CVE Vulnerability Catalog

A vulnerability in the Linux kernel's timestamp cmsg handling for AF_PACKET sockets was found. The incorrect assumption that the PACKET_OUTGOING flag uniquely identifies error queue packets allows reading AF_PACKET control buffer state as sock_exterr_skb, potentially leading to memory disclosure or kernel panic.

In the Linux kernel, the mvpp2 driver had a DMA synchronization bug for received packets. The CPU sync function started at an incorrect offset, missing data at the packet tail and syncing unused headroom. On non-coherent DMA systems, this can cause the CPU to read stale cache contents.

A use-after-free vulnerability was found in the Linux kernel's nft_tunnel module. The nft_tunnel_obj_destroy() function calls metadata_dst_free() which directly frees the metadata_dst memory, ignoring the dst_entry refcount. Packets that hold a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g., in a netem qdisc) are left with a dangling pointer, leading to use-after-free when dequeued.

A vulnerability was found in the Linux kernel's Bluetooth stack where hci_adv_bcast_annoucement() can cause a temporary buffer overflow when preparing Broadcast Announcement data. The issue occurs when existing advertising instances already hold the maximum extended advertising payload, and prepending service data exceeds the buffer capacity.

In the Linux kernel, the accel/ivpu driver now validates firmware log buffer read/write indices against buffer size. Missing bounds checks could allow out-of-bounds memory access when firmware supplies invalid indices.

In the Linux kernel, a buffer overflow check was added in the accel/ivpu driver's get_info_ioctl function. Missing validation of the size returned by firmware could lead to copying data beyond the allocated buffer.

In the Linux kernel, the accel/ivpu driver has a vulnerability due to signed integer truncation in the IPC receive function. Large unsigned values (>= 0x80000000) supplied by firmware are cast to signed int, causing negative values and subsequent stack buffer overflow during memcpy.

In the Linux kernel, an optimization that skipped exec queue schedule toggle during suspend was reverted because it bypassed GuC suspend, preventing context switch TLB flush for invalidated userptr VMAs. This caused page faults in userptr invalidation tests in LR/preempt-fence VM mode.

A vulnerability was found in the Linux kernel's KVM for ARM64, affecting the handling of the XN[0] bit when FEAT_XNX is not supported. The bug incorrectly uses FIELD_PREP() on the mask that clears XN[0], unconditionally granting execute permissions.

In the Linux kernel, the hv_netvsc driver used phys_to_virt() for mapping memory pages, which on 32-bit x86 with CONFIG_HIGHMEM=y causes memory access faults and system crashes. The fix replaces phys_to_virt() with kmap_local_page() to correctly handle pages outside the kernel direct map.

In the Linux kernel, a use-after-free vulnerability was found in ksmbd related to a deferred file_lock during double SMB2_CANCEL. A second cancel for the same AsyncId triggers the cancel callback on already freed memory, leading to a security breach.

In the Linux kernel, a vulnerability in the USB serial io_ti driver was found where build_i2c_fw_hdr() allocates a fixed-size buffer but copies user-controlled length data (up to 65535 bytes) without validation, causing a heap overflow.

In the Linux kernel's kl5kusb105 USB serial driver, a bulk-out buffer overflow vulnerability was found. The klsi_105_prepare_write_buffer() function copies data from the fifo into a 64-byte buffer without accounting for the two-byte header, causing an out-of-bounds write.

In the Linux kernel, a use-after-free vulnerability was found in the ALSA timer subsystem. When a timer object is freed via snd_timer_free, slave timer instances still point to the freed object, leading to potential memory corruption. The bug is easily triggered with the new userspace-driven timers (CONFIG_SND_UTIMER).

A use-after-free (UAF) vulnerability was found in the snd_timer_user_params() function of the ALSA driver in the Linux kernel. The issue occurs when a user timer (CONFIG_SND_UTIMER) is being closed while another thread concurrently executes the SNDRV_TIMER_IOCTL_PARAMS ioctl, which was not protected by the register_mutex. The patch adds the missing synchronization to prevent the race condition.

In the Linux kernel's io_uring/net subsystem, a vulnerability was found due to improper inheritance of the IORING_CQE_F_BUF_MORE flag during bundle recv retries. The flag was missing from the CQE_F_MASK, causing it to be dropped and leading to incorrect buffer management by userspace.

In the Linux kernel, a vulnerability was found in __split_huge_pmd_locked() where the file/shmem RSS counter was updated after dropping the folio reference. If folio_put() released the last reference, subsequent reads of folio state by mm_counter_file() could access freed memory.

In the Linux kernel RDMA/core component, a vulnerability was found due to missing validation of the file operations structure (fops) in the ib_get_ucaps() function. An attacker can use a block device with the same device number (dev_t) to impersonate a legitimate ucap cdev device.

In the Linux kernel RDMA/core subsystem, the cpu_id attribute from user space is passed to cpumask_test_cpu() without validation, potentially causing an out-of-bounds read of the CPU bitmap. With CONFIG_DEBUG_PER_CPU_MAPS and panic_on_warn enabled, this can lead to a system reboot.

A use-after-free vulnerability was found in the zram_bvec_write_partial() function of the Linux kernel's zram driver. During partial page writes, the read from the backing device is performed asynchronously, and the page buffer is freed before the read completes, leading to a write into freed memory.