CVE Vulnerability Catalog

In the Linux kernel, the cfg80211_rx_mlme_mgmt() and cfg80211_tx_mlme_mgmt() functions do not properly validate the length of management frames before accessing fields based on the subtype, which can lead to out-of-bounds reads. The patch adds frame-control length gating and validates the minimum frame size for each subtype.

In the Linux kernel, the wifi mac80211 subsystem may experience a race during IBSS disconnect in ieee80211_ibss_disconnect() where a TX to the driver occurs after carrier off and after telling the driver to leave the IBSS. In the case of iwlwifi, this leads to an attempt to use invalid queues.

In the Linux kernel, the wifi libipw subsystem's libipw_rx() reads skb->data[hdrlen + 3] to extract the WEP key index, but the existing guard only checks skb->len >= hdrlen + 3, which does not prove the byte at hdrlen + 3 exists. Requiring hdrlen + 4 bytes before reading is needed.

In the Linux kernel, the wifi rsi driver's rsi_prepare_beacon() copies the mac80211 beacon frame after FRAME_DESC_SZ into a management skb whose usable tailroom after alignment may be smaller than MAX_MGMT_PKT_SIZE. Missing validation of beacon length before copying can lead to buffer overflow.

In the Linux kernel, the SMB client's stack-allocated cifs_open_info_data structure may contain random data, which can cause fields to have incorrect values if they are not set later.

In the Linux kernel's btrfs subsystem, a use-after-free vulnerability exists related to relocation operations. When insert_dirty_subvol() fails, a root's reloc_root field remains pointing to a freed reloc root instead of being set to NULL, leading to a use-after-free or double free during filesystem unmount.

In the Linux kernel iwlwifi driver (mvm subsystem), the sta_id in the BA_WINDOW_STATUS_NOTIFICATION_ID notification is not validated before being used as an index into the fw_id_to_mac_id[] array, leading to potential out-of-bounds access.

In the Linux kernel btrfs filesystem, merge_reloc_roots() has an issue with reloc root cleanup: when a root has zero references, the reloc_root pointer is reset without memory barriers, and the BTRFS_ROOT_DEAD_RELOC_TREE flag is cleared incorrectly. The fix uses clear_reloc_root() to ensure proper synchronization.

In the Linux kernel iwlwifi driver (mvm subsystem), there is an off-by-one boundary check error. Before reading the 11th byte, the length is not checked to be sufficient, potentially leading to out-of-bounds read.

In the Linux kernel iwlwifi driver (pcie subsystem), after a failed TX init, the RX resources are freed but the pointers are not set to NULL. This can lead to use-after-free during later cleanup or retry.

In the Linux kernel blk-cgroup, the error path of blkg_create() has two issues: the online flag is set even when the blkg was not fully inserted, and blkg_put() is called instead of percpu_ref_kill(), leading to permanent memory leaks and preventing cgroup destruction.

In the Linux kernel SMB client, dirty data is not flushed before punching a hole. This can lead to the range being reported as data after the punch, which is incorrect.

In the Linux kernel iwlwifi driver (mvm subsystem), TX_CMD response parsing does not validate the response layout correctly. The minimum length check does not follow the runtime layout calculation, potentially leading to out-of-bounds read. For the new TX API, responses with frame_count != 1 are rejected.

In the Linux kernel iwlwifi driver (mvm subsystem), there is a possible underflow when processing the wowlan packet. The length of the packet is trusted from the firmware without proper validation, which could lead to incorrect calculations.

In the Linux kernel iwlwifi driver (mvm subsystem), the tid value from firmware is used as an index into tid_data[] without validation. Lack of bounds checking could lead to out-of-bounds access.

In the iwlwifi mvm driver, an incorrect indexing of the tid_data array was found — using the loop counter instead of the actual TID value. Currently it causes no harm, but a bounds check was added to prevent potential out-of-bounds access.

The iwlwifi firmware parser improperly checked aligned TLV length, potentially leading to length underflow with malformed data. Validation was added to avoid potential out-of-bounds reads.

In the iwlwifi ACPI function, a missing bounds check on the WGDS table revision before using it as a bit shift could cause undefined behavior with an invalid revision value.

In the Linux kernel CIFS (SMB1) module, cifs_filldir() copies directory entry names from an SMB response using a server-supplied length without checking that the name stays within the response buffer. A malicious SMB1 server returning an oversized FileNameLength causes memchr() to read past the end of the slab buffer.

The ksmbd SMB server could overwrite ACL masks inherited from the parent directory, leading to widened effective permissions during object creation. The fix preserves original masks.