CVE Vulnerability Catalog

In the Linux kernel's iomap module, the functions ifs_set_range_dirty() and ifs_set_range_uptodate() have an out-of-bounds write vulnerability in bitmap_set() when the range length is zero. An underflow in last_blk calculation leads to huge values, causing a write beyond the allocated memory.

In the Linux kernel's slip module, slip_receive_buf() reads and writes through the rbuff pointer without holding the sl->lock, while sl_realloc_bufs() can change the buffer size. An MTU change can lead to an out-of-bounds write or use-after-free.

In the Linux kernel's geneve module, the function geneve_changelink() does not check for CAP_NET_ADMIN in the device's network namespace (dev_net(dev)), allowing a caller with privileges only in one namespace to modify a geneve device whose underlay operates in another namespace.

In the Linux kernel's net/af_iucv subsystem, there is a NULL pointer dereference vulnerability in afiucv_hs_callback_syn(). When child socket allocation fails, nsk is NULL, and the connection-refused path unconditionally calls iucv_sock_kill(nsk), leading to a crash. The fix only calls iucv_sock_kill() when a child socket was successfully allocated.

In the Linux kernel's net/iucv subsystem, there is a use-after-free vulnerability in handling severed iucv_path connections. The message_q queue holds raw pointers to the iucv_path, which is freed when the connection is severed, but notifications remain queued. Later recvmsg() uses the freed path, leading to a bug. The fix drops queued notifications when the path is severed.

A vulnerability in the Linux kernel net/sched subsystem: qdisc_get_rtab() and qdisc_put_rtab() mutate the global qdisc_rtab_list and a non-atomic refcnt without locking, which is unsafe when called without RTNL (e.g., via cls_flower). This leads to a race condition, use-after-free, and double-free of the qdisc_rate_table structure.

In the Linux kernel's PTP subsystem for s390, there is a missing facility check. The physical clock is registered without verifying that facility 28 is installed and that PTFF QAF confirms PTFF QPT availability. The fix adds the missing check.

In the Linux kernel RBD driver, a positive result code in a reply to an object map update is not reset to zero, which can trigger an assertion and crash the system. The fix resets the positive result code to zero and adds a WARN_ON_ONCE.

In the Linux kernel gve driver, a page allocation failure during Rx buffer refill can cause a permanent queue stall. The fix introduces a recovery timer that periodically reschedules NAPI when the buffer count falls below a threshold.

In the Linux kernel ice driver, missing validation of ptype in ice_parser_profile_init allows a malicious VF to write past the bitmap, causing a page fault. The fix rejects out-of-range ptype values.

In the Linux kernel mac802154 llsec subsystem, missing validation of frame length relative to authentication tag length leads to passing a huge value to AEAD and out-of-bounds read. The fix rejects frames shorter than the tag.

In the Linux kernel, pppoe_sendmsg() saves a pointer to the PPPoE header before calling dev_hard_header(), which may reallocate the skb head and invalidate the pointer. Under certain conditions, this can lead to a write through a stale pointer into freed memory. The fix reloads the pointer after device header creation.

A vulnerability in the Linux kernel's rtase driver can cause TX hangs due to hardware packet parsing errors. Incomplete IPv4, IPv6, TCP, or UDP headers, as well as PTP packets with short transport data, may trigger this issue. The driver applies workarounds such as dropping malformed packets and padding transport data.

In the Linux kernel, in tcp_v4_send_ack() and tcp_v6_send_response(), when constructing standalone TCP responses with TCP-AO options, the alignment padding bytes after the MAC are left uninitialized and may be transmitted. The fix initializes only the padding in the TCP-AO branches before hashing the header.

In the Linux kernel, in tcp_check_req() in the SYN-RECEIVED state, a non-exact RST (not matching RCV.NXT) is accepted and removes the request instead of triggering a challenge ACK as per RFC 9293. The fix adds the RFC 5961 reset check before ACK-field validation to enforce challenge ACK for non-exact RSTs.

In the Linux kernel, a vulnerability in the VXLAN module causes corruption of the MDB source list during a failed replace operation. Due to improper error handling, existing source entries are deleted, leading to incorrect behavior of EXCLUDE and INCLUDE filters, causing unauthorized traffic or blocking of legitimate traffic.

In the Linux kernel, the amdgpu driver (VCE) fixed an integer overflow in image size calculation. Malicious VCE command streams with oversized dimensions (e.g., 65536×65536) caused the buffer size to wrap to 0, bypassing validation and allowing out-of-bounds memory access by GPU firmware. The fix uses 64-bit arithmetic and rejects invalid dimensions.

In the Linux kernel, the amdgpu driver (VCN4) avoids rereading the IB parameter length. Instead, it uses the value returned by vcn_v4_0_enc_find_ib_param(), eliminating a potential TOCTOU issue if the IB contents change between reads.

In the Linux kernel, the amdgpu driver fixed a division by zero with invalid UVD dimensions. When width or height is less than 16, width_in_mb or height_in_mb becomes 0, leading to division by zero in H264 and H264 Perf decode paths. Added validation to reject frames with dimensions smaller than 16.

In the Linux kernel, the amdgpu driver fixed a memory management issue: before freeing acp_genpd memory, pm_genpd_remove() is called to unregister from the global list, and the pointer is cleared after free.