CVE Vulnerability Catalog

A use-after-free vulnerability was found in the Linux kernel's hdlc_ppp driver. PPP protocol timers (LCP/IPCP/IPV6CP) were not synchronized before freeing the HDLC state structure, allowing code execution in freed memory.

A use-after-free vulnerability was found in the Linux kernel's __blkcg_rstat_flush() function in the blk-cgroup subsystem. It occurs when multiple blkgs in the same blkcg are released concurrently, causing a race condition and access to freed memory.

In the Linux kernel, a use-after-free vulnerability exists in the TIPC module's tipc_aead_decrypt_done function. Missing netns reference protection before asynchronous decryption can lead to reading freed memory after network namespace teardown.

A vulnerability in the Linux kernel's CID (Concurrency ID) mechanism in the scheduler causes an out-of-bounds (OOB) clear_bit operation when CID is MM_CID_UNSET, leading to kernel memory corruption.

Vulnerability in the rpmsg_char driver in the Linux kernel causes a use-after-free during error handling in rpmsg_chrdev_probe(). Incorrect initialization order may lead to a callback with a stale pointer.

In the Linux kernel OCFS2 filesystem, a vulnerability was found due to missing validation of the physical bitmap size in group block descriptors. A malicious descriptor can claim a bitmap size exceeding the available block space, leading to an out-of-bounds read (use-after-free) during bitmap scanning.

In the Linux kernel, a vulnerability was found in the sev_dbg_crypt() function in KVM for AMD SVM, where during encryption (ENCRYPT path) the transfer length is not bounded by the destination page offset (d_off). When d_off > s_off, the intermediate buffer (dst_tpage) of 4096 bytes can be written out of bounds, leading to page overflow and potential memory corruption.

A vulnerability was found in the Linux kernel's NTFS filesystem due to missing synchronization of volume label accesses. A race condition between setting and reading the label can lead to a use-after-free condition.

In the Linux kernel's fbdev/fbcon driver, the fbcon_do_set_font() function on error (e.g., memory allocation) fails to restore hi_font_mask and screen buffer. This causes terminal desynchronization and an out-of-bounds read of the font array, potentially disclosing kernel memory.

A use-after-free vulnerability was found in the Linux kernel's fbdev omap2 driver. The omapfb_mmap() function has a race condition with the OMAPFB_SETUP_PLANE ioctl, allowing concurrent memory mapping and freeing, leading to use-after-free.

In the Linux kernel's I2C subsystem, there is a race condition during adapter registration. The adapter can be looked up via i2c_get_adapter() before its struct device is fully initialized, leading to access to uninitialized data and potential NULL-pointer dereference or use-after-free.

A memory leak was discovered in the Linux kernel's NFS server (nfsd) during SETACL decode failure handling. The decoder calls nfs_stream_decode_acl() twice for access and default ACLs, but if the second call fails, the first allocated posix_acl is not freed. The fix adds dedicated release functions (nfsaclsvc_release_setacl and nfs3svc_release_setacl) that properly clean both ACL fields.

In the Linux kernel, the nfsd4_create_file() function in the NFSD server has two vulnerabilities: a posix_acl memory leak and ignored errors during NFSv4-to-POSIX ACL conversion. These bugs can cause memory exhaustion and violate RFC 7530/8881.

In the Linux kernel NFSD subsystem, a dead ACL conflict guard in nfsd4_create() checked nulled pointers instead of stolen values, causing memory leak of posix_acl objects when both ACL and POSIX ACL attributes are requested in the same CREATE operation.

In the Linux kernel NFSD module, a memory leak was found related to pre-allocated openowner structures. The issue occurs in find_or_alloc_open_stateowner() during a race condition with unconfirmed open owners in NFSv4.0.

In the Linux kernel, the NFSv4/flexfiles driver lacks validation for a zero filehandle version count. An attacker can supply a malformed flexfiles layout, causing a NULL pointer dereference and kernel panic.

A vulnerability in the Linux kernel's nfs4_decode_mp_ds_addr() function in NFSv4/pNFS fails to properly handle zero-length r_addr fields in GETDEVICEINFO responses, leading to a NULL pointer dereference and kernel panic. An attacker can exploit this via a malicious or compromised metadata server.

In the Linux kernel's ksmbd filesystem, an out-of-bounds read vulnerability was found in smb_check_perm_dacl(). Missing ACE size validation before reading SID sub-authorities allows an authenticated client on a share using ACL xattrs to trigger a heap out-of-bounds read past the allocated buffer.

A use-after-free vulnerability was found in the Linux kernel's TCP-AO implementation. In the del_async path of key deletion, the current_key and rnext_key pointers are not cleared, causing a reference to freed memory after the RCU grace period.

In the Linux kernel FUSE subsystem, a vulnerability was found due to missing re-locking of the request after successful fuse_try_move_folio(). This can lead to a use-after-free issue when accessing the fuse_io_args structure.