CVE Vulnerability Catalog

In the Linux kernel virt_wifi driver, virt_wifi_newlink() transferred operstate before registering the network device. If registration failed (e.g. due to an invalid name), free_netdev() freed the object while it remained on lweventlist, causing a use-after-free in a later linkwatch_fire_event(). The fix moves the transfer after netdev_upper_dev_link().

In the Linux kernel's drm/xe/shrinker component, a bug was found where __xe_shrinker_walk() walks the SYSTEM and TT LRUs without a runtime PM reference. Shrinking a buffer object outside system memory invalidates its GPU mappings, which requires the device to be resumed — while runtime suspended this trips an assertion warning and the TLB invalidation returns -ENODEV.

In the Linux kernel DRM vc4 driver, vc4_kms_load() called drm_kms_helper_poll_init() without a matching fini. After driver unbind, the scheduled output poll work ran on the freed drm_device, causing a use-after-free. The fix uses the managed drmm_kms_helper_poll_init().

In the Linux kernel ALSA HDA subsystem, the PCM open tracepoint was invoked before a stream was assigned. When stream assignment failed due to exhausted hardware streams, the tracepoint payload accessed an unassigned stream tag. The fix moves the tracepoint after the NULL check.

A memory leak was found in the Linux kernel's ath11k Wi-Fi driver. When the firmware crashes, ath11k_mac_peer_cleanup_all() failed to free arsta->rx_stats and tx_stats resources, causing kernel memory leaks (kmemleak). The fix extracts arsta cleanup into a new ath11k_mac_station_cleanup() function and calls it from both locations.

In the Linux kernel seg6, decap_and_validate() did not set the IPSKB_L3SLAVE flag in IPCB for IPv4 during IPIP decapsulation, although it did so for IPv6. As a result, SRv6 packets decapsulated on a VRF-enslaved interface did not reach local sockets as expected. The fix sets IPSKB_L3SLAVE for IPv4.

In the Linux kernel DSA driver mxl862xx, there is an issue with stats polling during teardown. The poll may run on freed port memory, and a re-arm after cancellation can queue work after sync has completed.

In the Linux kernel bcmgenet driver, configured hardware filter rules are lost on every interface up because list initialization in bcmgenet_hfb_init() drops all rules.

In the Linux kernel IPv4 ICMP, icmp_route_lookup() does not reject RTN_UNREACHABLE input routes, which can trigger a WARN_ON_ONCE() in ip_rt_bug() when sending ICMP packets.

In the Linux kernel, the skfp FDDI network driver has a NULL pointer dereference vulnerability when setting the MAC address on a down interface. skfp_ctl_set_mac_address() calls ResetAdapter() without checking netif_running(), leading to access to uninitialized transmit queues and a kernel oops.

In the Linux kernel network bridge, br_mst_set_state() calls switchdev_port_attr_set() while holding rcu_read_lock(), which may sleep in RCU context and cause potential issues.

A race condition exists in the Linux kernel's tcp_v6_do_rcv() function between checking the TCP_LISTEN socket state and calling skb_clone_and_charge_r(). A concurrent close() can change the state from TCP_LISTEN to TCP_CLOSE, causing the function to be called without locking and triggering a warning in inet_sock_destruct(). The issue affects IPv6 TCP listening sockets being closed concurrently.

A vulnerability in the Linux kernel allows net.ipv4.tcp_rmem to be set below 4096, causing a divide-by-zero error in tcp_rcvbuf_grow() and tcp_rcv_space_adjust(). This can lead to a kernel crash. The issue is fixed by enforcing a minimum value of 4096 for tcp_rmem.

In the Linux kernel DMA driver mmp_pdma, mmp_pdma_prep_slave_sg() reads entry length from the list head instead of the current entry, causing errors with varying lengths.

In the Linux kernel Bluetooth (hci_core), hci_send_acl(), hci_send_sco(), and hci_send_iso() queue tx_work unconditionally, which during device shutdown can cause warnings and work loss.

In the Linux kernel Bluetooth driver btintel_pcie, btintel_pcie_send_sync() does not validate packet length before copying to DMA buffer, which can lead to buffer overflow.

In the Linux kernel, a vulnerability in the Bluetooth coredump subsystem allows dump work to remain active after device unregister, leading to a use-after-free condition.

In the Linux kernel, the hci_qca Bluetooth driver has a vulnerability where it writes to a closed serial port. If hci_dev_open_sync() fails after a successful qca_setup(), the port is closed but power->vregs_on remains true, leading to a write to the closed port during driver removal. This results in a NULL pointer dereference, potentially causing a system crash.

In the Linux kernel, a reference leak in the Bluetooth ISO subsystem occurs in iso_conn_ready() when child socket allocation fails, causing memory leak.

In the Linux kernel, the Bluetooth drivers btmtksdio and btmtkuart lack validation of WMT event length before accessing structure fields, leading to out-of-bounds read.