CVE Vulnerability Catalog

In the Linux kernel, an nfs4_openowner left on nn->close_lru holds only a raw pointer to its nfs4_client. When the laundromat reaps entries, drops client_lock and calls nfs4_put_stid(), a concurrent force_expire_client() can free the client, causing a use-after-free.

In the Linux kernel, a bare lock owner left on nn->blocked_locks_lru holds only a raw pointer to its nfs4_client. When the laundromat reaps such a lock, the final nfs4_put_stateowner() takes the client's cl_lock, which a concurrent force_expire_client() may have already freed, causing a use-after-free.

In the Linux kernel, get_estimated_bw() in the drm/amd/display driver divides by bw_granularity, which is zeroed and only populated after DP_TUNNELING_BW_ALLOC_CAP_CHANGED is handled. If a USB4/DPIA device reports an estimated-bandwidth change before a capability change, the DPCD interrupt handler triggers a division by zero.

In the Linux kernel, the usb image mdc800 driver uses kmalloc() for irq_urb_buffer and download_urb_buffer in usb_mdc800_init(). If a shorter message is received in mdc800_usb_irq() or mdc800_usb_download_notify(), stack data may leak.

In the Linux kernel, snd_usbmidi_us122l_output() in ALSA usb-audio picks a count of 2 for anything slower than high speed without relating it to ep->max_transfer. With a device declaring a one-byte bulk endpoint, the memset computes 1 - 2 in int and wraps to SIZE_MAX, causing an out-of-bounds write.

In the Linux kernel, the media: usbtv driver has a use-after-free. ALSA PCM callbacks store driver state in pcm->private_data, and an open PCM file can outlive USB disconnect because usbtv_audio_free() uses snd_card_free_when_closed(). The disconnect path can free struct usbtv before ALSA releases the substream, causing a use-after-free in snd_usbtv_pcm_close().

In the Linux kernel, the usb-storage: ene_ub6250 driver has a race between scan work and probe. Both the delayed scan work via usb_stor_Bulk_max_lun() and ene_get_card_type() use us->current_urb, but only the scan path serializes access with us->dev_mutex. If scan work runs while ene_get_card_type() is still using us->current_urb, usb_submit_urb() warns that the URB is already active.

In the Linux kernel, the usb: dwc3 driver has an issue with the forceRM bit when issuing EndTransfer. On DWC_usb31 v2.00a and v2.10a controllers with forceRM=1, a transfer aborted via ep_dequeue remained active after EndTransfer completion, and a subsequent StartTransfer triggered writes associated with the aborted transfer, causing an SMMU fault because the transfer buffer had already been unmapped. Using forceRM=0 eliminates the issue.

In the Linux kernel, the usb: storage: realtek_cr driver has a use-after-free on disconnect. realtek_cr_destructor() calls timer_delete() before the chip containing the timer is freed, and the timer callback may still be running and can rearm itself. The fix uses timer_shutdown_sync() and moves timer_setup() into init_realtek_cr().

In the Linux kernel, the usb: typec: hd3ss3220 driver has an issue tracking VBUS enable state per consumer. regulator_is_enabled() reports the aggregate regulator state, not whether this consumer holds an enable reference. If another consumer enables VBUS first, the driver can skip its own regulator_enable() and later attempt to drop a reference it never acquired, triggering an unbalanced regulator disable warning.

In the Linux kernel, the usb: typec: qcom-pmic-typec driver has an issue with cc_debounce_dwork on stop. cc_debounce_dwork is queued from set_cc() and start_toggling() callbacks, and port_stop() returns before tcpm_unregister_port() destroys the worker. The delayed work can then run after devres has freed pmic_typec_port. The fix uses disable_delayed_work_sync() in port_stop().

In the Linux kernel, the usb: typec: qcom-pmic driver has an issue cancelling reset_work on stop. pdphy_stop() disables IRQs but leaves reset_work pending. If the IRQ handler schedules it just before disable_irq(), the work runs after remove() frees the struct via devm. The fix calls cancel_work_sync() after disabling IRQs.

In the Linux kernel, the usb: typec: ucsi: displayport driver has an out-of-bounds (OOB) altmode array index. The driver indexes the connector's port altmode array with the GET_CURRENT_CAM response after checking it is not 0xff. The array is UCSI_MAX_ALTMODES elements long, so if the PPM returns an invalid response above UCSI_MAX_ALTMODES and not equal to 0xff, the kernel may crash with an OOB index error.

A null-pointer dereference vulnerability exists in the Linux kernel's USB gadget MIDI 2.0 function, specifically in f_midi2_free_ep_reqs(). When configuring a MIDI 2.0 gadget via configfs with block direction set to SNDRV_UMP_DIR_INPUT, the midi1_ep_out endpoint is not initialized, leaving usb_ep->card as NULL. When the host later sets the alternate setting, f_midi2_free_ep_reqs() is called for the uninitialized endpoint, causing a kernel crash.

In the Linux kernel, the usb: gadget: f_mass_storage driver has a null pointer dereference in fsg_common_set_num_buffers(). fsg_num_buffers_validate() was previously removed because Kconfig limited n from 2 to 256, but setting page content so that kstrtou8() reflects n as 0 or 1 bypasses these restrictions and leads to a null pointer dereference when n is 0. The fix adds a check for n < 2 and returns -EINVAL.

In the Linux kernel, f_midi2_opts_str_show() in the USB gadget driver has a use-after-free. Callers dereference the opts->info.<field> pointer before taking the lock, racing with f_midi2_opts_str_store(), which frees the old string under the lock. A concurrent attribute write can cause a read of a freed pointer.

In the Linux kernel, f_midi_alloc() does not initialize the work structure if f_midi_bind() is never called. The condition in f_midi_free then becomes true, causing a warning in __flush_work due to work->func = 0. The fix moves INIT_WORK from f_midi_bind() to f_midi_alloc().

In the Linux kernel, gadget_dev_ioctl() reads dev->gadget before acquiring dev->lock, while dev->state is checked after acquiring the lock. A concurrent bind can change the device state, leaving a stale NULL gadget pointer and causing a NULL pointer dereference at gadget->ops->ioctl.

In the Linux kernel, usb_put_function_instance() attempts to dereference fd inside the fi struct in the uvc_alloc_inst() error path. However, fd is not allocated until later in try_get_usb_function_instance(), so it is guaranteed to be NULL in the error path. The fix adds a NULL check for fi->fd.

The rtw_get_wps_attr() function in the Linux kernel's staging rtl8723bs driver fails to validate the WPS attribute length taken from a wireless management frame. This attacker-controlled length is used unchecked as the size for a memcpy(), causing a heap out-of-bounds read and a stack buffer overflow. The flaw can be triggered by a crafted WPS IE in a beacon or probe response processed during scanning.