CVE Vulnerability Catalog

In the roccat HID driver, roccat_report_event() duplicates reports into a circular buffer, but device destruction paths did not free these copies. This caused a memory leak on each device removal.

In the HID sensor custom driver, hid_sensor_custom_add_attributes() did not remove previously created sysfs groups when a subsequent sysfs_create_group() call failed. This left invalid structures and potential access to freed memory.

A use-after-free vulnerability exists in the Linux kernel's HID: sony driver for GHL (Guitar Hero Live) dongles. During driver unbind, sony_remove() uses timer_delete_sync() which does not prevent timer re-arming, and usb_free_urb() does not cancel an in-flight URB. As a result, the ghl_poke_timer can be re-armed on freed memory and fire after the sc structure is freed.

In the Linux kernel, universal_pidff_probe() starts the device with hid_hw_start() but, if force-feedback initialization fails, returns the error without stopping the device. This leaves the registered hidraw device alive after the driver is cleared, leading to a use-after-free write when /dev/hidrawX is opened.

In the mcp2221 HID driver, the cleanup callback mcp2221_hid_unregister() did not stop device I/O before hardware teardown began. Incoming HID reports could race with device destruction, leading to a use-after-free.

In the mcp2221 HID driver, mcp_i2c_smbus_read() stored a buffer pointer in mcp->rxbuf but never cleared it after the transfer completed. A delayed or spurious MCP2221_I2C_GET_DATA report could write data into freed memory.

In the mcp2221 HID driver, mcp2221_raw_event() did not validate the size of incoming HID reports. In the MCP2221_I2C_GET_DATA path it trusted the device-supplied data[3] as the copy length, which could lead to a read past the report buffer.

In the Linux kernel, the intel-quickspi HID driver does not validate the report size before copying it into the report_buf heap buffer. The buffer is sized from the device descriptor (max_report_len), but the report length coming from a hidraw ioctl is unbounded, allowing a buffer overflow with attacker-controlled data.

In the Linux kernel, quickspi_get_report() in the intel-quickspi HID driver copies the entire device response into the caller's buffer without checking its length. A response larger than the caller's buffer overflows it with device-controlled content.

In the Linux kernel, init_ei() in eventfs does not initialize the eventfs_inode list_heads. If eventfs_create_dir() fails due to memory pressure, free_ei() checks the uninitialized children list, producing a false warning.

In the Linux kernel, the fs/ntfs3 driver does not validate the dirty page table during log replay. A crafted DIR_PAGE_ENTRY with an invalid lcns_follow field lets the v0->v1 conversion and later replay passes run off the entry.

In the Linux kernel, ni_read_frame() in fs/ntfs3 trusts decompress_lznt()'s return value, which may be smaller than the frame size. Unwritten bytes remain in the vmapped pages and are returned to userspace, disclosing uninitialized kernel memory.

In the Linux kernel, the copy_lcns and redo shorten loops in fs/ntfs3 index page_lcns[] based on the log record's lcns_follow, which is not checked against the target entry. A crafted record can overflow page_lcns[] of an otherwise valid entry.

In the Linux kernel, the ntfs driver bounds its free-cluster bitmap scan by the size of $Bitmap rather than the volume's cluster count. An image whose $Bitmap covers more clusters than the volume allows indexing past the lcn_empty_bits_per_page array.

In the Linux kernel, the ntfs driver does not reject attributes with empty mapping pairs if they have inconsistent highest VCN and size. The lack of validation can lead to incorrect processing.

In the Linux kernel, parse_ntfs_boot_sector() decodes the NTFS boot sector's 64-bit LCNs into an s64. A crafted high-bit value becomes negative and passes the upper-bound check, leading to an out-of-bounds access to lcn_empty_bits_per_page.

In the Linux kernel, ntfs_attr_update_meta() does not validate the attribute name offset when converting between non-sparse and sparse attributes. A malicious MFT record can set name_offset so the name extends beyond the attribute boundary or overlaps with mapping pairs.

In the Linux kernel, the NTFS mapping pairs decoder validated the starting LCN but did not check whether the run extends beyond the volume boundary. A malformed NTFS image with a crafted mapping pairs array could cause the kernel to access memory beyond the volume boundary, potentially leading to memory corruption and privilege escalation.

In the Linux kernel, ecryptfs_exorcise_daemon() dropped queued messages from a dying daemon without holding ecryptfs_msg_ctx_lists_mux, but ecryptfs_msg_ctx_alloc_to_free() requires that lock. This created a race with other users of the global message context list.

In the Linux kernel, ecryptfs_parse_packet_set() calculated the remaining packet buffer size as PAGE_SIZE - 8, even though for version 1 headers the packet set starts later in the header. This could overstate the available buffer and lead to parsing errors.