CVE Vulnerability Catalog

In the Linux kernel, the ksmbd_reopen_durable_fd() function rebinds every detached oplock on an inode to the reconnecting session instead of only the oplock owned by the reopened file. This allows one session to adopt another session's oplock, and when the adopting session is destroyed, a use-after-free occurs. The vulnerability is reachable with the default durable-handle and oplock configuration when two sessions open the same file with distinct AppInstanceIds.

In the Linux kernel SMB client, the ALIGN() macro in symlink_data() can overflow for ErrorDataLength values near UINT32_MAX (e.g. 0xFFFFFFF9), wrapping to 0. This causes the bounds check to pass and the loop to advance by zero bytes, leaving pointer 'p' pointing into stale data.

In the Linux kernel SMB client, coalesce_t2() computes data pointers directly from server-supplied DataOffset fields without validating them against buffer bounds. A small DataOffset can push a pointer below the data area and overwrite header fields, while a large one can push it past the buffer end, causing out-of-bounds heap reads or writes.

In the Linux kernel SMB client, reparse_buf_ptr() reads the ReparseDataLength field before verifying that the received data covers the full fixed header. If a server returns OutputCount < 6, the read at offset 4-5 reaches past the end of the received data.

In the Linux kernel SMB client, CIFSTCon() bounds its strnlen() by the server's ByteCount minus two, which for ByteCount 0 or 1 becomes negative as an int and converts to a huge size_t. The later subtraction wraps __u16 bytes_left, allowing cifs_strndup_from_utf16() to read up to 65535 bytes from a ~16 KB object, leaking data through /proc/fs/cifs/DebugData.

In the Linux kernel SMB client, the is_valid_oplock_break() function no longer effectively validates the DataOffset field. Due to an earlier change in RFC1002 header handling, the expression used for validation always evaluates to zero, so the check never rejects invalid values.

The corsair-void HID driver did not check the size of incoming status and firmware events. Malformed events could cause an out-of-bounds read.

In the picolcd HID driver, picolcd_debug_eeprom_read() trusted a device-supplied length byte without checking how much data was actually received. A device returning a length of 0xff could cause an out-of-bounds read and expose adjacent memory through the debugfs file.

In the roccat HID driver, roccat_report_event() duplicates reports into a circular buffer, but device destruction paths did not free these copies. This caused a memory leak on each device removal.

In the HID sensor custom driver, hid_sensor_custom_add_attributes() did not remove previously created sysfs groups when a subsequent sysfs_create_group() call failed. This left invalid structures and potential access to freed memory.

A use-after-free vulnerability exists in the Linux kernel's HID: sony driver for GHL (Guitar Hero Live) dongles. During driver unbind, sony_remove() uses timer_delete_sync() which does not prevent timer re-arming, and usb_free_urb() does not cancel an in-flight URB. As a result, the ghl_poke_timer can be re-armed on freed memory and fire after the sc structure is freed.

In the Linux kernel, universal_pidff_probe() starts the device with hid_hw_start() but, if force-feedback initialization fails, returns the error without stopping the device. This leaves the registered hidraw device alive after the driver is cleared, leading to a use-after-free write when /dev/hidrawX is opened.

In the mcp2221 HID driver, the cleanup callback mcp2221_hid_unregister() did not stop device I/O before hardware teardown began. Incoming HID reports could race with device destruction, leading to a use-after-free.

In the mcp2221 HID driver, mcp_i2c_smbus_read() stored a buffer pointer in mcp->rxbuf but never cleared it after the transfer completed. A delayed or spurious MCP2221_I2C_GET_DATA report could write data into freed memory.

In the mcp2221 HID driver, mcp2221_raw_event() did not validate the size of incoming HID reports. In the MCP2221_I2C_GET_DATA path it trusted the device-supplied data[3] as the copy length, which could lead to a read past the report buffer.

In the Linux kernel, the intel-quickspi HID driver does not validate the report size before copying it into the report_buf heap buffer. The buffer is sized from the device descriptor (max_report_len), but the report length coming from a hidraw ioctl is unbounded, allowing a buffer overflow with attacker-controlled data.

In the Linux kernel, quickspi_get_report() in the intel-quickspi HID driver copies the entire device response into the caller's buffer without checking its length. A response larger than the caller's buffer overflows it with device-controlled content.

In the Linux kernel, init_ei() in eventfs does not initialize the eventfs_inode list_heads. If eventfs_create_dir() fails due to memory pressure, free_ei() checks the uninitialized children list, producing a false warning.

In the Linux kernel, the fs/ntfs3 driver does not validate the dirty page table during log replay. A crafted DIR_PAGE_ENTRY with an invalid lcns_follow field lets the v0->v1 conversion and later replay passes run off the entry.

In the Linux kernel, ni_read_frame() in fs/ntfs3 trusts decompress_lznt()'s return value, which may be smaller than the frame size. Unwritten bytes remain in the vmapped pages and are returned to userspace, disclosing uninitialized kernel memory.