CVE Vulnerability Catalog

In the Linux kernel, the staging rtl8723bs driver's rtw_action_frame_parse() does not check the frame_len parameter before indexing into the frame body. Reading frame_body[0] and frame_body[1] requires frame_len >= 26, so a shorter frame (e.g. 24 bytes) causes a 1-2 byte out-of-bounds read. This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx().

In the Linux kernel, the staging rtl8723bs driver's rtw_restruct_wmm_ie() scans the in_ie buffer for a WMM IE. When the 'i + 5 < in_len' check fails near the end of the buffer, execution falls through to 'i += (in_ie[i + 1] + 2)', which at i == in_len - 1 causes a 1-byte out-of-bounds read. A previous fix added the guard only to the match condition, not to the advance.

A flaw in the Linux kernel's xhci driver causes lost bounce buffers for transfers spanning three or more ring segments. When data is not aligned to wMaxPacketSize, only the last bounce buffer is recorded in td->bounce_seg, so earlier bounce buffers are neither copied back nor DMA-unmapped. This leads to silent data corruption in the destination buffer and a DMA mapping leak.

In the Linux kernel, the newly added show_event_filters and show_event_triggers files do not take a reference to the trace_array they display. Without this reference, the trace_array may be freed via 'rmdir' while a task is reading the file, causing a use-after-free. The fix makes opening both files take the reference via trace_array_get().

A use-after-free vulnerability was found in the Linux kernel tracing mechanism. Opening an options file did not take a reference to the trace_array structure, which could lead to use of freed memory when one process opened the file while another removed the instance. The issue was fixed by adding the trace_array_options_get() function that takes a reference before use.

In the Linux kernel, __spi_map_msg() mishandles DMA mapping ownership on partial map failure. When RX or TX mapping fails, flags and device pointers are not properly cleared, which can lead to re-unmapping or using a NULL/stale device pointer. This can trigger a kernel oops.

In the Linux kernel, the scsi target iscsi function iscsi_target_check_login_request() does not reserve a NUL terminator byte for the login buffer. With payload_length from 8189 to 8192, the entire 8192-byte buffer is filled and then consumed as a C string, leading to out-of-bounds reads. The vulnerability is reachable by an unauthenticated initiator when CHAP is configured.

In the Linux kernel, the scsi bsg completion copies scmd->sense_len to the user response buffer without honoring max_response_len. After a valid sense, the midlayer sets sense_len to the real length (up to SCSI_SENSE_BUFFERSIZE), overrunning a smaller user buffer.

In the Linux kernel, the scsi bsg function scsi_bsg_uring_cmd() reads bsg_uring_cmd from the shared mmap'd SQE, allowing userspace to change a field between check and use (TOCTOU). request_len can grow past sizeof(scmd->cmnd) after the bound check and overflow scmd->cmnd in copy_from_user().

In the Linux kernel, the megaraid_sas driver's megasas_make_prp_nvme() builds a command's PRP list in cmd->sg_frame without checking the buffer bound. After the default BLK_DEF_MAX_SECTORS_CAP was increased to 4 MiB, NVMe transfers require more entries than fit in the frame, causing an out-of-bounds write, a page fault, or silent corruption of a neighbouring DMA pool entry.

In the Linux kernel, the scsi pm8001 driver function pm8001_request_msix() uses index i instead of j in the rollback loop when request_irq() fails, passing the wrong IRQ/dev_id pair to free_irq(). Earlier registered handlers remain installed.

In the Linux kernel, samples/damon/mtier function damon_sample_mtier_stop() assumes damon_stop() always succeeds and deallocates DAMON contexts after the call. If a context is already stopped, damon_stop() fails, leaving running contexts, leading to use-after-free. The issue is only in mtier.

In the Linux kernel, the samples/damon/wsse sample module's damon_sample_wsse_start() function did not free the DAMON context memory when damon_start() failed. This leads to a memory leak, and more broadly, similar mishandling of damon_start() and damon_stop() failures across DAMON sample modules can cause memory leaks, disruptions of subsequent DAMON operations, and use-after-free.

In the Linux kernel, mm/damon/core function damon_apply_min_nr_regions() assumes damon_split_region_at() always succeeds. On memory allocation failure and when the region was the last, fetching the next region returns an invalid pointer, leading to invalid memory dereference and corruption. The fix breaks all loops on any split failure.

A use-after-free vulnerability exists in the Linux kernel's futex implementation during requeue PI operations on PREEMPT_RT kernels. A race between an early wakeup of a waiting task and a PI requeue can cause the requeue task to call rcuwait_wake_up() on a futex_q structure that has already been freed from the waiter's stack. The issue is resolved by skipping rcuwait_wake_up() in the Q_REQUEUE_PI_LOCKED case.

A use-after-free bug exists in the Linux kernel ftrace subsystem. The set_ftrace_filter and set_ftrace_notrace files for trace instances use the ftrace_ops pointer from inode->private, which can be freed concurrently by an rmdir on the instance, leading to a use-after-free and kernel crash.

In the Linux kernel, a race condition exists in the HID BPF subsystem between the device destruction path (__hid_bpf_ops_destroy_device) and the unregistration path (hid_bpf_unreg), which can double-put the same device reference. This frees the hid_device structure while hid_destroy_device() is still using it, resulting in a use-after-free. The fix serializes the reference release decision under the prog_list_lock.

In the Linux kernel, the HID RMI driver is vulnerable to out-of-bounds (OOB) access due to undersized report buffers. The driver allocates buffers based on device-declared report sizes without a minimum bound, then reads/writes at fixed offsets, leading to memory corruption. Additionally, the read loop can hang indefinitely if the device returns zero-length replies, blocking the probe worker.

OpenMeter before v1.0.0-beta.228 contains an SQL injection vulnerability in ClickHouse-backed meter definitions. A remote unauthenticated attacker can access or modify metering event data and potentially cause denial of service.

In the Linux kernel, the wacom_intuos_pro2_bt_irq() function in the HID wacom driver did not validate the received report length before parsing. A malicious or malfunctioning Bluetooth device impersonating a Wacom tablet can send an undersized report, causing an out-of-bounds read and leaking data to userspace via evdev.