All CVEs — page 297 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The Linux kernel's ESP (Encapsulating Security Payload) implementation fails to properly handle zerocopy managed fragments, leading to potential use-after-free conditions and memory leaks when processing network packets. This occurs because ESP mutates fragment arrays without downgrading managed fragment references, breaking critical invariants that protect zero-copy page management.
The Linux kernel's RDMA/siw implementation has a race condition where the connection endpoint (cep) reference is not properly cleared under a lock when QP modification fails during acceptance. This can lead to use-after-free conditions when concurrent operations try to modify the QP state, potentially allowing attackers to corrupt memory or escalate privileges.
The Linux kernel's RDMA/rxe driver has a race condition where memory region access flags are validated after the protection domain (PD) is already reassigned, potentially leading to use-after-free vulnerabilities when a PD is freed while still referenced by active memory windows.
The flaw is an integer overflow in the mr_check_range() function, allowing a remote peer to perform out-of-bounds access, leading to potential kernel crashes and data corruption.
The Linux kernel's IPsec implementation has a use-after-free vulnerability in the XFRM subsystem where network device references are not properly held under RCU during bundle creation, potentially allowing attackers to corrupt memory or execute code when concurrent network interface removal occurs.
The Linux kernel's RDMA/rxe driver had a missing permission check that allowed unprivileged users to overwrite read-only file pages through RDMA operations, creating a Dirty COW-like vulnerability where attackers could modify protected files like /etc/passwd or setuid binaries without proper write permissions.
The Linux kernel's iSCSI over RDMA (iSER) implementation has a race condition where control PDU completions can be processed after the connection is already freed, leading to use-after-free memory corruption. This occurs because deferred completions are queued without ensuring they complete before connection teardown.