The Linux Kernel Organization

An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables: Reject tables of unsupported…

It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div…

The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file net/socket.c. This issue was int…

io_uring UAF, Unix SCM garbage collection

It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if…

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was…

It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-after-free.