CVE Vulnerability Catalog

In the Linux kernel, the RDMA/siw driver has an out-of-bounds (OOB) write vulnerability caused by improper length limiting of fragmented header copies. The fix uses the number of already received header bytes to calculate the next copy length.

In the Linux kernel, the netfilter nft_nat module has an uninitialized memory issue in nft_nat_setup_netmap() for IPv4 mapping. The fix zero-initializes the entire new_addr structure to avoid using uninitialized data.

In the Linux kernel, the netfilter nf_nat module has a memory leak when hook registration fails. The fix postpones setting nat_hook_ops and simplifies the error path to ensure hooks are released.

In the Linux kernel, the netfilter flowtable module has an issue with premature release of conntrack reference, potentially leading to use of an invalid object. The fix holds the reference until flow release after RCU grace period and adds rcu_barrier() on module exit.

In the Linux kernel, the DRM subsystem has a leak of drm_pending_vblank_event in the error path for out_fence_ptr. The fix releases the event and sets crtc_state->event to NULL to avoid memory leak.

In the Linux kernel, the SMB client has a buffer overflow vulnerability when processing absolute native symlink targets. The fix validates the NT drive prefix before accessing fixed offsets to prevent memory overwrites.

A vulnerability in the Linux kernel was found in the validation of the NDTPA_INTERVAL_PROBE_TIME_MS parameter for neighbor tables (e.g., ARP). Missing validation allows setting 0 or very large values (e.g., 4294967296), leading to incorrect timer behavior and potential security bypass.

In the Linux kernel, the ALSA bcd2000 driver has a race between rawmidi operations and USB disconnect, potentially leading to use-after-free (UAF). The fix introduces a spinlock covering rawmidi operations and handling in the callback to ensure safety.

In the Linux kernel, the NTFS ntfs_non_resident_attr_shrink() function called runlist helpers requiring the runlist write lock without holding it while freeing clusters and truncating the runlist, creating a race. Additionally, ntfs_attr_map_cluster() could leave inconsistent state if a mapping update failed. The fix serializes these operations with the runlist lock and adds rollback handling.

In the Linux kernel ALSA subsystem, snd_pcm_timer_init() registered the PCM timer before setting timer->private_data. During a brief window, a concurrent reader could reach the timer via /proc/asound/timers or snd_timer_open() and invoke callbacks that dereference a NULL pointer. The fix moves the private_data assignment before registration.

In the Linux kernel, the drm/msm/dp driver's msm_dp_display_atomic_disable() unconditionally wrote DP_STATE_CTRL_PUSH_IDLE and waited for an idle pattern even when the main link had never been enabled (e.g., after failed link training). This caused a PUSH_IDLE pattern timeout and dropped the controller's runtime-PM reference without taking the link down. On Snapdragon X2 Elite (glymur) SoCs, this led TrustZone to force-stop the SOCCP and ADSP remote processors and the machine reset silently.

In the Linux kernel, the ALSA driver for 6fire USB devices contains an out-of-bounds write in usb6fire_pcm_in_urb_handler(). A device can report an isochronous packet length less than 4 bytes, causing an integer underflow (wrap) in the subtraction and leading to a memset() with a huge size on a 4832-byte buffer. Even without the wrap, at 88.2/96 kHz the 4-in/6-out scaling causes the buffer to be exceeded.

In the Linux kernel virt_wifi driver, virt_wifi_newlink() transferred operstate before registering the network device. If registration failed (e.g. due to an invalid name), free_netdev() freed the object while it remained on lweventlist, causing a use-after-free in a later linkwatch_fire_event(). The fix moves the transfer after netdev_upper_dev_link().

In the Linux kernel's drm/xe/shrinker component, a bug was found where __xe_shrinker_walk() walks the SYSTEM and TT LRUs without a runtime PM reference. Shrinking a buffer object outside system memory invalidates its GPU mappings, which requires the device to be resumed — while runtime suspended this trips an assertion warning and the TLB invalidation returns -ENODEV.

In the Linux kernel DRM vc4 driver, vc4_kms_load() called drm_kms_helper_poll_init() without a matching fini. After driver unbind, the scheduled output poll work ran on the freed drm_device, causing a use-after-free. The fix uses the managed drmm_kms_helper_poll_init().

In the Linux kernel ALSA HDA subsystem, the PCM open tracepoint was invoked before a stream was assigned. When stream assignment failed due to exhausted hardware streams, the tracepoint payload accessed an unassigned stream tag. The fix moves the tracepoint after the NULL check.

A memory leak was found in the Linux kernel's ath11k Wi-Fi driver. When the firmware crashes, ath11k_mac_peer_cleanup_all() failed to free arsta->rx_stats and tx_stats resources, causing kernel memory leaks (kmemleak). The fix extracts arsta cleanup into a new ath11k_mac_station_cleanup() function and calls it from both locations.

In the Linux kernel seg6, decap_and_validate() did not set the IPSKB_L3SLAVE flag in IPCB for IPv4 during IPIP decapsulation, although it did so for IPv6. As a result, SRv6 packets decapsulated on a VRF-enslaved interface did not reach local sockets as expected. The fix sets IPSKB_L3SLAVE for IPv4.

In the Linux kernel DSA driver mxl862xx, there is an issue with stats polling during teardown. The poll may run on freed port memory, and a re-arm after cancellation can queue work after sync has completed.

In the Linux kernel bcmgenet driver, configured hardware filter rules are lost on every interface up because list initialization in bcmgenet_hfb_init() drops all rules.