CVE Vulnerability Catalog

In the Linux kernel, the ti-adc161s626 ADC driver used stack memory for spi_read(), which is not DMA-safe. A dedicated DMA-safe buffer has been added, and conversion functions updated accordingly.

A vulnerability has been identified in the Linux kernel regarding the validation of the doorbell_offset parameter during user queue creation in amdgpu. Lack of proper bounds checking may lead to corruption of the doorbell space in the kernel.

A vulnerability has been identified in the Linux kernel that allows out-of-bounds access to the odr_table array in the st_lsm6dsx_hwfifo_odr_store() function. This issue occurs when a user attempts to set the buffer sampling frequency for sensors other than the accelerometer or gyroscope.

In the Linux kernel, the MPU3050 gyroscope IIO driver called iio_device_register() before completing device initialization, potentially causing race conditions. The fix moves registration to the end of the probe function and adjusts unregistration accordingly.

In the Linux kernel USB ULPI driver, ulpi_register_interface() has a double free in its error path. When device_register() fails, put_device() triggers ulpi_dev_release() which frees the ulpi structure, and the error path then calls kfree(ulpi) again. The fix removes the extra free and lets put_device() handle cleanup.

In the Linux kernel, the usbtmc driver's usbtmc_release does not flush pending anchored URBs, which can lead to use-after-free errors (e.g. in the HCD giveback path). The fix calls usbtmc_draw_down() to allow anchored URBs to complete.

A vulnerability has been identified in the Linux kernel related to a double free in the reset_add_gpio_aux_device() function on error. The issue occurs when __auxiliary_device_add() fails, leading to improper resource deallocation.

A vulnerability has been identified in the Linux kernel related to incorrect buffer size in DMA allocation and memcpy in zynqmp_nvmem. This flaw may lead to undersized DMA buffer access and potential memory corruption.

In the Linux kernel, the virtual terminal (vt) subsystem has an out-of-bounds access after a console resize while in the alternate screen. enter_alt_screen() saves vc_uni_lines into vc_saved_uni_lines and sets vc_uni_lines to NULL; a subsequent resize skips reallocating the buffer, so when leave_alt_screen() restores it, the dimensions no longer match vc_rows/vc_cols, causing a kernel oops in csi_J. The fix checks whether console dimensions changed while in the alternate screen and frees the stale buffer instead of restoring it.

A vulnerability has been identified in the tegra crypto driver in the Linux kernel, which involved the failure to set the CRYPTO_ALG_ASYNC flag for asynchronous algorithms. This led to the crypto API selecting these algorithms for users requesting only synchronous algorithms, potentially causing crashes.

A vulnerability in the Linux kernel related to the unmap function was identified, which can unmap more than requested if the endpoint lands within the middle of a large or contiguous IOPTE. This issue has been resolved with a fix that ensures all unmapped areas are properly flushed.

A use-after-free vulnerability exists in the Linux kernel thermal subsystem due to a race between thermal zone removal and resume. The functions thermal_zone_pm_complete() and thermal_zone_device_resume() re-initialize the poll_queue delayed work, causing cancel_delayed_work_sync() in thermal_zone_device_unregister() to miss running work items and free the thermal zone prematurely.

In the Linux kernel USB Type-C UCSI driver, ucsi_notify_common() does not validate the connector number extracted from CCI. This is a 7-bit field (0-127) used to index the connector array in ucsi_connector_change(), but the array is allocated only for the number of connectors reported by the device (typically 2-4). A malicious device can report an out-of-range number and cause an out-of-bounds array access.

In the Linux kernel crypto krb5enc module, krb5enc_dispatch_decrypt() sets req->base.complete as the skcipher callback, which on asynchronous completion signals "done" without executing the integrity verification (hash check). The fix adds an intermediate callback krb5enc_decrypt_done that chains into krb5enc_dispatch_decrypt_hash() on async completion, and fixes EBUSY/EINPROGRESS handling.

W jądrze Linuxa zidentyfikowano podatność w ksmbd, która nie weryfikuje, czy użytkownik próbujący ponownie połączyć się z trwałym uchwytem jest tym samym użytkownikiem, który pierwotnie otworzył plik. To umożliwia każdemu uwierzytelnionemu użytkownikowi przejęcie osieroconego trwałego uchwytu poprzez przewidywanie lub łamanie identyfikatora.

W jądrze Linuxa zidentyfikowano podatność polegającą na braku walidacji wartości rec->used podczas sprawdzania rekordów plików w dzienniku. To może prowadzić do niebezpiecznego kopiowania dużych ilości pamięci do bufora o rozmiarze 4 KB.

A use-after-free (UAF) vulnerability has been identified in the Linux kernel within the f2fs_write_end_io() function, which may lead to a NULL pointer dereference. The issue occurs in a concurrent scenario, potentially resulting in system panic.

A vulnerability has been identified in the Linux kernel within the smb_check_perm_dacl() function, allowing for out-of-bounds (OOB) reads due to improper ACE size validation. An attacker can exploit this flaw to access memory, potentially leading to kernel state corruption.

A vulnerability has been identified in the Linux kernel that leads to a leak of the active connection count on transport allocation failure in the ksmbd_tcp_new_connection() function. This issue can be exploited by an unauthenticated remote attacker to induce memory pressure, resulting in the rejection of all subsequent connection attempts.

In the Linux kernel, a vulnerability was found in the CIFS implementation where build_sec_desc() and id_mode_to_cifs_acl() improperly validate the DACL structure from the server. A malicious server can supply a truncated DACL with a fake ACE count, causing an out-of-bounds read during security descriptor rewrite.