CVE Vulnerability Catalog

In the Linux kernel's mac80211 subsystem, a use-after-free vulnerability was found during mesh frame processing. The issue occurs when ieee80211_invoke_fast_rx() reads RX status via skb->cb, which is later overwritten by ieee80211_rx_mesh_data() with TX data, leading to access to freed or zeroed memory.

In the Linux kernel, the ipv6_hop_ioam() function lacked a NULL check for the pointer returned by __in6_dev_get(). During network interface teardown, this pointer can be NULL, leading to a NULL pointer dereference when processing an IOAM Hop-by-Hop option.

In the Linux kernel, a use-after-free (UAF) vulnerability was found in the vsock/vmci driver during connection handshake. When a peer sends a RST packet during handshake, the driver fails to properly remove the pending socket from the list, leading to double free and access to freed memory.

A vulnerability was found in the Linux kernel's IPv4 raw socket implementation. The raw_send_hdrinc() function fails to reject packets with ihl (Internet Header Length) less than 5, allowing malformed IP headers to be sent. This leads to an out-of-bounds memory access in ah_output() and a kernel panic.

A race condition was found in the Linux kernel's RBD (Ceph RADOS Block Device) driver during image unmap. The lock_dwork work item can be re-queued by maybe_kick_acquire() after cancellation, causing rbd_acquire_lock() to execute after resources are freed, violating an assertion about valid image format.

In the Linux kernel, a vulnerability was found in the LSM (Linux Security Module) mechanism. The lsm_set_self_attr() function does not hold the cred_guard_mutex, which may allow unauthorized changes to process security attributes, especially in the context of SELinux and AppArmor.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's unix_stream_data_wait() function for AF_UNIX sockets. The issue stems from a missing lock when reading the pointer to the last SKB in the receive queue, potentially leading to dereferencing freed memory. The flaw affects kernels from version 6.5 onward.

In the Linux kernel CIFS filesystem, a bug causes a busy dentry to be used after unmounting. The issue occurs when deferred file close work executes after unmount, triggering a warning in generic_shutdown_super.

In the Linux kernel's sev-guest module, a vulnerability was found where pages remain in an unknown state when set_memory_{encrypted,decrypted}() fails. To prevent potential data leaks, these pages are not returned to the buddy allocator but are explicitly leaked via snp_leak_pages().

A use-after-free vulnerability was found in the Linux kernel's ISCI driver during device removal. The completion tasklet is not killed before the controller is torn down, allowing a race between interrupts and memory cleanup. After the ihost structure is freed, a delayed tasklet may still dereference freed memory, leading to a crash or potential exploitation.

In the Linux kernel's DRM V3D driver, a use-after-free vulnerability exists on the error path during CPU job handling. After v3d_job_cleanup() frees the job memory, subsequent reads of timestamp and performance query arrays cause memory corruption. Additionally, a NULL pointer dereference occurs on the early error path.

In the Linux kernel DRM driver for VirtIO, a vulnerability was found where the return value of the DMA reservation lock function (dma_resv_lock_interruptible) is ignored. If interrupted by a signal (-EINTR) or due to memory shortage (-ENOMEM), the lock is not held, leading to a race condition when adding fences and potentially corrupting the fence list.

In the Linux kernel's AMD/Display driver, an out-of-bounds read vulnerability was found. GPIO pin table parsers did not validate whether the declared structure size from VBIOS fits within the available BIOS image, allowing reads beyond its boundaries.

In the Linux kernel, a use-after-free vulnerability was found in the batman-adv module's batadv_mcast_purge_orig() function. It removes entries from RCU-protected hlists without waiting for an RCU grace period, allowing concurrent RCU readers to access freed memory.

In the Linux kernel's batman-adv (BLA) module, a vulnerability was found involving a double decrement of the bla.num_requests counter. The issue stems from non-atomic operations on the counter and the request_sent flag, leading to a race condition and incorrect state.

In the Linux kernel, the batman-adv (tp_meter) module had a vulnerability where batadv_tp_sender_cleanup() used an unsafe combination of timer_delete_sync() and timer_delete() to stop a timer. This could lead to the timer being re-armed after cleanup, causing a use-after-free condition.

In the Linux kernel's batman-adv module, a vulnerability was found due to incorrect typing of the `tt_buff_len` field as `s16` instead of `u16`. Values greater than 32767 wrap to negative numbers, causing full buffer allocation but only partial population, leaving the rest uninitialized.

In the Linux kernel's pmbus/adm1266 driver, a buffer overflow vulnerability exists during block read operations. The read_buf declaration was one byte too small, causing out-of-bounds write when handling maximum-length responses (255 bytes + PEC byte).

A buffer overflow vulnerability was found in the pmbus/adm1266 driver of the Linux kernel. The adm1266_nvmem_read_blackbox() function passes a 64-byte buffer to the adm1266_pmbus_block_xfer() helper, which can write up to 255 bytes, causing memory corruption.

In the Linux kernel hwmon (pmbus/adm1266) driver, a vulnerability was found where the wrong constant (ADM1266_PDIO_STATUS instead of ADM1266_PDIO_NR) is used in the PDIO mask scanning loop. This causes out-of-bounds read from the caller's stack and potential out-of-bounds write to the bits array, leading to memory corruption.