CVE Vulnerability Catalog

A vulnerability in the Linux kernel's af_unix mechanism was found, related to incorrect assignment of SCC indices in Tarjan's algorithm. In certain cases, vertices within one SCC may have different scc_index values, leading to incorrect garbage collection and potential memory leaks.

In the Linux kernel, the stmmac network driver has a TSO header length truncation issue because it stores the length in a u8, causing wraparound for headers longer than 255 bytes.

In the Linux kernel, the pppoatm driver lacks ensuring a writable skb header and linear data, which can lead to out-of-bounds reads or unbalanced buffer operations.

In the Linux kernel, a vulnerability was found in the drop_monitor module where per-CPU timers are stopped using timer_delete_sync() during teardown, which does not prevent concurrent workers from re-arming the timer. Under memory pressure, a worker can re-arm the timer after timer_delete_sync() returns, and after module unload, the timer fires in freed memory, causing a kernel panic or use-after-free.

In the Linux kernel, a bug in the bridge VLAN deletion handling was found when switchdev blocks the operation. Allowing switchdev to prevent VLAN deletion leads to inconsistent state, memory leaks, and NULL pointer dereference. The fix logs the error and continues with software VLAN deletion, consistent with 8021q behavior.

In the Linux kernel, a vulnerability was found in the netlink subsystem where netlink_realloc_groups() can free the old group bitmap before lockless readers finish using it. Two read paths (sk_diag_dump_groups() and /proc/net/netlink) can access freed memory, leading to use-after-free or out-of-bounds read.

In the Linux kernel, KVM for PowerPC (Book3S HV) has a use-after-free vulnerability in kvmhv_emulate_tlbie_all_lpid(). The function iterates nested-guest IDs without holding a reference, allowing a race with a concurrent vCPU that can free the memory. The fix increments the reference count before dropping the lock and releases it after the work.

In the Linux kernel, the powerpc/iommu module has an overflow validation bug in iommu_tce_check_ioba. The unified IOBA checking ignored the npages argument, using a constant value of 1, potentially allowing overflow when npages > 1. The fix accounts for npages, checks arithmetic overflow, and verifies the entire range does not exceed table capacity.

In the Linux kernel, the futex mechanism lacks private hash allocation on vfork(). Since accessing mm via vfork() is feasible, a private hash must be allocated for vfork() and other CLONE_VM users. The fix ensures the private hash is allocated before any private futex waiters exist.

In the Linux kernel, the drm/xe/i2c driver has a use-after-free vulnerability during unbind. The xe_i2c structure is freed before the SGUnit IRQ is disabled, leaving a window where an I2C IRQ can hit freed memory. The fix explicitly disables the I2C IRQ in xe_i2c_remove().

In the Linux kernel, the btrfs filesystem has a vulnerability where cleaning up verity items (rollback_verity, drop_verity_items, btrfs_orphan_cleanup) lacks metadata reservation, causing the whole filesystem to be forced read-only when hitting qgroup limit or lack of space, even though the limit applies to one subvolume only. Leftover items are never removed, making the subvolume unreachable or causing mount failures.

In the Linux kernel, the dev_fill_forward_path() function contains a WARN_ON_ONCE that can be triggered by a routing loop in IPIP and IPv6 tunnels when the route to the tunnel's remote endpoint resolves back to the tunnel itself. This configuration is possible for users with CAP_NET_ADMIN and causes the function to make no progress, triggering the warning when a flowtable tries to offload a flow through the tunnel.

In the Linux kernel, the fbnic network driver has a vulnerability where fbnic_tx_map() skips the doorbell write and completion request for packets with xmit_more set, relying on the packet ending the burst to publish them all. If that packet is dropped (e.g., due to DMA error), no doorbell is written, and descriptors of preceding packets remain invisible to the hardware, potentially causing a transmit queue stall.

A vulnerability in the Linux kernel's sock_gettstamp() function changes socket sk_flags without holding the socket lock. This leads to a race condition between bind() and SIOCGSTAMPNS_NEW ioctl, potentially causing a use-after-free on UDP sockets. The fix locks the socket only when SOCK_TIMESTAMP needs to be set, keeping the common case lockless.

In the Linux kernel, the Cortina (gmac) network driver has a vulnerability where the RX overrun interrupt is reported in interrupt status register 4, but gmac_irq() acknowledges it using the RX descriptor error bit from status register 0. For GMAC0 this writes the GMAC1 overrun bit, while for GMAC1 the shift leaves no bit in the 32-bit register, leading to incorrect interrupt acknowledgment.

In the Linux kernel, the PSP (Packet Security Protocol) mechanism conflicts with TLS ULP in its usage of both skb->decrypted and sk->sk_validate_xmit_skb(). To avoid conflicts, PSP should be mutually exclusive with TLS ULP, the only other user of these fields. Additionally, for future proofing, it would make sense to assert that sk->sk_validate_xmit_skb() is also NULL in both setup paths.

A vulnerability in the Linux kernel's x86 kprobes implementation causes a kernel crash when probing CS CALL instructions using eBPF. The int3_emulate_call() function assumes the CALL instruction is 5 bytes long, but the CS-prefixed CALL instruction is 6 bytes, leading to an incorrect exception return address and a crash. The fix uses the actual instruction length from the instruction decoder instead of the hardcoded CALL_INSN_SIZE macro.

In the Linux kernel, the mvpp2 network driver has a vulnerability where mvpp2_change_mtu() may call mvpp2_bm_switch_buffers(priv, true) without checking whether the number of pools (nrxqs * 2) exceeds MVPP2_BM_MAX_POOLS (8). This can lead to an out-of-bounds access in the priv->page_pool array in mvpp2_bm_init(), as the array is sized to hold MVPP2_PORT_MAX_RXQ entries and the per-CPU scheme doubles the count.

In the Linux kernel, a vulnerability exists in pskb_carve_inside_header() and pskb_carve_inside_nonlinear(), which after removing initial packet bytes do not properly update header pointers (mac_header, network_header, transport_header, csum_start). Leftover stale values point beyond actual data, potentially causing kernel BUG during RDS TCP packet processing.

In the Linux kernel, the amdgpu graphics driver has a vulnerability where nbio_v7_9_handle_ras_controller_intr_no_bifring() dereferences ras and obj without checking for NULL. Both amdgpu_ras_get_context() and amdgpu_ras_find_obj() can return NULL, e.g., during the window between adev->nbio.ras being set and the PCIE_BIF ras object being created, which can cause a crash in hard-IRQ context.