CVE Vulnerability Catalog

In the Linux kernel seg6, decap_and_validate() did not set the IPSKB_L3SLAVE flag in IPCB for IPv4 during IPIP decapsulation, although it did so for IPv6. As a result, SRv6 packets decapsulated on a VRF-enslaved interface did not reach local sockets as expected. The fix sets IPSKB_L3SLAVE for IPv4.

In the Linux kernel DSA driver mxl862xx, there is an issue with stats polling during teardown. The poll may run on freed port memory, and a re-arm after cancellation can queue work after sync has completed.

In the Linux kernel bcmgenet driver, configured hardware filter rules are lost on every interface up because list initialization in bcmgenet_hfb_init() drops all rules.

In the Linux kernel IPv4 ICMP, icmp_route_lookup() does not reject RTN_UNREACHABLE input routes, which can trigger a WARN_ON_ONCE() in ip_rt_bug() when sending ICMP packets.

In the Linux kernel, the skfp FDDI network driver has a NULL pointer dereference vulnerability when setting the MAC address on a down interface. skfp_ctl_set_mac_address() calls ResetAdapter() without checking netif_running(), leading to access to uninitialized transmit queues and a kernel oops.

In the Linux kernel network bridge, br_mst_set_state() calls switchdev_port_attr_set() while holding rcu_read_lock(), which may sleep in RCU context and cause potential issues.

A race condition exists in the Linux kernel's tcp_v6_do_rcv() function between checking the TCP_LISTEN socket state and calling skb_clone_and_charge_r(). A concurrent close() can change the state from TCP_LISTEN to TCP_CLOSE, causing the function to be called without locking and triggering a warning in inet_sock_destruct(). The issue affects IPv6 TCP listening sockets being closed concurrently.

A vulnerability in the Linux kernel allows net.ipv4.tcp_rmem to be set below 4096, causing a divide-by-zero error in tcp_rcvbuf_grow() and tcp_rcv_space_adjust(). This can lead to a kernel crash. The issue is fixed by enforcing a minimum value of 4096 for tcp_rmem.

In the Linux kernel DMA driver mmp_pdma, mmp_pdma_prep_slave_sg() reads entry length from the list head instead of the current entry, causing errors with varying lengths.

In the Linux kernel Bluetooth (hci_core), hci_send_acl(), hci_send_sco(), and hci_send_iso() queue tx_work unconditionally, which during device shutdown can cause warnings and work loss.

In the Linux kernel Bluetooth driver btintel_pcie, btintel_pcie_send_sync() does not validate packet length before copying to DMA buffer, which can lead to buffer overflow.

In the Linux kernel, a vulnerability in the Bluetooth coredump subsystem allows dump work to remain active after device unregister, leading to a use-after-free condition.

In the Linux kernel, the hci_qca Bluetooth driver has a vulnerability where it writes to a closed serial port. If hci_dev_open_sync() fails after a successful qca_setup(), the port is closed but power->vregs_on remains true, leading to a write to the closed port during driver removal. This results in a NULL pointer dereference, potentially causing a system crash.

In the Linux kernel, a reference leak in the Bluetooth ISO subsystem occurs in iso_conn_ready() when child socket allocation fails, causing memory leak.

In the Linux kernel, the Bluetooth drivers btmtksdio and btmtkuart lack validation of WMT event length before accessing structure fields, leading to out-of-bounds read.

In the Linux kernel, the Bluetooth btintel_pcie driver has an off-by-one bounds check in RX submission, allowing access to an element past the end of the FRBD array.

In the Linux kernel, a potential socket lock inversion in the Bluetooth RFCOMM listener cleanup can lead to a deadlock.

A vulnerability in the Linux kernel's af_unix mechanism was found, related to incorrect assignment of SCC indices in Tarjan's algorithm. In certain cases, vertices within one SCC may have different scc_index values, leading to incorrect garbage collection and potential memory leaks.

In the Linux kernel, the stmmac network driver has a TSO header length truncation issue because it stores the length in a u8, causing wraparound for headers longer than 255 bytes.

In the Linux kernel, the pppoatm driver lacks ensuring a writable skb header and linear data, which can lead to out-of-bounds reads or unbalanced buffer operations.