CVE Vulnerability Catalog

A buffer overflow vulnerability in the hid_hw_request function in the Linux kernel's HID BPF. The return value can be arbitrarily large because it comes from dispatch_hid_bpf_raw_requests(), which calls struct_ops without guarantees. This could lead to a buffer overflow.

In the Linux kernel's nvdimm/bus subsystem, there is a potential use-after-free vulnerability during asynchronous initialization. If device_add() fails, accessing freed memory may occur.

A vulnerability has been identified in the Linux kernel regarding incorrect pte restoration for lazyfree folios. The issue involved potentially setting an entire batch of anonymous folios as writable during unmapping, which has been fixed by respecting the writable bit during batching.

In the Linux kernel, a vulnerability in move_pages_huge_pmd() handling UFFDIO_MOVE for THP and huge zero pages was found. For zero pages, src_folio is set to NULL, causing folio_mk_pmd(NULL) to create a PMD pointing to non-existent physical memory (SPARSEMEM_VMEMMAP) or a NULL dereference (other models). Additionally, PMD reconstruction in the zero branch drops pmd_special(), allowing vm_normal_page_pmd() to treat the moved zero page as normal and corrupt its refcount.

A use-after-free vulnerability was found in the Linux kernel's MACB (Cadence) driver. The PTP clock is registered on interface open and destroyed on close, but can be accessed via ethtool get_ts_info while the interface is present, leading to a read-after-free.

In the Linux kernel's bnxt_en driver, an out-of-bounds access vulnerability exists in the DBG_BUF_PRODUCER async event handler. The firmware-supplied 'type' field is used as an array index without bounds validation, potentially leading to out-of-bounds kernel memory access.

In the Linux kernel, the Bluetooth L2CAP stack has an out-of-bounds read vulnerability in l2cap_information_rsp() due to insufficient payload length validation. This can lead to reading adjacent kernel memory.

In the Linux kernel's SMB client, a bug was fixed where the SMB session from the first mount was reused for subsequent mounts with different usernames when using Kerberos. Now the client correctly matches the username option in match_session() even for Kerberos.

In the Linux kernel's SPI driver, a use-after-free vulnerability exists during controller registration. If per-CPU statistics allocation fails, deregistration from the driver core is not performed, leading to use-after-free and uncontrolled register accesses.

Immich before version 2.6.0 has a credential disclosure vulnerability when authenticating to a shared album. The album password is transmitted in URL query parameters in a GET request to /api/shared-links/me, exposing it in browser history, proxy and server logs, and referrer headers.

Budibase is an open-source low-code platform. Prior to version 3.33.4, the bash automation step executes user-provided commands using execSync without proper sanitization or validation. User input is processed through processStringSync which allows template interpolation, potentially allowing arbitrary command execution.

In the Linux kernel DRM/XE driver, GGTT MMIO access protection relied on hotplug (drm_dev_enter), which failed on driver load failure. An open-coded flag protected by the GGTT lock was added to disable MMIO access during teardown.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's Bluetooth HIDP subsystem. The issue is caused by not releasing the l2cap_conn reference when the user->remove callback is invoked, potentially leading to system crashes.

In the Linux kernel, the Bluetooth L2CAP subsystem has a use-after-free vulnerability in l2cap_unregister_user. Missing locking (conn->lock) between l2cap_conn_del() and registration functions causes a race condition leading to use-after-free and list corruption.

In the Linux kernel, the iptunnel_xmit_stats() function has a vulnerability due to missing support for NETDEV_PCPU_STAT_DSTATS. It assumed tunnels only use NETDEV_PCPU_STAT_TSTATS, causing syncp offset differences between pcpu_sw_netstats and pcpu_dstats, leading to corruption or hangs on 32-bit kernels.

A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in the ctnetlink_dump_exp_ct() function. The conntrack pointer is stored in netlink callback data but its reference is dropped immediately after dump start, causing a use-after-free on subsequent recvmsg() calls.

In the Linux kernel, the netfilter nf_conntrack_sip module has a vulnerability where Content-Length is truncated from unsigned long to unsigned int in sip_help_tcp(). On 64-bit systems, values exceeding UINT_MAX are silently truncated, causing incorrect SIP message boundary calculation and potentially processing trailing data as a second SIP message.

An out-of-bounds read vulnerability exists in the Linux kernel's netfilter nf_conntrack_h323 module in the decode_int() function's CONS case. Missing boundary check allows reading 1-4 bytes beyond the allocated buffer via a crafted H.323/RAS packet.

In the Linux kernel's MANA driver, a use-after-free vulnerability exists in mana_hwc_destroy_channel(). The teardown order frees hwc->caller_ctx before destroying CQ and EQ queues, allowing interrupt handlers to access freed memory.

In the Linux kernel, in the TI ICSSG PRUETH network driver, there is a memory leak in the XDP_DROP path for non-zero-copy mode. Page recycling was removed from the XDP_DROP path in emac_run_xdp() to avoid conflicts with AF_XDP zero-copy mode, but this causes a memory leak when running XDP programs that drop packets in non-zero-copy mode (standard page pool mode). Pages are never returned to the page pool, leading to OOM conditions. The fix handles cleanup in the caller, emac_rx_packet(), which now recycles the page back to the page pool when emac_run_xdp() returns ICSSG_XDP_CONSUMED for XDP_DROP.