CVE Vulnerability Catalog

In the Linux kernel, __get_vm_area_node() incorrectly triggers a BUG() when bottom halves (BH) are disabled, causing a kernel panic during normal bridge operations like FDB entry addition.

In the Linux kernel, a vulnerability in the HPFS filesystem causes a crash when hpfs_map_dnode_bitmap fails. The issue is calling hpfs_brelse4 on an uninitialized quad buffer head, leading to memory corruption.

In the Linux kernel, a vulnerability in memfd allows SEAL_WRITE to be implied via SEAL_EXEC before checking for existing writable mappings, breaking the write-seal contract. This enables an attacker to pass a memfd that appears write-sealed but remains modifiable.

A use-after-free vulnerability was found in the Linux kernel's zram subsystem in the zram_writeback_endio function. A race condition between the bio completion handler and the writeback task can cause a kernel crash.

In the Linux kernel, a vulnerability in try_to_unmap_one in mm/rmap fails to initialize nr_pages at the start of each loop iteration, allowing reuse of a stale value from a previous folio_unmap_pte_batch() call. This can corrupt folio refcount/mapcount when combining MAP_DROPPABLE, MADV_FREE, and HMM_DMIRROR_EXCLUSIVE, leading to a kernel crash.

In the Linux kernel, an out-of-bounds (OOB) read vulnerability exists in the auxdisplay line-display driver when writing zero bytes to the 'message' sysfs attribute. The linedisp_display() function reads msg[count - 1] before checking if count is zero, causing a read at msg[-1] which can lead to kernel panic on KASAN-enabled systems or silent adjacent data reads on stock kernels.

In the Linux kernel Bluetooth HIDP subsystem, missing length validation in hidp_input_report() allows an out-of-bounds read when a paired device sends a truncated packet. This can cause phantom key presses or spurious mouse movements.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's Bluetooth ISO stack in the iso_recv_frame function. It reads the socket pointer under a lock but uses it after releasing the lock, allowing a concurrent iso_sock_kill() to free the memory.

In the Linux kernel's Bluetooth ISO subsystem, a race condition was found in iso_sock_clear_timer(). The function reads the connection pointer without holding the socket lock, which can lead to a NULL pointer dereference or use-after-free (UAF) when the socket is being closed concurrently.

In the Linux kernel Bluetooth subsystem, a use-after-free (UAF) vulnerability was found in hci_le_create_cis_sync. The conn pointer is dereferenced after releasing RCU and hci_dev_lock locks, allowing a concurrent disconnect to free memory before read. The cancellation mechanism in hci_conn_del() fails because queue and dequeue data mismatch.

In the Linux kernel xpad driver, an out-of-bounds access vulnerability was found in the Share button handling. A controller can send a crafted GIP_CMD_INPUT packet shorter than 18 bytes, causing memory reads beyond the allocated buffer.

A race condition was found in the Linux kernel's parport subsystem between port and client registration. Ports are registered before full initialization, allowing clients like lp to attach to incomplete ports, causing system crashes.

A vulnerability was found in the Linux kernel's KVM for ARM64, related to incorrect capping of the ZCR_EL2 register by a guest hypervisor. The issue occurs when the guest updates ZCR_EL2 via ZCR_EL1 without proper sanitization, allowing L2 guests to access unauthorized vector lengths (VL).

In the Linux kernel, a vulnerability was found in the KVM SEV component due to missing READ_ONCE() when reading entries/indices from the guest-accessible Page State Change (PSC) buffer. This allows a TOCTOU (Time-of-Check Time-of-Use) attack by a malicious guest.

In the Linux kernel driver for the ITG3200 gyroscope, a bug in itg3200_read_all_channels() passes the address of a local pointer instead of the caller's buffer to i2c_transfer(). This causes sensor data to be written to the stack and lost, while uninitialized stack contents are pushed to userspace via /dev/iio:deviceX.

A use-after-free vulnerability was found in the Linux kernel's IIO hardware consumer error path. The list_for_each_entry() macro accesses freed memory after iio_buffer_put() releases a buffer during cleanup in iio_hw_consumer_alloc().

A vulnerability in the Linux kernel's USB serial omninet driver can cause memory corruption when a malicious device reports a smaller endpoint max packet size than expected, leading to controlled slab corruption.

In the Linux kernel, a use-after-free vulnerability was found in the USB dwc2 driver's debug code. The issue occurs because the 'urb' structure is dereferenced after calling usb_hcd_giveback_urb(), which is not allowed.

In the Linux kernel, a bug was found in the BPF sockmap's bpf_msg_push_data() function. When inserting data into a scatterlist entry, the right fragment offset was incorrectly advanced by the global insertion point instead of the local offset within the entry, causing split layout inconsistency.

In the Linux kernel's macsec module, a vulnerability bypasses replay protection at XPN lower-PN wrap. When PN reaches 0xFFFFFFFF, incrementing overflows to 0, failing to update next_pn_halves, allowing an attacker to replay a captured frame indefinitely.