CVE Vulnerability Catalog

In the Linux kernel's TTY subsystem, a vulnerability exists where TTY device registration can fail before a cdev is allocated. The serial core keeps the port, so setserial can still use it, and later removal passes a NULL cdev pointer to cdev_del(), causing a NULL-pointer dereference.

In the Linux kernel's tty_cdev_add(), on cdev_add() failure, the cdev reference is dropped but driver->cdevs[index] remains pointing to freed memory. Later tty_unregister_device() passes that stale pointer to cdev_del(), causing a use-after-free.

In the Linux kernel's dm-integrity module, a vulnerability exists where a block tag of all 0xf6 bytes (DISCARD_FILLER) is treated as proof of discard and skips HMAC verification. An attacker with raw write access to the backing device, but without the integrity key, can stamp any block with such a tag and have it served as authentic.

In the Linux kernel's PCI dwc ep driver, a vulnerability exists where the MSI path lacks a flush equivalent to the MSI-X path before unmapping the iATU entry. This can cause posted MSI writes to be dropped or misrouted when the iATU entry is unmapped.

In the Linux kernel's HID driver for ASUS devices, multiple issues exist: unchecked size in asus_raw_event(), unclean teardown in asus_probe on failure, possible use-after-free in asus_probe, multiple workqueues used where one sufficed, sleeping calls in atomic context, and packets of incorrect size sent to the keyboard controller.

In the Linux kernel's Logitech HID++ driver, a vulnerability exists where in hidpp_ff_init(), if allocations of private data, effect ID array, or workqueue fail after input_ff_create() succeeds, the function returns an error without destroying the FF device, leading to resource leaks.

In the Linux kernel's HID subsystem, a vulnerability exists where hid_device_io_start() allows reports to run concurrently with probe. If probe subsequently fails, __hid_device_probe() releases driver resources and clears hdev->driver without excluding those report callbacks, leading to use-after-free, e.g., in hidraw_report_event().

In the Linux kernel, the HID driver for the Steam Controller (HID: steam) trusted the message size reported within the FEATURE report itself instead of verifying the actual read length. This led to a potential issue with short reads.

In the Linux kernel, the pep_getsockopt() function in the phonet module clamped the reported length to the caller's buffer using min_t(), but then stored the value with put_user(), which always writes sizeof(int) bytes. A getsockopt() call with an optlen smaller than sizeof(int) thus reported the clamped length yet wrote a full int, one to three bytes past the user buffer.

In the Linux kernel, blk-cgroup has a race between policy activation and blkg destruction. When switching an IO scheduler, blkcg_activate_policy() may race with concurrent blkcg deletion, leading to use-after-free and memory leak issues. Additionally, blkg_free_workfn() frees pd before removing the blkg from q->blkg_list, allowing allocation of a new pd for a blkg being destroyed.

In the Linux kernel, blk-cgroup's blkcg_activate_policy() can race with concurrent blkcg deletion when switching IO schedulers, leading to a use-after-free in rcu_accelerate_cbs. The issue occurs when a blkg is being destroyed while blkcg_activate_policy() tries to get a reference to it.

In the Linux kernel, the ublk module's import_ubuf() can fail if the address range provided by the userspace ublk server is outside the allowed user address space. In that case, an uninitialized struct iov_iter is passed to ublk_copy_user_pages().

In the Linux kernel, the ublk module with UBLK_F_AUTO_BUF_REG can fail on invalid sqe->addr after ublk_fill_io_cmd() has set UBLK_IO_FLAG_ACTIVE. The uring_cmd is completed while the tag stays active, which can hang teardown.

In the Linux kernel, the ocfs2/cluster module has a bug in local node state management. When local=0 clears the live local-node state but leaves cl_has_local set, o2nm_this_node() returns invalid node number 255, causing a KASAN slab-out-of-bounds in o2hb_do_disk_heartbeat().

In the Linux kernel, a vulnerability in the OCFS2 filesystem was found due to missing validation of inline extended attribute (xattr) bounds in the inode block. Corrupted metadata can lead to out-of-bounds memory access (use-after-free) during getxattr() or listxattr() calls.

In the Linux kernel, the ocfs2 filesystem's ocfs2_validate_xattr_block() checks the xattr block header but does not verify that a non-indexed block's xh_count and entry offsets fit inside the block. Indexed buckets likewise reach list/get consumers without an entry-bounds check, leading to use-after-free in ocfs2_xattr_list_entries().

In the Linux kernel, the rapidio subsystem's rio_alloc_net() stores the newly allocated rio_net in mport->net before rio_scan_alloc_net() registers the device. If rio_add_net() fails, put_device() releases the rio_net, but mport->net is left pointing at the freed object, potentially leading to double free.

In the Linux kernel, fat_rebuild_parent() uses a directory entry to rebuild the parent inode but fails to release sinfo.bh after a successful scan. This causes a buffer head leak in the nostale_ro NFS export path.

In the Linux kernel, in sleepable BPF programs a spin lock can be the only RCU protection for a kptr. After the final bpf_spin_unlock() the verifier leaves the pointer valid, allowing another CPU to free the object before use, causing a use-after-free (e.g. in __bpf_get_task_stack()).

In the Linux kernel, the drm/omap DSI driver copied the ISR table to allow unregistering interrupt handlers. Since stack-allocated objects are passed to these ISRs, there is a use-after-free risk if IRQs are unregistered while being handled.