CVE Vulnerability Catalog

In the Linux kernel for RISC-V, an uninitialized stack variable 'cregs' causes register corruption. Functions compat_riscv_gpr_set() and compat_restore_sigcontext() call cregs_to_regs() even after a failed user-space copy, writing uninitialized stack data into the target task's pt_regs.

In the Linux kernel, a vulnerability was found in the ARM FF-A driver due to missing validation of the framework notification message layout. Incorrect offset and size values can lead to out-of-bounds reads or oversized memory allocations.

In the Linux kernel netfilter/x_tables subsystem, a new function xtables_unregister_table_exit was added to replace xt_unregister_table(). This fixes an issue where during module removal (rmmod), users performing set/getsockopt could not re-instantiate the table because the larval table was already removed and the existing instance was no longer on the active table list.

In the Linux kernel, the netfilter ebtables module introduces a two-stage removal scheme to prevent a race condition during table operation assignment. The table->ops assignment is now performed while holding the ebt mutex, avoiding exposure of a partially filled table structure.

A race condition vulnerability was found in the Linux kernel's netfilter bridge eb_tables module during initialization. The sockopt registration occurs too early, before the module initialization is complete, exposing partially initialized structures globally.

In the Linux kernel, unregister_fprobe() lacked RCU grace period synchronization, potentially causing use-after-free after fprobe unregistration. This affects fprobe events and sample module code.

A vulnerability in the Linux kernel's statmount_mnt_idmap function can cause an out-of-bounds write on the seq buffer. The issue occurs because manual increment of seq->count after seq_printf() bypasses overflow detection, leading to a NULL byte write beyond the allocated buffer.

In the Linux kernel on PREEMPT_RT, a use-after-free vulnerability was found in irq_work_single(). After clearing the BUSY flag via atomic_cmpxchg(), the code still dereferences the work structure, which can be freed prematurely by another thread calling irq_work_sync().

In the Linux kernel, the nvme-pci driver has a use-after-free vulnerability in nvme_free_host_mem(). After freeing memory via dma_free_noncontiguous(), the dev->hmb_sgt pointer is not cleared, leading to a double-free and NULL pointer dereference when the function is called twice in an error path.

In the Linux kernel netfs subsystem, a vulnerability was found where streaming writes could be overwritten incorrectly. When a partially written streaming write page was fully overwritten, the netfs_folio structure was not freed, leading to data corruption. The fix properly manages the netfs_folio structure and handles partial copy failures.

In the Linux kernel, the netfs_read_folio() function fails to wait for ongoing writeback to complete. This can lead to data corruption because the function trusts the dirty flag and folio->private data, which may be cleaned up before the writeback flag is cleared.

In the Linux kernel, the AFS filesystem has a vulnerability due to incorrect locking when handling symbolic links. This allows races between multiple get_link() calls, potentially leading to memory leaks or incorrect symlink content reads.

In the Linux kernel, a vulnerability was found in the net shaper mechanism. The net_shaper_nl_group_doit() function does not deduplicate NET_SHAPER_A_LEAVES entries, causing a double free of the same parent pointer in the cleanup loop. This occurs when userspace supplies the same leaf handle twice.

In the Linux kernel, a vulnerability was found in bio_integrity_copy_user() where overwriting bip_vcnt with nr_vecs breaks the bip_vcnt <= bip_max_vcnt invariant. On WRITE this causes out-of-bounds read of the bip_vec[] flex array, and on READ it reads incorrect data.

In the Linux kernel, the accel/qaic driver lacks an overflow check in remap_pfn_range during mmap, allowing a buffer object (BO) that is too large to map beyond the VMA region. This can cause use-after-free issues when munmap() unmaps only the VMA region.

In the Linux kernel, a vulnerability was found due to mixing devm and drmm memory management functions in the MSM DPU graphics driver. This causes a use-after-free condition during driver teardown when userspace holds a reference to the DRM device.

In the Linux kernel's SMC-D subsystem, a vulnerability exists where a malicious peer can reply to an SMC-Dv2 proposal with CHID=0, matching an empty slot in the ism_dev[] array. This leads to a NULL pointer dereference in smc_conn_create(), causing a kernel panic.

In the Linux kernel, a security flaw was found in the ovpn TCP driver's ovpn_tcp_close() function. It used the sock->peer pointer outside the RCU section, leading to a race condition and potential use-after-free.

In the Linux kernel's ovpn (OpenVPN) driver, a vulnerability was found due to improper reference counting (kref) handling in the error path of the CMD_NEW_PEER command. For TCP connections, a new peer may be accessible via the socket before being added to the hash table, and calling ovpn_peer_release() directly instead of ovpn_peer_put() leads to a use-after-free condition.

A vulnerability in the Linux kernel's VFIO/PCI driver allows exporting unallocated BAR resources via DMABUF. Lack of reservation verification before export may lead to unauthorized memory access.