CVE Vulnerability Catalog

In the Linux kernel, the octeontx2-af driver has a vulnerability allowing out-of-bounds memory write. The rvu_mbox_handler_rep_event_notify function does not validate the pcifunc field in the request, enabling an attacker to write past the allocated PF/VF structure array.

In the Linux kernel VTI (Virtual Tunnel Interface) driver for IPv6, a vulnerability allows an unprivileged user in a network namespace to hijack a VTI tunnel from another namespace. The issue stems from using dev_net(dev) instead of t->net in the tunnel lookup within vti6_siocdevprivate(), enabling hash table manipulation after tunnel migration.

In the Linux kernel, a vulnerability in IPv6 extension header handling allows an unprivileged user to trigger a slab-out-of-bounds read via nftables payload-write, as the header length is not re-validated before copying to cmsg.

A vulnerability was found in the Linux kernel's xfrm module related to transport-mode packet processing. During deferred transport reinjection, a pointer to the network namespace (netns) stored in skb->cb may become invalid if the namespace is removed before the callback executes.

In the Linux kernel's L2TP module, a vulnerability was found where l2tp_session_get_by_ifname() uses plain refcount_inc() instead of refcount_inc_not_zero(). This can cause a race condition returning a pointer to a session with a zero reference count, leading to a use-after-free.

A vulnerability in the Linux kernel's VTI6 (Virtual Tunnel Interface for IPv6) driver was found. After moving a VTI6 interface between network namespaces (netns), the vti6_changelink() and vti6_update() functions use a stale network reference (dev_net instead of t->net), leaving a stale entry in the original namespace's hash table. This causes a kernel BUG when cleaning up that namespace, allowing an attacker in an unprivileged container to crash the system.

A vulnerability was found in the Linux kernel's HID driver for Wacom tablets. The wacom_hid_set_device_mode() function assumes that the HID_DG_INPUTMODE usage is always in the first field of the report, which can lead to an out-of-bounds (OOB) write if the usage is located in a different field.

In the Linux kernel, an out-of-bounds read vulnerability exists in the NFC HCI stack within nfc_hci_recv_from_llc() and nci_hci_data_received_cb(). A malicious NFC peer can send a zero-length HCP frame, causing an out-of-bounds heap read and potentially a skb_over_panic during reassembly.

In the Linux kernel, a vulnerability was found in the XFRM (IPsec) migration mechanism. Functions sending migration notifications (xfrm_send_migrate and pfkey_send_migrate) incorrectly routed them to the default network namespace (init_net) instead of the caller's namespace. This caused IKE daemons in other namespaces to never receive their own migration notifications, while daemons in init_net received notifications from all namespaces.

A vulnerability in the Linux kernel's netfilter conntrack TCP module allows an RST packet with an invalid sequence number to force a connection into the CLOSE state without proper direction validation. This can prematurely terminate active NAT entries.

In the Linux kernel, the xfrm iptfs module has a vulnerability due to improper cloning of runtime state when copying Security Associations (SAs). The iptfs_clone_state() function copies runtime objects such as skb queues, timers, and spinlocks that should not be shared with the original SA, leading to use-after-free and double-free memory issues.

A use-after-free (UAF) vulnerability was found in the Linux kernel's dma_buf_fd() function related to a tracepoint. After FD_ADD() returns, the file descriptor becomes live in the descriptor table, allowing another thread to close it before DMA_BUF_TRACE() executes, causing a use-after-free of the dma_buf structure.

In the Linux kernel's ksmbd filesystem, a regression causes an out-of-bounds (OOB) read in the ACE-walk loop of smb_check_perm_dacl(). The flaw stems from a transposed bounds check that never breaks the loop, allowing a 2-byte heap OOB read past the allocated pntsd buffer during SMB2_CREATE operations.

In the Linux kernel UIO driver, a double free of devm_kzalloc() memory was found. The probe() and remove() functions explicitly call kfree() on a structure that is automatically freed by the devres mechanism, causing a double free.

A use-after-free vulnerability was found in the Linux kernel's USB MUSB driver for the OMAP2430 platform. The omap2430_probe() function calls of_node_put(np) before the last access to the node, potentially leading to use of freed memory.

A use-after-free vulnerability was found in the Linux kernel's USB/IP vudc driver. During device removal (vudc_remove), a race condition can cause the timer to still be active while the vudc structure is freed, leading to access to freed memory.

In the Linux kernel, a vulnerability in the USB USBTMC driver fails to check the actual_length of URB data for interrupt-IN notifications. This can lead to out-of-bounds reads or use of stale data.

In the Linux kernel's belkin_sa USB serial driver, the interrupt callback lacks validation of the received data length. Short interrupt packets can cause out-of-bounds reads (slab-out-of-bounds) when parsing LSR/MSR status fields.

In the Linux kernel's cypress_m8 USB serial driver, a vulnerability allows out-of-bounds read due to missing validation of interrupt packet headers. The cypress_read_int_callback() function did not check if the received packet contains the required header before reading it, which can lead to out-of-bounds memory access on short transfers.

A vulnerability in the Linux kernel's USB digi_acceleport driver can cause memory corruption due to missing bulk-out buffer size validation. A malicious USB device could report smaller buffers than expected, leading to out-of-bounds memory access or slab corruption.