CVE Descriptions Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/CVE-2021-46912 b/CVE-2021-46912
new file mode 100644
index 0000000..7b572ba
--- /dev/null
+++ b/CVE-2021-46912

@@ -0,0 +1,8 @@
+The Linux kernel vulnerability, CVE-2021-46912, occurs because the `tcp_allowed_congestion_control` sysctl is global and writable. This allows writing to it in any net namespace to leak into all other net namespaces. The issue arises from the fact that `tcp_available_congestion_control` and `tcp_allowed_congestion_control` are the only sysctls in the `ipv4_net_table` (the per-netns sysctl table) with a NULL data pointer.
+
+The handlers for these sysctls, `proc_tcp_available_congestion_control` and `proc_allowed_congestion_control`, operate globally because they have no other way of referencing a `struct net`. This is due to the fact that `ipv4_net_table` does not use designated initializers, making it difficult to fix this specific table entry.
+
+The solution implemented is to make these sysctls read-only by forcing the entries to be read-only. This should be sufficient since the intent of the original commit was only to know (i.e., read) which congestion algorithms are available or allowed.
+
+This vulnerability was introduced in kernel version 5.7 with commit 9cb8e048e5d9 and has been fixed in versions 5.10.32, 5.11.16, and 5.12 with commits 35d7491e2f77, 1ccdf1bed140, and 97684f0970f6, respectively. The affected file is `net/ipv4/sysctl_net_ipv4.c`.
+

diff --git a/CVE-2021-46913 b/CVE-2021-46913
new file mode 100644
index 0000000..923a808
--- /dev/null
+++ b/CVE-2021-46913

@@ -0,0 +1,8 @@
+The vulnerability affects the netfilter subsystem in the Linux kernel, specifically the nftables component. The issue arises when using connlimit in set elements, which causes `memcpy()` to break and leads to a crash in the connlimit garbage collector.
+
+The problem occurs because the connlimit expression list is not properly initialized using `nft_expr_clone()`, resulting in a corrupted list head copy that crashes the garbage collector. This is evident from the provided kernel crash dump, which shows a RIP error in the `find_or_evict()` function of the `nf_conncount` module.
+
+The vulnerability was introduced in Linux kernel version 5.7 with commit 409444522976 and has been fixed in versions 5.10.64, 5.11.16, and 5.12 with commits e51ff3ffc316, 47d8de3c2265, and 4d8f9065830e, respectively.
+
+The affected file is `net/netfilter/nf_tables_api.c`. The Linux kernel CVE team recommends updating to the latest stable kernel version to fix this issue. If updating is not possible, the individual changes can be cherry-picked from the provided commit links.
+

diff --git a/CVE-2021-46914 b/CVE-2021-46914
new file mode 100644
index 0000000..852746e
--- /dev/null
+++ b/CVE-2021-46914

@@ -0,0 +1,8 @@
+The CVE-2021-46914 vulnerability affects the Linux kernel, specifically the ixgbe driver, which is used for Intel 10GbE network cards. The issue arises from an unbalanced device enable/disable in suspend/resume operations.
+
+When a device is suspended, `pci_disable_device()` is called in `__ixgbe_shutdown()`, which decrements the `dev->enable_cnt` by 1. However, when the device resumes, `pci_enable_device_mem()` was removed in commit 6f82b2558735 ("ixgbe: use generic power management"), causing an unbalanced increase/decrease of `dev->enable_cnt`. To fix this, `pci_enable_device_mem()` needs to be added back to `ixgbe_resume()`.
+
+This vulnerability can lead to a call trace error, where the device is reported as already disabled during shutdown. The affected files are in `drivers/net/ethernet/intel/ixgbe/ixgbe_main.c`.
+
+The issue was introduced in kernel version 5.9 and fixed in versions 5.10.32, 5.11.16, and 5.12. To mitigate this vulnerability, it is recommended to update to the latest stable kernel version. If updating is not possible, individual changes can be applied from the specified commits.
+