CVE Vulnerability Catalog

In the Linux kernel dma-buf module, the mapped_len variable was 32-bit, causing silent overflow for MMIO sizes larger than 4G, leading to incorrect lengths passed to fill_sg_entry(). The fix changes mapped_len to size_t (64-bit) and adds overflow protections in calc_sg_nents.

In the Linux kernel IPv6 XFRM, xfrm6_local_rxpmtu() and xfrm6_local_error() assume skb->sk always points to a full IPv6 socket, but it can be a request_sock, leading to out-of-bounds reads. The fix uses skb_to_full_sk() and bails out when no full socket is attached.

In the Linux kernel ip_tunnel module, the options_len variable is not initialized before use in ip_tun_parse_opts_geneve, leading to a buffer overflow when copying option data. The fix initializes the counter before referencing options.

In the Linux kernel lan743x driver, lan743x_rx_process_buffer() adds each non-first receive buffer to the head skb's frag_list, and lan743x_rx_trim_skb() then linearizes the head and frees the fragment skb metadata. The checksum-success path still writes ip_summed through the local skb pointer that points to the freed fragment, causing a use-after-free write when a packet spans more than one receive buffer.

In the Linux kernel t7xx WWAN driver, t7xx_ccmni_recv_skb() indexes the ccmni_inst[] array without a bounds check. The netif index in the DPMAIF PIT header is five bits wide (0-31) but the array holds only 21 entries, so indexes 21-31 read past it into the callback table, causing the driver to treat arbitrary data as a struct t7xx_ccmni and dereference it.

In the Linux kernel mhi_wwan_mbim driver, mhi_mbim_rx() traverses the NDP chain and only stops when wNextNdpIndex is zero. Nothing requires the offsets to advance, so a modem that points an NDP at itself or at an earlier NDP keeps the loop spinning forever on one CPU.

In the Linux kernel mhi_wwan_mbim driver, mhi_mbim_rx() ignores the return value of skb_copy_bits() when copying each datagram out of the NTB. The datagram offset and length come from the DPE, which is only checked to lie within the NTB, so a modem can point a datagram outside the received skb; the copy fails and the freshly allocated skbn with uninitialized contents is passed to netif_rx(), leaking kernel heap memory.

In the Linux kernel net/sched subsystem, tcf_action_put_many() uses the tcf_act_for_each_action() iterator, which stops at the first NULL slot. When a batched RTM_DELACTION request stops at an action bound to a filter, references on subsequent actions are not released, leaking a reference and allowing a later delete of an unbound action to return success without removing it from the IDR.

In the Linux kernel net/sched subsystem, hhf_change() stores TCA_HHF_HH_FLOWS_LIMIT with no upper bound. A huge hh_flows_limit lets each new heavy-hitter flow pass the hh_flows_current_cnt check in alloc_new_hh() and forces a fixed-size kzalloc(GFP_ATOMIC) per flow under spoofed traffic, causing unbounded memory growth.

In the Linux kernel net/packet subsystem, tpacket_rcv() claims a V1 or V2 ring slot before converting the virtio-net header. If the conversion fails, the drop path leaves the slot claimed; with a one-frame TPACKET_V2 ring, an unsupported UDP GSO packet leaves the only slot unavailable and the ring also drops the next valid packet.

A vulnerability was found in the Linux kernel in scsi_cdl_enable() in the SCSI core. During scanning of USB devices that identify as ATA and support CDL, lengths returned by MODE SENSE can be invalid, leading to out-of-bounds stack read/write and disclosure of stack contents to the attacker.

A use-after-free vulnerability exists in the Linux kernel's xfrm_dev_state_free() during XFRM device state flush. The state GC worker can free the same state concurrently while the flush thread accesses it after dropping the xfrm_state_dev_gc_lock, leading to double driver callback invocation and use of freed memory.

In the Linux kernel xfrm subsystem, the state_cache and state_cache_input lists still use hlist_del_rcu() instead of hlist_del_init_rcu(), leaving pprev = LIST_POISON2 (non-NULL) after deletion. A second __xfrm_state_delete() on the same object performs a write through LIST_POISON2, causing a write use-after-free and, in turn, a read use-after-free during a subsequent list traversal.

In the Linux kernel, xfrm_input() has a use-after-free vulnerability involving xfrm_state. Some receive paths, such as VTI and XFRM interfaces, can reset the secpath before processing completes, leading to dereferencing freed memory. The fix saves the state protocol on the stack before the reset and uses the already saved address family.

In the Linux kernel, for MIPS I6500 CPU cores, the CONFIG_WEAK_REORDERING_BEYOND_LLSC option is not selected when CONFIG_EYEQ is enabled. The lld/scd instructions on these cores do not provide ordering guarantees, so arch_cmpxchg() is not fully ordered. This can lead to kernel page faults and system crashes, as demonstrated in the oops report.

In the Linux kernel memstick ms_block driver, there is a memory leak: the workqueue msb->io_queue created in msb_init_disk() is not destroyed on device removal (msb_remove()). Each card insert/remove cycle leaks the workqueue and its kworker, exhausting kernel memory.

In the Linux kernel, a collision exists between the SWAP_USAGE_OFFLIST_BIT flag and the real swap usage counter. The flag is defined as bit 30, which on systems with 4 KiB pages collides with the usage count once it reaches 4 TiB. This can cause underreporting of swap usage, premature swapoff leading to lost pages, and corruption of the counter and plist.

A bug in the Linux kernel shrinker mechanism manifests when cgroup.memory=nokmem is enabled. In that configuration, shrinker_memcg_alloc() fails to allocate an id, leaving shrinker->id as zero, which is then mistakenly treated as a valid bit index. This triggers a WARN_ON_ONCE in set_shrinker_bit() when the first THP is queued in a cgroup.

In the Linux kernel mmap_prepare() function, there is an error in memory accounting. When call_mmap_prepare() fails, jumping to abort_munmap does not unaccount previously accounted memory, leading to inconsistencies in memory counters.

In the Linux kernel filemap mechanism, there is an issue with dropbehind folios. Fault-around can map ready dropbehind folios without normal page-cache lookup, leading to forced unmapping during writeback. The fix retains mapped folios, avoiding a path that may sleep in non-preemptible context.