TCP listening sockets being closed concurrently.

A vulnerability in the Linux kernel allows net.ipv4.tcp_rmem to be set below 4096, causing a divide-by-zero error in tcp_rcvbuf_grow() and tcp_rcv_space_adjust(). This can lead to a kernel crash. The issue is fixed by enforcing a minimum value of 4096 for tcp_rmem.

In the Linux kernel DMA driver mmp_pdma, mmp_pdma_prep_slave_sg() reads entry length from the list head instead of the current entry, causing errors with varying lengths.

In the Linux kernel Bluetooth (hci_core), hci_send_acl(), hci_send_sco(), and hci_send_iso() queue tx_work unconditionally, which during device shutdown can cause warnings and work loss.

In the Linux kernel Bluetooth driver btintel_pcie, btintel_pcie_send_sync() does not validate packet length before copying to DMA buffer, which can lead to buffer overflow.