CVE Vulnerability Catalog

In the Linux kernel, the net: usb: ax88179_178a driver has a vulnerability where when the interface has NETIF_F_SG enabled and skb_linearize() fails in ax88179_tx_fixup(), the function returns NULL without freeing the skb. This leads to a memory leak on every TX frame whose linearization fails (e.g., under memory pressure).

A use-after-free vulnerability was found in the Linux kernel's ipheth driver for iPhone USB devices, caused by improper re-arming of carrier_work after interface close or device disconnect. This leads to accessing freed memory, potentially causing a kernel crash or memory corruption.

In the Linux kernel, the vt driver lacks a permission check for the KDSKBMETA ioctl, allowing a process to change keyboard meta mode on a non-controlling console without authorization.

In the Linux kernel, kbd_keycode() reads the port.tty pointer without acquiring a proper reference, racing with con_shutdown() and potentially causing use-after-free.

A vulnerability in the Linux kernel's zap_pte_range function during direct page table reclaim causes an incorrect flush address passed to pte_free_tlb. This leads to improper TLB (paging-structure-cache) flushing, potentially resulting in use-after-free or system crashes. The issue primarily affects architectures where flushing depends on the address, such as AMD with EFER.TCE or Intel with INVPCID.

In the Linux kernel, the evdev subsystem does not fully initialize the input_event structure, leaking uninitialized stack memory to userspace via padding bytes.

A use-after-free (UAF) vulnerability has been found in the Linux kernel's vmalloc mechanism, caused by a race between page table freeing and the ptdump tool. The issue occurs when promoting entries to huge pages, where the lower page table is freed without proper locking, potentially leading to access to freed memory. The patch resolves this by acquiring the mmap lock on init_mm during vmap operations and in the CPA (Change Page Attributes) mechanism on x86.

In the Linux kernel, the IMA module's xattr_verify() has a bug in the digest length check, leading to an out-of-bounds read for truncated xattrs.

In the Linux kernel, the IPVS estimator thread may continue after the calculation phase is disabled, leading to out-of-bounds writes and potential crashes.

In the Linux kernel, IPVS does not clear IPv4 options after rebasing tunnel ICMP errors, potentially leading to a stack out-of-bounds write via __ip_options_echo().

In the Linux kernel, the packet subsystem's tpacket_snd() reads dev->hard_header_len independently for allocation and header construction, which can lead to buffer overflow during concurrent reconfiguration.

In the Linux kernel, the packet socket transmit path does not reset the MAC header for protocol-bound SOCK_RAW, SOCK_DGRAM, and SOCK_PACKET frames. In PACKET_QDISC_BYPASS mode, the frame reaches the driver with an unset MAC header, causing an out-of-bounds read.

In the Linux kernel, packet_set_ring() updates RX ring state under lock but publishes the tpacket receive mode after releasing it. This race can cause packet_poll() or packet_recvmsg() to access stale or NULL ring storage.

In the Linux kernel, generic XDP fragment adjustment leaves skb->len stale, causing skb_headlen() to be larger than the actual linear area. In the UDP receive path, this can copy data beyond the linear area to userspace.

In the Linux kernel Open vSwitch, when updating a flow with a UFID that misses and falls back to key lookup, the preallocated reply may be too small. This can cause -EMSGSIZE and trigger BUG_ON in the update path.

In the Linux kernel net/sched subsystem, overly deep qdisc hierarchies can cause excessive recursion and kernel stack exhaustion. The existing loop check does not cover the create-and-graft path, allowing hierarchy extension.

In the Linux kernel inet_frag_create(), the fragment queue timer is armed before the queue is published in the hash table. If the fragment timeout is zero or negative, the timer can run before publication, causing a race and leaving a stale hash node.

In the Linux kernel mac802154 subsystem, the beacon worker reads local->beacon_req under RCU but continues to use sdata and wpan_dev after leaving the RCU section. This can lead to use-after-free after interface teardown.

A vulnerability in the Linux kernel netfilter ebt_nflog module leads to a use-after-free condition. The issue arises from not holding a reference to the NFLOG logging module, allowing an ebtables rule to be invoked after per-net data has been freed by nfnetlink_log. An attacker could exploit this to corrupt kernel memory.

In the Linux kernel bridge MRP subsystem, br_mrp_alloc_test_skb() builds MRP test frames on an skb from dev_alloc_skb(), which does not clear the linear data area. In the MRA ring-role branch, three bytes remain uninitialized in every MRP_Test frame.