CVE Vulnerability Catalog

A null pointer dereference vulnerability was found in the Linux kernel's bpf_lwt_xmit_push_encap function. The issue occurs when skb->_skb_refdst is not initialized during BPF program test runs, leading to a kernel crash.

A race condition in the Linux kernel during unmap operations on PMD migration entries has been fixed. The issue occurs when move_pages and munmap syscalls are executed concurrently, triggering a VM_BUG_ON in pmdp_huge_get_and_clear_full. The vulnerability affects PowerPC 64-bit architecture.

In the Linux kernel libertas driver, usb_kill_urb() is called from interrupt context, which can cause synchronization issues. Instead, the driver now checks for pending URBs.

A fix in the Linux kernel for potential deadlock in BPF local storage. Deleting selem in NMI context could deadlock, so an error check was added.

In the mt76 WiFi driver (mt7925 model), there is a bug in mt7925_mac_write_txwi where missing NULL check for 'vif' pointer can lead to NULL pointer dereference and kernel panic.

In the mt76 WiFi driver, there is a memory leak when destroying the device. Rx queues have an associated page_pool that is not destroyed in mt76_dma_cleanup, and pages are not returned to the pool when WED is not enabled.

In the Linux kernel, the mt7925 driver (mt76) has a potential deadlock in mt7925_roc_abort_sync. It calls cancel_work_sync() while roc_work() holds dev->mt76.mutex, causing a lockup. This occurs during station removal.

In the Linux kernel, in the mt76 driver, mt76_connac_mcu_alloc_sta_req() allocates an skb that should be freed by mt76_mcu_skb_send_msg(). However, if an intermediate function (mt76_connac_mcu_sta_wed_update() or mt76_connac_mcu_sta_key_tlv()) fails before sending, the allocated skb leaks.

In the Linux kernel, a potential deadlock was found in the mt76 mt7921 WiFi driver in the mt7921_roc_abort_sync function. This function can deadlock on cancel_work_sync() when roc_work() holds dev->mt76.mutex and the caller already owns the same mutex. The deadlock occurs during station removal in the path mt76_sta_remove -> mt7921_mac_sta_remove -> mt7921_roc_abort_sync.

In the Linux kernel, the mt76 driver has a deadlock in mt76_remain_on_channel() and mt76_roc_complete(). They call mt76_set_channel() while already holding dev->mutex, causing a lockup.

In the Linux kernel, the configuration option was switched from CONFIG_CFI_CLANG to CONFIG_CFI, as it is now compiler-agnostic. Using the old name results in the code being compiled out, meaning CFI failures for btf_dtor_kfunc_t would still trigger.

A vulnerability in the Linux kernel regarding abuse of kprobe_write_ctx via freplace programs. Uprobe programs can modify struct pt_regs, and through kprobe+freplace they can affect kernel function arguments. The fix disallows attaching freplace programs to kprobe with different kprobe_write_ctx values.

In the Linux kernel, the brcmfmac driver for Broadcom Wi-Fi cards has a bug where the return value of brcmf_chip_add_core() is not checked for error pointers. This can lead to dereferencing an error pointer and potentially cause system instability.

In the Linux kernel task_vma iterator, there is a lock ordering issue. Holding the VMA lock during BPF program execution can lead to deadlocks. The fix takes a VMA snapshot and releases the lock before returning.

In the Linux kernel, the bpf_fd_array_map_clear() function is missing a cond_resched() call in its loop, which can cause RCU stalls and system crashes when clearing PROG_ARRAY maps with many entries.

In the 6pack (hamradio) driver in the Linux kernel, the sixpack_receive_buf() function does not skip bytes with TTY error flags, leading to processing of uninitialized data and KMSAN reporting an uninit-value read.

In the Linux kernel, a vulnerability in the cls_fw classifier allows a filter to be published to the datapath before the change() function is called, leading to a NULL pointer dereference when an invalid filter is processed.

A memory leak was found in the Linux kernel in the deferred packet drop mechanism of qdiscs. When the root qdisc does not implement the TCQ_F_DEQUEUE_DROPS flag, packets to be freed are not released and remain on a local list.

In the Linux kernel, bpf_prog_test_run_skb() calls eth_type_trans() and then uses skb->protocol to initialize sk family and address fields for the test. For IPv4/IPv6 packets, it may access ip_hdr(skb) or ipv6_hdr(skb) even when the test input only contains an Ethernet header. The fix rejects the input earlier if the Ethernet frame carries IPv4/IPv6 EtherType but the L3 header is too short.

A vulnerability in the Linux kernel in the Bluetooth HCI UART driver (hci_ldisc). When hci_register_dev() fails, the HCI_UART_PROTO_INIT flag is not cleared, potentially leading to recv being called after resources are freed. The fix clears the flag before closing.