CVE Vulnerability Catalog

In the Linux kernel, in Bluetooth hci_conn, the SCO setup context is allocated with a NULL destroy callback, leading to memory leaks when an entry is cancelled. Additionally, the context stores a bare hci_conn pointer, potentially leading to use-after-free. The fix holds the connection and releases it from a destroy callback.

In the Linux kernel, in Bluetooth hci_sync, the advertising instance allocated in adv_timeout_expire() is not freed on error or cancellation paths, leading to memory leaks. The fix frees the buffer from a destroy callback and in the caller when the entry could not be queued.

In the Linux kernel, in Bluetooth MGMT, the mesh_send_cancel() command is queued with a NULL destroy callback, leading to memory leaks when the entry is cancelled. The leak also pins the socket reference, so the MGMT socket is never released. The fix frees the command from a destroy callback.

In the Linux kernel's Bluetooth MGMT subsystem, there is a memory leak when an HCI command is cancelled. The command is not freed, leading to memory leak and holding a reference to the mgmt socket that is never released.

In the Linux kernel's Bluetooth subsystem (MSFT), the length of the event prefix (evt_prefix_len) is not validated against the actual response length. A controller can declare a length up to 255 bytes, and the kernel will copy data beyond the response, leading to reading unauthorized data.

In the Linux kernel's BPF and cgroup subsystem, there is a null-ptr-deref bug after replacing a program. When program A (empty) is replaced by program B using BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE, the required storage is not allocated, leading to a panic when the new program is kicked.

In the Linux kernel's iio: light: gp2ap002 driver, there is unbalanced runtime PM management on repeated event writes. Double enabling leaks a runtime PM reference, and double disabling underflows the usage count and triggers a warning.

A bug was fixed in the Linux kernel's net/sched cls_api regarding teardown of an adopted proto when losing an insert race. When a request loses the race in tcf_chain_tp_insert_unique(), tp_created was not cleared, causing the error path to delete an active classifier belonging to the winning request. A tri-state variable was introduced to track the insert step outcome.

In the Linux kernel's BPF subsystem, there is a mmap_lock leak in the irq_work path. A nested caller can reuse the slot before the first caller queues it, leading to double locking of mmap_lock and a lock leak, blocking exit_mmap().

In the Linux kernel, a vulnerability in AppArmor's verify_tags() function allows an integer overflow in the bounds check, enabling an out-of-bounds read when loading a crafted policy. The issue is reachable by an unprivileged user in a nested user namespace if unprivileged_userns_apparmor_policy=1 is enabled.

In the Linux kernel's fbdev: kyro driver, there is a lack of validation of overlay viewport coordinates. Large input values can cause 32-bit arithmetic wraparound, leading to incorrect coordinates passed to SetOverlayViewPort().

A locking issue exists in the Linux kernel's iommu/dma subsystem around the msi_page_list. When multiple devices assigned to a VM via the legacy VFIO type1 container share the same IOMMU domain (e.g. ARM SMMU with IOMMU_RESV_SW_MSI), concurrent calls to iommu_dma_get_msi_page() can corrupt that list. The fix restores the static msi_prepare_lock.

In the Linux kernel's iommu/vt-d subsystem, there is an issue with clearing the Present bit before tearing down a copied context entry. Zeroing the entry while Present is still set leaves a window where hardware can fetch a torn entry, leading to unpredictable behavior or spurious faults.

In the Linux kernel's iommu/vt-d subsystem, there is an iopf_refcount leak when replacing a domain at the RID level. The functions identity_domain_attach_dev() and blocking_domain_attach_dev() do not disable IOPF for the old domain, leading to a reference leak. As a result, the count never drops to zero, triggering a WARN_ON when the device is released.

In the Linux kernel's iommu/vt-d subsystem, on device probe failure, scalable-mode context entries are not torn down before freeing the PASID table. This can lead to the IOMMU referencing freed memory. The fix performs teardown before freeing the table, similar to the device release path.

In the Linux kernel's iommu/vt-d subsystem, during DMA alias teardown, the function intel_context_flush_no_pasid() uses an incorrect SID (always the device's requester ID instead of the alias). This causes context cache entries for aliases not to be invalidated, potentially leading to the IOMMU using freed memory.

In the Linux kernel's media: amd: isp4 driver, the function isp4if_alloc_fw_gpumem() does not release previously allocated GPU memory pools when a subsequent allocation fails. This causes a memory leak. The fix releases already-allocated pools before returning an error.

In the Linux kernel's media: amd: isp4 driver, the function isp4sd_pwron_and_init() causes a deadlock in the error path by re-acquiring the ops_mutex it already holds. The fix changes error handling to release resources in stages, avoiding the deadlock and other issues like runtime-PM underflow.

A vulnerability was fixed in the Linux kernel's netfilter nft_ct module related to custom expectation support. The previous implementation could corrupt the expectations list through stale pointers after conntrack extension reallocation. The fix moves expectation handling to an internal conntrack helper and introduces the nf_conntrack_helper_release() function.

A bug was found in the Linux kernel NFSD (NFS server) module where the export reference (svc_export) was leaked when reaping open and lock stateids. The free_ol_stateid_reaplist() function freed stateids directly via ->sc_free(), bypassing the nfs4_put_stid() path that releases the export reference. As a result, the reference was never dropped, pinning the export and blocking unmount for the lifetime of the stateid.