CVE Vulnerability Catalog

In the Linux kernel rtl818x driver, a NULL pointer dereference vulnerability exists in the rtl8187_tx_cb function. The issue occurs when in rtl8187_stop() the TX status queue is cleared before killing anchored URBs, allowing a callback to use already freed skb.

In the Linux kernel ath11k Wi-Fi driver, the initialized flag for SRNG lists is not cleared during deinitialization. After a crash and recovery attempt, a subsequent call to dump SRNG stats may access freed memory, causing a page fault and kernel panic.

In the mt7925 WiFi driver in the Linux kernel, there is an off-by-one error in the mt7925_mcu_hw_scan() function. Using >= instead of > may lead to an out-of-bounds array access.

In the mt76 WiFi driver in the Linux kernel, there is an out-of-bounds (OOB) access vulnerability in mt7996_tx(). If link_id is set to IEEE80211_LINK_UNSPECIFIED, it may read or write outside the allocated memory.

A use-after-free vulnerability was found in the Linux kernel's amdgpu driver in the amdgpu_userq_suspend function. It occurs during PCI hot-unplug and can lead to reading freed memory.

In the panthor DRM graphics driver in the Linux kernel, there is a use-after-free (UAF) vulnerability in panthor_gem_create_with_handle() debugfs code. The object may be freed before initialization completes, leading to access to freed memory.

In the Xen driver (gntdev), there is a use-after-free (UAF) vulnerability in the dmabuf_exp_from_pages() function. After calling dma_buf_fd() and fd_install(), objects like gntdev_dmabuf can be destroyed by closing the descriptor, and then are still used.

In the IOMMU subsystem (Intel VT-d) in the Linux kernel, there is a use-after-free (UAF) vulnerability during SVA unbind with pending IOPFs. The iopf_for_domain_remove() function is called before blocking hardware and flushing pending page faults, leading to premature freeing of data structures.

A double-free vulnerability was found in the Linux kernel's Bluetooth subsystem in the 'hci_discovery_filter_clear()' function. The issue is caused by a race condition where the 'uuids' array can be freed twice before being set to NULL.

In the Linux kernel's Bluetooth subsystem, an out-of-bounds read vulnerability was found in the hci_devcd_dump function. The issue is caused by incorrect call ordering: dev_coredumpv may free the buffer pointed to by hdev->dump.head before skb_put_data safely reads it.

In the Linux kernel's mlx5e driver, a bug was found where after hardware decryption, if the xfrm (IPsec) state was freed before lookup, the secpath extension on the skb was not removed. This caused access to an invalid pointer and a system crash (page fault) during security policy checks.

In the Linux kernel BPF JIT for ARM64, when a program acts as an exception boundary, find_used_callee_regs() is not called, leaving ctx->fp_used false. Consequently, the frame pointer (FP) is not set up in the prologue, potentially causing a kernel crash due to a page fault.

A vulnerability has been identified in the Linux kernel related to stack buffer overflow in the gmin_get_var_int() function. The issue arises when gmin_get_config_var() does not return the proper error code, leading to incorrect buffer length processing and memory overwrite.

W jądrze systemu Linux naprawiono podatność związaną z warunkiem wyścigu oraz użyciem po zwolnieniu (UAF) w funkcji padata_reorder. Problem polegał na niewłaściwym zarządzaniu licznikiem referencji, co mogło prowadzić do błędów w przetwarzaniu padata.

A double destruction of the rsv_qp object was found in the Linux kernel's RDMA HNS driver. The issue occurs when rsv_qp is destroyed first in free_mr_init() and then in hns_roce_exit() during error handling, leading to list corruption.

In the ext4 filesystem in the Linux kernel, a use-after-free vulnerability exists in ext4_end_io_rsv_work(). The issue occurs when an io_end is added to the i_rsv_conversion_list without checking if conversion is needed, and the inode may be freed before the work executes, leading to use-after-free.

In the f2fs filesystem in the Linux kernel, KMSAN detected use of uninitialized values in the extent_info structure. The get_read_extent_info() function initializes only three fields (fofs, blk, len), leaving others uninitialized, leading to undefined behavior during extent merging.

A use-after-free (UAF) vulnerability was discovered in the Linux kernel's F2FS filesystem in the f2fs_sync_inode_meta() function. Reported by syzbot, it can cause reading freed memory during inode metadata synchronization.

In the Linux kernel, a vulnerability in the F2FS filesystem causes a kernel panic during f2fs_evict_inode due to a use-after-free in inode list operations. An attacker could trigger this to crash the system.

In the PPTP driver in the Linux kernel, there is an uninitialized data read vulnerability in the pptp_xmit() function. Lack of minimal skb length check can lead to out-of-bounds memory read.