CVE Vulnerability Catalog

A vulnerability in the Linux kernel's dm-cache SMQ policy was found. Missing synchronization of the allocation flag check (e->allocated) outside the mq->lock allows a race condition between concurrent invalidation operations, potentially corrupting queue or hash table structures.

A race condition was found in the Linux kernel between NEWTFILTER and DELFILTER operations in the net/sched/act_api subsystem. Concurrent execution could cause a use-after-free (UAF) of the tc_action structure because memory was freed immediately without RCU deferral. The patch restores deferred freeing via call_rcu(), eliminating the vulnerability.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's L2TP PPPoL2TP driver. The pppol2tp_ioctl() function accessed the session pointer without proper locking or reference counting, allowing a race condition during copy_from_user(). The fix securely fetches the session reference using an RCU-safe, refcounted helper.

A use-after-free vulnerability was found in the Linux kernel's IPv6 anycast implementation, where an anycast address (aca) could be inserted into the global hash after the device teardown had already removed it from the interface list, leading to a dangling pointer. The fix moves the hash insertion under the idev->lock to ensure atomicity with device removal.

A use-after-free vulnerability was found in the Linux kernel's Bluetooth RFCOMM subsystem in the rfcomm_connect_ind() function. The issue stems from missing reference counting on the listening socket after leaving the rfcomm_sk_list lock, allowing a race condition with socket closure and potential exploitation.

In the Linux kernel Bluetooth stack, an out-of-bounds read vulnerability was found in tlv_data_is_valid(). A malformed MGMT_OP_ADD_ADVERTISING request can cause reading one byte past the allocated buffer, as reported by KASAN.

In the Linux kernel, a vulnerability in Bluetooth RFCOMM MCC handlers fails to validate skb length before accessing data. A remote attacker can send truncated MCC frames, triggering out-of-bounds reads.

A vulnerability was found in the Linux kernel's Bluetooth BNEP subsystem due to missing frame length validation before parsing. A remote attacker can send a short BNEP SDU frame, causing a slab-out-of-bounds read and potentially system instability.

A TOCTOU vulnerability was found in the Linux kernel's xsk_skb_metadata() function related to TX metadata processing in the XSK mechanism. A malicious userspace application can race to overwrite csum_start and csum_offset values between two reads, bypassing bounds validation and causing out-of-bounds memory access during checksum computation.

In the Linux kernel's airoha network driver, a use-after-free vulnerability was found in metadata dst teardown. The metadata_dst_free() function freed memory directly via kfree(), bypassing the RCU grace period, allowing access to freed memory through noref pointers in the RX path.

In the Linux kernel, a vulnerability in nfsd4_create_file() can cause a failure to release a lock on the parent directory due to improper error handling from dentry_create(). This occurs when an exported filesystem uses atomic_create() and returns an error.

A vulnerability was found in the Linux kernel's ALSA PCM driver, where snd_pcm_drain() can corrupt wait queues when handling linked streams. The bug stems from improper wait entry management, potentially leading to a NULL pointer dereference and kernel panic.

A use-after-free vulnerability was found in the Linux kernel's xfrm IPsec module in the __input_process_payload function. The issue occurs when first_skb is stored in xtfs->ra_newskb without a lock, allowing another thread to free it, leading to use-after-free.

A use-after-free vulnerability was found in the Linux kernel's XFRM policy mechanism. The bug occurs in xfrm_policy_bysel_ctx() when deleting a policy, as the xfrm_policy_lock is released before pruning the inexact bin, leading to a race condition and use of freed memory.

A vulnerability was found in the Linux kernel's skb_gro_receive_list() function, which calls skb_pull() without first ensuring data is in the linear area via pskb_may_pull(). For packets arriving via napi_gro_frags(), this can trigger a BUG_ON assertion failure and system crash.

A use-after-free vulnerability was found in the IBM EMAC network driver for the Linux kernel during device removal. Using devm_register_netdev() caused delayed unregister_netdev(), leading to access to freed hardware resources by interrupt handlers.

A double-free vulnerability was found in the Linux kernel's netdev_nl_bind_rx_doit() function. The error path incorrectly calls nlmsg_free(rsp) after genlmsg_reply() has already consumed the skb, causing a double-free. The fix propagates the error to the user instead of attempting to unbind.

In the Linux kernel, a vulnerability was found where sfp_bus_del_upstream() is not called in the probe failure path of the PHY driver. This leaves a dangling 'upstream' pointer in the sfp-bus structure, which may be later used during SFP events.

In the Linux kernel, a slab-out-of-bounds vulnerability was found in the mlx5 driver's mlx5_query_nic_vport_mac_list function. The firmware command buffer is sized based on PF capabilities, but querying a VF with a larger configuration causes the response to overflow the buffer.

In the mlx5e driver for Mellanox network cards, a DMA memory and XDP frame leak was discovered. When sending an XDP_TX packet in XSK mode, if the hardware queue is full, the function does not free the allocated frame or unmap the DMA address, leading to resource leakage.