CVE Vulnerability Catalog

In the Linux kernel, the ltc4282 hwmon driver has a vulnerability where negative current values are cast directly to u64, leading to large positive values and then overflow and random values after division. These values are then clamped to the maximum limit instead of zero.

In the Linux kernel, the net: tap driver has a vulnerability where in tap_get_user_xdp() the virtio-net header is parsed before assigning skb->dev. When the vhost TX path passes an XDP buffer with a GSO virtio-net header and protocol set to zero, dev_parse_header_protocol() can be called with skb->dev NULL, leading to a crash.

In the Linux kernel, the Input: evdev driver has a vulnerability where the user-supplied event type index in EVIOCGMASK / EVIOCSMASK ioctls is used to index arrays in evdev_get_mask_cnt() and evdev_get_mask(). Speculative execution may mispredict bounds checks and perform out-of-bounds loads.

In the Linux kernel, the ALSA usb-audio driver has an out-of-bounds write vulnerability when handling inbound USB transfers of Format Type II. The issue is caused by incorrect calculation of the transfer buffer size, which is one packet too small, leading to writes beyond the allocated memory.

In the Linux kernel, the usb: misc: usbio driver has a vulnerability where in usbio_bulk_msg() the EMSGSIZE check compares ibuf_len (receive buffer size) with txbuf_len (transmit endpoint size) instead of rxbuf_len. When these sizes differ, the check is incorrect.

In the Linux kernel's cxacru driver for USB ATM devices, a vulnerability was found due to improper URB management. During an error in cxacru_cm(), the active rcv_urb is not killed, which can lead to a warning in usb_submit_urb() and potential system stability issues.

In the Linux kernel, the usb: gadget: f_ncm driver has a vulnerability where the variable ndp_index is declared as signed, but it stores the return value of get_ncm(), which is unsigned. A malicious host can supply a large offset that overflows the signed ndp_index, making it negative, which bypasses sanity checks and leads to an out-of-bounds read when calculating the address of the NDP block.

In the Linux kernel, the net: usb: ax88179_178a driver has a vulnerability where when the interface has NETIF_F_SG enabled and skb_linearize() fails in ax88179_tx_fixup(), the function returns NULL without freeing the skb. This leads to a memory leak on every TX frame whose linearization fails (e.g., under memory pressure).

A use-after-free vulnerability was found in the Linux kernel's ipheth driver for iPhone USB devices, caused by improper re-arming of carrier_work after interface close or device disconnect. This leads to accessing freed memory, potentially causing a kernel crash or memory corruption.

In the Linux kernel, the vt driver lacks a permission check for the KDSKBMETA ioctl, allowing a process to change keyboard meta mode on a non-controlling console without authorization.

In the Linux kernel, kbd_keycode() reads the port.tty pointer without acquiring a proper reference, racing with con_shutdown() and potentially causing use-after-free.

A vulnerability in the Linux kernel's zap_pte_range function during direct page table reclaim causes an incorrect flush address passed to pte_free_tlb. This leads to improper TLB (paging-structure-cache) flushing, potentially resulting in use-after-free or system crashes. The issue primarily affects architectures where flushing depends on the address, such as AMD with EFER.TCE or Intel with INVPCID.

In the Linux kernel, the evdev subsystem does not fully initialize the input_event structure, leaking uninitialized stack memory to userspace via padding bytes.

A use-after-free (UAF) vulnerability has been found in the Linux kernel's vmalloc mechanism, caused by a race between page table freeing and the ptdump tool. The issue occurs when promoting entries to huge pages, where the lower page table is freed without proper locking, potentially leading to access to freed memory. The patch resolves this by acquiring the mmap lock on init_mm during vmap operations and in the CPA (Change Page Attributes) mechanism on x86.

In the Linux kernel, the IMA module's xattr_verify() has a bug in the digest length check, leading to an out-of-bounds read for truncated xattrs.

In the Linux kernel, the IPVS estimator thread may continue after the calculation phase is disabled, leading to out-of-bounds writes and potential crashes.

In the Linux kernel, IPVS does not clear IPv4 options after rebasing tunnel ICMP errors, potentially leading to a stack out-of-bounds write via __ip_options_echo().

In the Linux kernel, the packet subsystem's tpacket_snd() reads dev->hard_header_len independently for allocation and header construction, which can lead to buffer overflow during concurrent reconfiguration.

In the Linux kernel, the packet socket transmit path does not reset the MAC header for protocol-bound SOCK_RAW, SOCK_DGRAM, and SOCK_PACKET frames. In PACKET_QDISC_BYPASS mode, the frame reaches the driver with an unset MAC header, causing an out-of-bounds read.

In the Linux kernel, packet_set_ring() updates RX ring state under lock but publishes the tpacket receive mode after releasing it. This race can cause packet_poll() or packet_recvmsg() to access stale or NULL ring storage.