CVE Vulnerability Catalog

In the Linux kernel, a buffer overflow vulnerability was found in the fs210x audio codec driver. The fs210x_effect_scene_info() function used strscpy with an incorrect destination size (strlen(SRC)+1 instead of sizeof(DST)), which can lead to out-of-bounds write.

In the Linux kernel, a vulnerability was found in the MSM DRM driver's snapshot code. Internal 16-byte alignment caused incorrect dumping of DSI data (shifted by 4 bytes) and 16x memory overallocation. The fix removes length alignment and accurately prints last registers.

A vulnerability was found in the Linux kernel's cgroup/rstat mechanism, where the css_rstat_updated() function exposed as a BPF kfunc does not validate the CPU number provided by the caller. A BPF program with appropriate capabilities can pass an invalid CPU value, leading to an out-of-bounds array access.

A use-after-free vulnerability was found in the Linux kernel's bridge multicast implementation when removing a bridge port. The issue occurs when per-VLAN multicast snooping is enabled and global multicast snooping is toggled, causing both per-port and per-VLAN multicast contexts to be active simultaneously. When such a port is removed, the per-port context is not disabled, leading to use of freed memory.

A race condition was found in the Linux kernel's EROFS filesystem managed cache for unaligned extents. Two threads may simultaneously add the same folio to the cache, leading to an inconsistent state. This only affects data compression with the -E48bit option (e.g., zstd).

In the Linux kernel's mac80211 subsystem, a vulnerability was found due to missing bounds checking of the link_id in ieee80211_ml_epcs. An attacker WiFi 7 AP can send a crafted EPCS Enable Response frame with link_id=15, causing an out-of-bounds read and kernel crash.

In the Linux kernel ALSA sequencer UMP subsystem, a use-after-free vulnerability exists during output teardown. Lack of synchronization between event processing and rawmidi connection closing can lead to access to already freed memory.

A vulnerability in the Linux kernel's network shaping mechanism (net: shaper) arises from non-atomic storage of the VALID flag relative to the XArray entry, causing a data race. This can lead to a use-after-free (UAF) during rollback operations.

A vulnerability in the Linux kernel's rxrpc mechanism causes pagecache corruption when locally transmitting DATA packets via splice(). The fix copies data to a temporary buffer before decryption in recvmsg().

In the Linux kernel, the gpio: aggregator driver has a use-after-free vulnerability. On error, dev_id in aggr->lookups was freed before removing the entry from the lookup table, allowing a concurrent thread calling gpiod_find() to access freed memory via strcmp().

A memory leak of dma_vec allocation was found in the Linux kernel's nvme-pci driver when using P2P memory. The allocation was not freed upon completion because P2P memory is not unmapped.

A use-after-free vulnerability was found in the Linux kernel's blk-mq mechanism. The issue occurs when a task sleeps after peeking a cached request but before popping it, leading to memory being freed and potential exploitation.

In the Linux kernel, a vulnerability was found in the key lookup mechanism where find_key_to_update() calls assoc_array_find() without holding the RCU read lock. This causes security issues, especially with persistent keys that use a different locking model than regular keys.

In the Linux kernel's usbtouchscreen driver, a vulnerability was found due to missing validation of data lengths from NEXIO devices. A malicious device can supply inflated header values, causing an out-of-bounds read beyond the allocated DMA buffer (up to 64 KiB) and potential kernel memory leak to userspace as touch events.

A use-after-free vulnerability was found in the Linux kernel's NFC LLCP stack in the llcp_sock_release() function. The issue occurs when a socket in the connecting state is removed from the wrong list, potentially leading to memory corruption.

A race condition in the Linux kernel's NFC LLCP stack during CC packet processing can cause a use-after-free of a socket when handled concurrently with socket release.

A vulnerability in the Linux kernel's xfrm_state_mtu function can cause an out-of-bounds write in the ESP component. An unprivileged attacker can install an IPv4 ESP tunnel with a large authentication key, small interface MTU, and large XFRMA_TFCPAD, triggering an arithmetic underflow that results in writing a massive amount of zeros to memory.

In the Linux kernel's rocket driver, a use-after-free (UAF) vulnerability was found due to a dangling GEM handle left after a failed buffer object creation. The bug occurs when rocket_ioctl_create_bo() creates a GEM handle before performing fallible operations, and on error frees the object without removing the handle from the IDR.

In the Linux kernel, a vulnerability was found in the SMC (Shared Memory Communications) module. The smc_init() function unnecessarily and dangerously re-initializes the smc_v*_hashinfo.ht hashtables, which can corrupt the hash list if entries already exist and are in use.

A vulnerability in the Linux kernel's locking mechanism for the .getsockopt function in AF_IUCV sockets was found. Missing proper locking allows a race condition between recvmsg() and getsockopt(SO_MSGSIZE), leading to a NULL pointer dereference and system crash.