CVE Vulnerability Catalog

In the Linux kernel net/sched subsystem, hhf_change() stores TCA_HHF_HH_FLOWS_LIMIT with no upper bound. A huge hh_flows_limit lets each new heavy-hitter flow pass the hh_flows_current_cnt check in alloc_new_hh() and forces a fixed-size kzalloc(GFP_ATOMIC) per flow under spoofed traffic, causing unbounded memory growth.

In the Linux kernel net/packet subsystem, tpacket_rcv() claims a V1 or V2 ring slot before converting the virtio-net header. If the conversion fails, the drop path leaves the slot claimed; with a one-frame TPACKET_V2 ring, an unsupported UDP GSO packet leaves the only slot unavailable and the ring also drops the next valid packet.

A vulnerability was found in the Linux kernel in scsi_cdl_enable() in the SCSI core. During scanning of USB devices that identify as ATA and support CDL, lengths returned by MODE SENSE can be invalid, leading to out-of-bounds stack read/write and disclosure of stack contents to the attacker.

A use-after-free vulnerability exists in the Linux kernel's xfrm_dev_state_free() during XFRM device state flush. The state GC worker can free the same state concurrently while the flush thread accesses it after dropping the xfrm_state_dev_gc_lock, leading to double driver callback invocation and use of freed memory.

In the Linux kernel xfrm subsystem, the state_cache and state_cache_input lists still use hlist_del_rcu() instead of hlist_del_init_rcu(), leaving pprev = LIST_POISON2 (non-NULL) after deletion. A second __xfrm_state_delete() on the same object performs a write through LIST_POISON2, causing a write use-after-free and, in turn, a read use-after-free during a subsequent list traversal.

In the Linux kernel, xfrm_input() has a use-after-free vulnerability involving xfrm_state. Some receive paths, such as VTI and XFRM interfaces, can reset the secpath before processing completes, leading to dereferencing freed memory. The fix saves the state protocol on the stack before the reset and uses the already saved address family.

In the Linux kernel, for MIPS I6500 CPU cores, the CONFIG_WEAK_REORDERING_BEYOND_LLSC option is not selected when CONFIG_EYEQ is enabled. The lld/scd instructions on these cores do not provide ordering guarantees, so arch_cmpxchg() is not fully ordered. This can lead to kernel page faults and system crashes, as demonstrated in the oops report.

In the Linux kernel memstick ms_block driver, there is a memory leak: the workqueue msb->io_queue created in msb_init_disk() is not destroyed on device removal (msb_remove()). Each card insert/remove cycle leaks the workqueue and its kworker, exhausting kernel memory.

In the Linux kernel, a collision exists between the SWAP_USAGE_OFFLIST_BIT flag and the real swap usage counter. The flag is defined as bit 30, which on systems with 4 KiB pages collides with the usage count once it reaches 4 TiB. This can cause underreporting of swap usage, premature swapoff leading to lost pages, and corruption of the counter and plist.

A bug in the Linux kernel shrinker mechanism manifests when cgroup.memory=nokmem is enabled. In that configuration, shrinker_memcg_alloc() fails to allocate an id, leaving shrinker->id as zero, which is then mistakenly treated as a valid bit index. This triggers a WARN_ON_ONCE in set_shrinker_bit() when the first THP is queued in a cgroup.

In the Linux kernel mmap_prepare() function, there is an error in memory accounting. When call_mmap_prepare() fails, jumping to abort_munmap does not unaccount previously accounted memory, leading to inconsistencies in memory counters.

In the Linux kernel filemap mechanism, there is an issue with dropbehind folios. Fault-around can map ready dropbehind folios without normal page-cache lookup, leading to forced unmapping during writeback. The fix retains mapped folios, avoiding a path that may sleep in non-preemptible context.

In the Linux kernel KEYS encrypted mechanism, there is an integer overflow in the datablob_len variable (u16). If the sum of lengths exceeds U16_MAX, the assignment truncates the allocation size, leading to a slab-out-of-bounds write reported by KASAN. The fix uses check_add_overflow() and kzalloc_flex().

In the Linux kernel KEYS trusted mechanism, tpm2_load_cmd() performs boundary checks against the ASN.1 size (payload->blob_len), which may be incorrect. The fix passes the decoded blob size to tpm2_load_cmd() and uses it for boundary checks.

In the Linux kernel, a vulnerability in sched_ext causes NULL pointer dereference in scx_bpf_select_cpu_and() and scx_bpf_dsq_insert_vtime() when handling tasks without a scheduler (e.g., exited or idle tasks). This leads to a kernel oops in the error handling path.

In the Linux kernel's sched_ext scheduler, there is a pre-enable error claim window that can lead to a use-after-free. An error claimed by a BPF program in this window is consumed by the disable path, causing the scheduler to remain up but unable to be disabled, and then freed while still in use.

In the Linux kernel's i2c atr driver, there is a dangling adapter pointer on add failure. After i2c_add_adapter() fails, the channel is freed but the pointer in the adapter array remains pointing to freed memory, potentially leading to use-after-free and blocking reuse with -EEXIST.

In the Linux kernel's mlx4 driver for InfiniBand, there is a use-after-free on pkey sysfs registration failure. Errors are ignored, and pointers to freed kobjects remain in the device, leading to double-free during cleanup.

A vulnerability in the Linux kernel's IB/hfi1 driver affects the PIO_CRED credit-return mmap. Incorrect pointer arithmetic and improper DMA API usage cause user space to receive the wrong credit-return page, leading to corrupted page tables, kernel Oops, or PIO transmission hangs.

In the Linux kernel's SELinux module, there is an issue with preserving user SID across nested backing files. For nested backing files (e.g., overlayfs over overlayfs), the user file SID may be the mounter's SID, leading to incorrect access checks during mprotect().