A flaw was found in the Linux kernel's t7xx WWAN driver. A malicious, buggy, or compromised modem firmware can exploit this by sending packets with excessive fragments. This leads to a buffer overflow in the `skb_shinfo(skb)->frags[]` array, corrupting adjacent memory. This can result in kernel crashes or other undefined behavior, effectively causing a Denial of Service (DoS).

A flaw was found in the Linux kernel's `xfrm` (IP eXtensible FRamework) subsystem. This vulnerability involves a race condition where a network device's reference is released too early during packet processing after asynchronous cryptography. This premature release can lead to the system attempting to access a deallocated device, potentially causing a system crash (Denial of Service).

A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) RXE component. A race condition exists between the `retransmit_timer()` and `rxe_destroy_qp` functions. This can cause a Queue Pair (QP) reference count to underflow, leading to a use-after-free vulnerability. A local attacker could potentially leverage this to cause a denial of service or achieve arbitrary code execution.

A flaw was found in the Linux kernel's RDMA/rxe component. The `rxe_rcv()` function does not adequately validate the BTH pad and ICRC fields of incoming packets before calculating the payload size. A remote attacker could exploit this by sending a specially crafted short packet or a packet with a forged BTH pad. This could lead to an integer underflow, potentially causing unexpected behavior or a denial of service in the receive path.

A flaw was found in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem, specifically within the rxe driver. A remote attacker could exploit this vulnerability by sending a specially crafted ATOMIC_WRITE request with a zero-byte payload. This improper handling of non-8-byte ATOMIC_WRITE payloads allows the attacker to read past the intended packet boundary. Consequently, sensitive kernel memory, such as kernel strings and partial kernel-direct-map pointer words, can be disclosed into the attacker's memory region.

A flaw was found in the Linux kernel's Soft RoCE (RDMA/rxe) driver. An unauthenticated remote attacker can send a specially crafted UDP packet with an unknown opcode to trigger an out-of-bounds read. This vulnerability can lead to a kernel panic, effectively causing a Denial of Service (DoS) on the affected system. The issue arises from insufficient validation of unknown opcodes before performing length arithmetic during Cyclic Redundancy Check (CRC) processing.

A flaw was found in the Linux kernel's Elastic Network Adapter (ENA) driver, specifically within the Precision Time Protocol Hardware Clock (PHC) timestamp retrieval function. A race condition exists where the `get_timestamp` function could attempt to access memory that has already been freed by the `ena_com_phc_destroy` function. This use-after-free vulnerability can lead to a NULL pointer dereference, potentially causing a system crash and resulting in a Denial of Service (DoS).

A flaw was found in the Linux kernel's Internet Small Computer System Interface (iSCSI) Extensions for Remote Direct Memory Access (RDMA) (iSER) module. A remote attacker can send a specially crafted login request with a payload shorter than expected, leading to an integer underflow. This underflow causes a negative length to be used in a memory copy operation, resulting in an out-of-bounds write that crashes the system. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS).

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) timer component. A race condition can occur during the release of a timer object, specifically when the SNDRV_TIMER_IOCTL_PARAMS ioctl is called concurrently. This can lead to a use-after-free vulnerability, potentially allowing a local attacker to achieve arbitrary code execution or cause a denial of service.

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) timer component. This vulnerability occurs when a timer object is freed while timer instances are still associated with it, particularly when userspace-driven timers are involved. A local user can exploit this by repeatedly creating and deleting timer objects, leading to a use-after-free condition. This can result in system instability or denial of service.

A flaw was found in the Linux kernel's `io_ti` USB serial driver. A malicious USB device, when plugged into a host running this driver, can exploit a heap overflow vulnerability in the `get_manuf_info()` function. This occurs because the driver does not properly validate the size of data read from the device's I2C EEPROM against the allocated memory buffer. This improper validation can lead to out-of-bounds memory writes, potentially allowing an attacker to execute arbitrary code or cause a system crash (Denial of Service).

A flaw was found in the Linux kernel. A race condition exists in the `xfrm` policy handling, specifically within the `xfrm_policy_bysel_ctx()` function. This flaw allows for a use-after-free vulnerability, where memory is accessed after it has been released. This can lead to system instability or a denial of service (DoS), making the system unresponsive or causing it to crash.

A flaw was found in the Linux kernel's mac80211 WiFi subsystem. This vulnerability allows an attacker to cause undefined behavior by injecting a specially crafted frame with an invalid radiotap header. This can lead to system instability or a denial of service (DoS), potentially causing the system to crash.

A flaw was found in the Linux kernel's netfilter conntrack TCP state machine. A remote attacker can exploit this vulnerability by sending a specially crafted sequence of TCP (Transmission Control Protocol) packets, specifically a SYN (synchronize) packet followed by an RST (reset) packet with an invalid sequence number. This improper handling of the RST packet can prematurely terminate an active Network Address Translation (NAT) entry, making connection teardown easier than intended and potentially leading to a denial of service for affected connections.

A flaw was found in the Linux kernel's IPv6 Virtual Tunnel Interface (vti6) component. An unprivileged local user, particularly within a user namespace, could exploit a vulnerability related to incorrect network namespace handling during the movement of a vti6 tunnel. This issue can lead to a kernel bug, resulting in a denial of service (system crash) and potentially impacting container isolation on affected hosts.

A flaw was found in the Linux kernel's xfrm input component. The transport-mode reinjection process, which handles network packet re-injection, stores a network namespace pointer that must remain valid until a deferred callback completes. However, a missing reference count for the network namespace during this deferred operation could lead to a use-after-free vulnerability. This could allow an attacker to potentially cause a system crash or other unpredictable behavior if the network namespace is deallocated prematurely.

A flaw was found in the Linux kernel's IPv6 Virtual Tunnel Interface (VTI) module. When a VTI tunnel device is moved to a different network environment, an unprivileged user in a separate user space can manipulate tunnel parameters. This manipulation could allow the user to intercept or redirect network traffic intended for other parts of the system or other containers, leading to unauthorized information disclosure or denial of service across different tenants on a container host.

A flaw was found in the Advanced Linux Sound Architecture (ALSA) sequencer component of the Linux kernel. This vulnerability, a use-after-free, occurs because of improper synchronization when handling Universal MIDI Packet (UMP) output. A local attacker could exploit this by creating a specific timing issue, which may lead to a system crash, resulting in a denial of service, or potentially allow for increased privileges on the system.

A flaw was found in the Linux kernel's cfg80211 Wi-Fi subsystem. A remote attacker, by sending a specially-crafted malicious Wi-Fi beacon, could exploit a vulnerability in the cfg80211_merge_profile() function. This flaw causes the kernel to spend an excessive amount of processing time, leading to a Denial of Service (DoS) condition. This could theoretically be abused to impact system availability.

A flaw was found in the Linux kernel's iwlwifi driver. When the Wi-Fi firmware crashes, the driver continues to process network transmission requests inefficiently. This creates a continuous loop of attempting to send data through an unresponsive firmware, consuming excessive CPU resources and memory. This can lead to resource exhaustion and a denial of service (DoS) for the system.

A flaw was found in the Linux kernel's iwlwifi driver, affecting older Intel wireless devices. This vulnerability arises from incorrect handling of transmit (TX) rates, specifically when the driver attempts to set these rates. An attacker could potentially trigger a firmware assert or crash, leading to a denial of service (DoS) for the affected wireless functionality.

A flaw was found in the Linux kernel's RDMA/rxe component. A race condition in the `rxe_mmap()` function, which manages memory for Remote Direct Memory Access (RDMA) operations, can lead to a use-after-free vulnerability. A local attacker could exploit this timing issue to cause a system crash, resulting in a denial of service. In some scenarios, this could also potentially lead to a page-level use-after-free, which might allow for further system compromise.

A flaw was found in the Linux kernel's ice driver. A malicious virtual function (VF) can provide an out-of-range 'ptype' value through the VIRTCHNL interface. This can lead to a write past the end of an allocated memory region, causing a kernel page fault and resulting in a Denial of Service (DoS).

A flaw was found in libceph in the Linux kernel. A remote attacker, acting as a malicious monitor, could send a specially crafted OSDMap (Object Storage Device Map) with an overly long pg_temp or pg_upmap entry. This could lead to a stack out-of-bounds write, resulting in a kernel bug and potentially a denial of service.

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) timer component. A lack of serialization in the userspace-driven timer (utimer) TRIGGER ioctl allows two threads to concurrently call snd_timer_interrupt(). This race condition can lead to a use-after-free vulnerability, where a timer instance is freed while its callback is still running. A local attacker with the ability to open /dev/snd/timer could exploit this to achieve privilege escalation.

A flaw was found in the ath9k Wi-Fi driver in the Linux kernel. A race condition exists during the asynchronous firmware loading process and device disconnection. A local attacker, by repeatedly connecting and disconnecting a malicious USB Wi-Fi device that fails firmware download, could trigger a use-after-free vulnerability. This could lead to reading freed memory, potentially causing a system crash and resulting in a Denial of Service (DoS).

A flaw was found in the Linux kernel's `xfrm` subsystem. This vulnerability arises when asynchronous cryptographic operations incorrectly handle network packet segments, leaving a pointer to memory that has already been released. An attacker could potentially exploit this use-after-free condition to cause a system crash (denial of service) or, in some scenarios, execute unauthorized code.

A flaw was found in the Linux kernel's brcmfmac Wi-Fi driver. A remote attacker, by sending a specially crafted short authentication frame during the SAE (Simultaneous Authentication of Equals) authentication exchange, could trigger a heap overflow. This vulnerability allows for potential arbitrary code execution or a denial of service (DoS) on the affected system.

A flaw was found in the Linux kernel's device mapper (DM) subsystem. During certain resume operations, the kernel might attempt to free a memory table that has already been released. This error, known as a double-free vulnerability, can lead to memory corruption. A successful exploit could result in a system crash, causing a denial of service.

A flaw was found in the Linux kernel's Security-Enhanced Linux (SELinux) module. When using TCP Fast Open, SELinux failed to properly check connect-related permissions. This oversight could allow a local attacker to bypass SELinux network access controls, potentially enabling unauthorized network connections that should have been restricted by security policies.

A flaw was found in the Linux kernel's `qrtr` network component. On 32-bit systems, a 32-bit integer overflow can occur in the `qrtr_endpoint_post()` function when processing an incoming packet. This overflow can bypass a size validation check, leading to an out-of-bounds write and causing the kernel to crash. This vulnerability could allow a local attacker to cause a Denial of Service (DoS).