CVE Vulnerability Catalog

A vulnerability in the Linux kernel futex mechanism involves a race condition during robust futex exit. The previous fix (ca16d5bee598) was insufficient, allowing lost wakeup notifications when another thread re-acquired the futex via the fast path. This could cause waiting threads to sleep forever on a free futex.

In the Linux kernel, fib_nlmsg_size() incorrectly estimated nexthop space assuming every gateway is encoded as an IPv4 RTA_GATEWAY attribute. IPv4 routes can also carry an IPv6 gateway, which is dumped as RTA_VIA, leading to undersized skb allocation and -EMSGSIZE errors, and with panic_on_warn set, a kernel panic.

A use-after-free vulnerability was found in the Linux kernel's fib_nhc_update_mtu() function for IPv4. The issue stems from lack of synchronization between walking the PMTU exception table and updates, potentially leading to access to freed memory. An attacker could exploit this flaw to compromise system integrity.

In the Linux kernel's qcom-geni UART driver, there is an issue with flushing the TX DMA buffer during transmission, causing the UART to get stuck infinitely repeating corrupted TX DMA frames. The DMA-mode uart_ops lacks a flush_buffer callback, and the stop path is broken, leading to a hang.

In the Linux kernel's 8250_dma driver, serial8250_release_dma() terminates RX DMA and releases the channel but leaves rx_running set. On port reopen, the stale state causes a NULL channel to be passed to dmaengine_pause(), leading to a kernel Oops.

A vulnerability in the Linux kernel serial driver 8250_of for the NXP LPC32xx UART was found. The UART can report an RX timeout interrupt while the FIFO is empty, which is never cleared. This causes an interrupt storm that can livelock the CPU on single-core ARM926 systems.

In the Linux kernel's amba-pl011 driver, RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel both timers.

In the Linux kernel's staging rtl8723bs driver, rtw_get_wpa_ie() reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short trailing IE.

In the Linux kernel's staging rtl8723bs driver, WMM_param_handler() copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read for a short WMM IE.

In the Linux kernel's staging rtl8723bs driver, the WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg_txt buffer, potentially causing overflow or underfill.

In the Linux kernel's staging rtl8723bs driver, rtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and reads the 802.11 frame control field without checking that a base 802.11 header remains, potentially causing out-of-bounds reads or insufficient data.

In the Linux kernel's fastrpc module, there is a potential race condition during buffer unmap operations. The buffer is removed from the list only after the unmap operation, which can cause issues when multiple threads invoke unmap concurrently. The fix moves the list removal before the unmap, re-adding the buffer if unmap fails.

In the Linux kernel's fastrpc module, the fl->lock is not held when moving memory mappings after an interrupted invoke. The list_del() and list_add_tail() operations run without this lock, which can cause races with other operations on the mmaps list. The fix adds the lock around the move.

In the Linux kernel's DAMON_LRU_SORT module, there is a division by zero vulnerability when the active_mem_bp parameter is set to a value greater than 10000. The target value for cold memory is calculated as '10000 - active_mem_bp + 2', which becomes zero for 10002, causing a divide error. The fix returns an error when starting DAMON with >10000.

In the Linux kernel's DAMON module, there is an issue with folios when the migration target is invalid (e.g., NUMA_NO_NODE). Functions damon_pa_migrate() and damos_va_migrate() isolate folios, but when target_nid is invalid, folios are not returned to the LRU, causing reference leaks and pages staying off the LRU. The fix adds putting folios back on the invalid-nid path.

A vulnerability in the Linux kernel's DAMON_SAMPLE_MTIER sample module allows a user to trigger a division by zero in damos_quota_score(). This occurs when the node0_mem_free_bp or node0_mem_used_bp parameter is set to zero, leading to a kernel Oops and potential system crash.

In the Linux kernel's ALSA USB driver, there is a use-after-free (UAF) vulnerability in delayed release of MIDI2 endpoints. The previous fix for UAF in ump_to_endpoint() causes another UAF because it tries to dereference the UMP endpoint object, which may already be released in a delayed context. The fix adds private_free to clear associated data.

In the Linux kernel, the ALSA usx2y driver (for USB US-X2Y sound cards) lacks offset validation in the mmap function for the hwdep interface. An attacker can supply an arbitrary offset, leading to access to kernel memory outside the allocated region, and in extreme cases to a system oops.

A vulnerability in the Linux kernel's ALSA FCP driver causes an out-of-bounds write in fcp_meter_ctl_get(). The issue stems from an incorrect map size limit (255 instead of 128), allowing writes beyond the allocated buffer. An attacker with CAP_SYS_RAWIO can install an oversized map, and any process with access to /dev/snd/controlC0 can trigger the out-of-bounds write.

In the Linux kernel, the ALSA driver for the us144mkii device has a use-after-free vulnerability. When resubmitting capture URBs in capture_urb_complete(), the URBs were not re-anchored, leaving the anchor list empty after the first completion. This caused cleanup functions like tascam_free_urbs() to fail to stop the URBs, leading to writes to freed memory and dereferencing of a freed driver object.