CVE Vulnerability Catalog

In the Linux kernel, a vulnerability in the mxuport USB serial driver can cause slab memory corruption when a malicious device reports a too small bulk-out endpoint max packet size. The fix ensures the packet size is at least eight bytes.

In the Linux kernel's mct_u232 driver, a vulnerability causes memory corruption when a USB device reports a smaller bulk-out endpoint max packet size than expected (32 bytes). The driver overrides the maximum transfer size, potentially leading to slab corruption.

In the Linux kernel, a use-after-free vulnerability exists in the USB gadget f_fs subsystem. The ffs_epfile_dmabuf_io_complete() function frees a USB request without clearing the priv->req pointer, leading to usb_ep_dequeue() being called on freed memory. The fix moves the deallocation to ffs_dmabuf_cleanup() with proper locking.

In the Linux kernel Thunderbolt driver, a vulnerability was found where a 32-bit sum wraps during property entry validation. A malicious XDomain peer can exploit this to read memory beyond the allocated block, leading to data leakage.

A vulnerability in the Linux kernel's SCSI Fibre Channel (FC) transport subsystem allows an attacker with FC fabric access to send a crafted FPIN ELS frame, causing an infinite loop in the FC transport driver and resulting in a denial of service (DoS). The issue stems from using an 8-bit counter for a 32-bit pname_count field, which wraps at 256 and keeps the loop condition true indefinitely.

In the Linux kernel, a race condition in the DRM GEM driver between change_handle and handle_delete operations was fixed. During the window between releasing and re-acquiring the IDR table lock, a concurrent delete of the old handle could decrement the reference count to zero and free the GEM object while the new handle still references it in the IDR.

In the Linux kernel i915 driver, a use-after-free (UAF) vulnerability was found during TTM object purge. The issue arises because the bo->ttm pointer may be changed by ttm_bo_validate(), leading to dereference of an invalid object and general protection faults.

A race condition in the Linux kernel's qcom_geni serial driver causes a kfifo underflow when uart_flush_buffer() runs before the DMA completion IRQ. This results in stale buffer data being transmitted on the next DMA transfer.

In the Linux kernel, the amdkfd driver has an integer overflow vulnerability in the get_queue_ids() function. The array size calculation as num_queues * sizeof(uint32_t) can overflow on 32-bit systems, leading to potential security issues.

In the Linux kernel, a bug in the amdgpu_hmm_range_get_pages function of the amdgpu driver was fixed. The notifier sequence was read multiple times, which could lead to working with invalid pages. The coding style was also improved by removing the pre-initialized return value and using the common define for the 2G range.

In the Linux kernel for ARM64 architecture, a vulnerability was found in the TLB walk cache invalidation mechanism. The tlb_flush() function did not check the unshared_tables flag, causing the wrong instruction (VALE1IS instead of VAE1IS) to be used after PMD table unsharing (huge_pmd_unshare), leaving stale non-leaf entries in the walk cache. This could lead to incorrect page table walks.

A race condition was found in the Linux kernel's MCTP USB driver between URB completion and cancellation of the rx_retry work. This can cause a URB to be submitted after the network interface has been stopped.

A vulnerability was found in the Linux kernel's 6LoWPAN stack for IEEE 802.15.4 networks. The lowpan_xmit() function accepts non-IPv6 packets (e.g., ETH_P_AOE), leading to the use of uninitialized data in the lowpan_addr_info structure. An attacker could exploit this for potential information disclosure or system instability.

In the Linux kernel's mac80211 subsystem, a vulnerability was found where the antenna index from the radiotap header is used directly as a shift count in a bit operation. This can cause undefined behavior reported by UBSAN.

In the Linux kernel MPTCP subsystem, a TOCTOU (time-of-check time-of-use) race condition was found while computing the receive window (rcv_wnd). The MPTCP output path reads the acknowledgment sequence (ack_seq) without locking, which may cause inconsistencies between the data_ack value in the DSS option and the calculated receive window in the same packet.

In the Linux kernel, a vulnerability in the mt76 driver for mt7996 chipsets was found where the WCID pointer is not cleared when removing a station link in mt7996_mac_sta_deinit_link(), potentially leading to a use-after-free condition.

In the Linux kernel, two LSM hooks (task_to_inode and inet_conn_established) have been removed from the list of hooks usable by sleepable BPF programs. The bpf_lsm_task_to_inode() hook is called under rcu_read_lock(), and bpf_lsm_inet_conn_established() is called from softirq context, making them unsafe for sleepable programs.

In the Linux kernel, a vulnerability in the BPF subsystem was found where the return value of visit_tailcall_insn() is not checked. This could lead to undefined behavior.

In the Linux kernel drm/gpusvm driver, an unbalanced unlock of the notifier lock was found in drm_gpusvm_scan_mm(). The first jump to the err_free label occurs before calling drm_gpusvm_notifier_lock(), causing an attempt to release a lock that was not acquired.

In the Linux kernel, a vulnerability in the RDMA/core subsystem was found related to NLA_STRING attributes that do not check for a null terminator. This can lead to incorrect string comparison and potential security issues.