CVE Vulnerability Catalog

In the Linux kernel, the scheduler (sched/core) can move a blocked donor's scheduling context to the lock owner's CPU even when the donor is migration-disabled. set_task_cpu() warns unconditionally for migration-disabled tasks, causing a false positive. The fix excludes blocked proxy donors from the warning.

In the Linux kernel, ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates that offset and triggers the skb warning path. The fix uses the careful transport-header helper and drops the skb through the existing XFRM error path when the offset cannot be represented.

In the Linux kernel, the dmaengine ti k3-udma-glue driver has a bug in k3_udma_glue_release_rx_chn(). If devm_kcalloc() for rx_chn->flows fails in a channel request function, the error path calls k3_udma_glue_release_rx_chn(), which dereferences the NULL rx_chn->flows pointer in k3_udma_glue_release_rx_flow(). The fix skips the flow release loop when rx_chn->flows is not allocated.

In the Linux kernel, the soc: samsung: exynos-pmu driver has a use-after-free of the interrupt generator device tree node. setup_cpuhp_and_cpuidle() releases the node reference (of_node_put()) too early and then passes the intr_gen_node pointer to of_syscon_register_regmap().

In the Linux kernel, a bug in memcg causes obj_cgroup_charge_pages() to not short-circuit the root memcg, leading to a warning in refill_stock() and asymmetric page accounting. This can be triggered via zswap and cgroup operations, resulting in a page counter leak in the root memcg.

In the Linux kernel, the SELinux avc_has_perm_noaudit() function returns early for an empty requested permission set without filling the access decision buffer (@avd). All callers pass an uninitialized stack variable that is then fed to avc_audit(), and the inode hook even stores it in the per-task decision cache.

In the Linux kernel, the power: sequencing subsystem's pwrseq_unit_new() can dereference a NULL pointer. If memory allocation fails in pwrseq_unit_setup_deps(), pwrseq_unit_put() is called to release the partially initialized unit, but unit->list was never initialized and pwrseq_unit_release() unconditionally calls list_del() on it.

In the Linux kernel, the power: sequencing subsystem's pwrseq_device_register() can dereference a NULL pointer. If dev_set_name() fails, the code jumps to the err_put_pwrseq label before initializing pwrseq->targets, and pwrseq_release() unconditionally iterates over targets and dereferences an invalid pointer.

In the Linux kernel, the watchdog: da9063 driver's da9063_wdt_suspend() and da9063_wdt_resume() only check watchdog_active(). When the driver sets WDOG_HW_RUNNING in da9063_wdt_probe() but userspace never opens the device, WDOG_ACTIVE remains cleared and wdt_disable() is not executed during suspend, so the watchdog keeps counting and may reset the system.

In the Linux kernel, the watchdog: rtd119x driver's clk_get_rate() can return 0, leading to a division by zero. The vulnerability causes a kernel panic.

In the Linux kernel, the watchdog: rzv2h driver's clk_get_rate() can return 0, leading to a division by zero. The vulnerability causes a kernel panic.

In the Linux kernel, the wifi: rsi driver's rsi_hal_load_key() performs a memset with an incorrect offset when a key is removed (data == NULL). Since set_key is a struct rsi_set_key pointer, the subscript is scaled by sizeof(struct rsi_set_key) (160 bytes), so the memset writes 144 zero bytes about 2.4 KB past the end of the skb data buffer, corrupting unrelated heap objects.

In the Linux kernel, ieee80211_set_bitrate_mask() lacked a check for the IEEE80211_SDATA_IN_DRIVER flag before calling the driver. When the interface was running but not yet added to the driver (e.g., during bringup or teardown), an ioctl SIOCSIWRATE call triggered a WARN in driver-ops.h. The fix adds an IN_DRIVER check and returns -ENETDOWN.

In the Linux kernel SMB client, parse_posix_sids() computes sidsbuf_end using the server-supplied out_len without validating it against the actual received iov length. A malicious server can provide an inflated out_len, enabling out-of-bounds reads into adjacent kernel memory.

In the Linux kernel drm/virtio driver, virtio_gpu_user_framebuffer_create() returns NULL instead of an ERR_PTR() error pointer. This leads to a NULL pointer dereference in drm_mode_addfb2().

In the Linux kernel s390 boot code, append_ipl_block_parm() may pass a zero size to the IPL parameter conversion helpers when the command line occupies the entire COMMAND_LINE_SIZE buffer. This results in a write outside the command line buffer.

In the Linux kernel, a bug was fixed in the icmp_send tracepoint where TP_fast_assign() unconditionally called udp_hdr(skb) before checking whether the packet is UDP. This triggered a DEBUG_NET_WARN_ON_ONCE warning when accessing an uninitialized transport header (transport_header = ~0U), as __icmp_send() can be invoked from paths such as link failures, ARP errors, forwarding, or AF_PACKET.

A vulnerability in the Linux kernel's iptunnel handling causes a stale transport_header offset during tunnel decapsulation of GSO packets. This leads to a negative offset and subsequent KASAN fault or page fault in qdisc_pkt_len_segs_init(). The issue occurs when encapsulated GSO packets are forwarded at L2 by a bridge or HSR instead of being delivered to the local IP stack.

In the Linux kernel s390 kdump handling, set_os_info_reipl_block() dereferences reipl_block_actual, which remains NULL for IPL types without a re-IPL parameter block (e.g., HMC FTP boot, QEMU direct kernel boot). This can lead to a NULL pointer dereference.

In the Linux kernel s390 stand-alone dump handling, dump_reipl_run() unconditionally dereferences reipl_block_actual, which remains NULL for IPL types without a re-IPL parameter block. This can lead to a NULL pointer dereference and put the dumper into disabled wait.