CVE Vulnerability Catalog

In the Linux kernel, the algif_hash cryptographic algorithm implementation has a double-free vulnerability in the hash_accept function. When accept(2) on an algif_hash socket with MSG_MORE flag fails in crypto_ahash_import, the sk2 structure is freed twice – once in this function and again in af_alg_release, leading to a use-after-free error.

In the Linux PCM OSS layer, calling snd_pcm_format_set_silence() with runtime->dma_area can lead to use-after-free (UAF) because dma_area may be freed concurrently outside the buffer access lock.

In the Linux kernel vhost-scsi driver, access to vq->log_used is not properly protected by vq->mutex. The command completion path may read vq->log_base after QEMU has set vq->log_used to false and freed vq->log_base, leading to writes to invalid QEMU userspace memory.

In the Linux kernel's LZO compression implementation, there is a lack of output buffer overrun checking. The compression function assumes the caller always provides enough space, ignoring the provided buffer size. The patch adds a safe compression interface that checks for buffer end before each write.

W jądrze Linuxa zidentyfikowano podatność w module orangefs, która polega na błędnym obliczaniu rozmiaru pliku. Użycie typu 'size_t' do przechowywania wyniku funkcji i_size_read() prowadzi do obcięcia rozmiaru do 4GiB na systemach 32-bitowych.

In the Linux kernel, during system shutdown or kexec, virtio devices are not broken or reset. This can cause a hang, as devices (e.g., virtio-console) continue to write to MMIO after the PCI bus reset, and IOMMUs are reset before devices.

A vulnerability in the Linux kernel's MSI handling stores an IOMMU cookie pointer in the MSI descriptor without proper locking, allowing a race condition between IOMMU domain changes and MSI message composition. This can lead to a use-after-free (UAF) condition.

In the Linux kernel BPF subsystem, a vulnerability was found where the 'loop_entry' field is not copied during verifier state copy (copy_verifier_state()). This allows 'loop_entry' values from unrelated states to poison 'cur_state', and states on the verifier stack may contain invalid pointers. As a result, the verifier may accept BPF programs that are not safe.

In the Linux kernel, a race condition was found in the __legitimize_mnt() function related to the MNT_SYNC_UMOUNT flag. The check for this flag is performed outside the mount_lock, which could allow stealing the final mntput from a sync unmount, leading to incorrect reference management.

W jądrze Linuxa zidentyfikowano podatność związaną z brakiem zwolnienia pamięci w niektórych ścieżkach błędów w module espintcp. Problem ten dotyczy brakujących wywołań kfree_skb, co prowadzi do wycieków pamięci.

A use-after-free vulnerability was found in the Linux kernel's TIPC module in the tipc_aead_encrypt_done function. After deleting a network namespace, the cryptd_queue_worker may still access the freed tipc_crypto tx structure, leading to a slab-use-after-free read.

A use-after-free vulnerability was found in the cifs_fill_dirent function of the Linux kernel's CIFS module. During concurrent readdir operations, the response buffer may be accessed after being freed, causing memory corruption.

In the Linux kernel, the nvmet-tcp subsystem attempts to restore the sk_state_change pointer that may be NULL if the TCP connection was not established when nvmet_tcp_set_queue_sock() was called. This causes a NULL pointer dereference and kernel panic.

A race condition in the Linux kernel's nfs_local_open_fh() function was found. After dropping the clp->cl_uuid.lock, another CPU could free the newly added nfsd_file structure.

In the Linux kernel, the RDMA/rxe driver has a use-after-free bug in the rxe_queue_cleanup function. During CQ creation (rxe_create_cq), when rxe_cq_from_init fails, rxe_cleanup is called which frees already freed memory resources, causing an error.

A use-after-free vulnerability was found in the Linux kernel's ib_register_device function. The issue occurs when ib_device_rename() changes the device name under lock, while kobject_uevent() accesses the same name without lock protection, leading to a race condition and access to freed memory.

In the Linux kernel TLS subsystem, a bug causes a kernel panic when a page allocation fails. Setting frag_list to NULL leads to a NULL pointer dereference on the next tls_strp_read_sock call.

A vulnerability in the Linux kernel's HID-BPF implementation causes access to a cleaned-up SRCU structure after a HID device is unplugged. The issue occurs when the device has LEDs and the driver does not implement the request() function, leading to calls to dispatch_hid_bpf_output_report() or dispatch_hid_bpf_raw_requests() after device destruction.

In the Linux kernel sched_ext scheduler, bpf_iter_scx_dsq_new() may leave the iterator uninitialized on error, leading to garbage data dereference in next() or destroy().

In the Linux kernel, the TI K3 UDMA DMA engine driver lacked proper locking, triggering lock validator warnings. The fix adds the missing synchronization to prevent data races.