CVE Vulnerability Catalog

In the Linux kernel, the USB: c67x00 driver has a use-after-free vulnerability in c67x00_add_iso_urb(). When TD creation fails for the last packet of an isochronous URB, the URB is given back before updating the endpoint scheduling state, leading to access to freed memory. The fix updates next_frame and cnt before giving back the URB.

In the Linux kernel, a vulnerability in the mt76 driver for mt7925 chipsets fails to ensure adequate headroom in USB/SDIO transmit buffers. Forwarded frames from a wired interface to an mt7925u AP can trigger a kernel panic (skb_under_panic) due to insufficient headroom. The issue affects the transmit path for forwarded frames that do not reserve the required headroom.

A use-after-free vulnerability was found in the Linux kernel's usbfs driver (usbdev_release). The function drops its reference to the usb_device structure before draining the list of completed URBs, which after a disconnect leads to reading freed memory. The issue is reachable by an unprivileged process with access to /dev/bus/usb.

In the Linux kernel's st21nfca NFC driver, the declared length of an ATR_REQ frame was not validated against the actual received length. A nearby attacker can send a short frame with an inflated length, causing an out-of-bounds read that may disclose kernel memory or lead to a denial of service.

In the Linux kernel's mchp-ipc-sbi mailbox driver, a missing null check for devm_kasprintf() could lead to a null pointer dereference if memory allocation fails.

In the Linux kernel's NVMe PCIe endpoint subsystem (nvmet pci-epf), a missing CQ reference release on PCI mapping failure leads to memory and controller reference leaks. A remote PCI host can repeatedly trigger this, exhausting resources.

In the Linux kernel's XFS filesystem, the online scrub functionality can livelock if the unlinked inode list contains a loop. There is no cycle detection.

A vulnerability was found in the Linux kernel's Bluetooth RFCOMM subsystem. The rfcomm_sock_recvmsg() function calls rfcomm_dlc_accept() without holding the rfcomm_mutex lock, which can lead to a NULL pointer dereference when a remote peer sends a DISC frame for a deferred setup connection (BT_DEFER_SETUP). The issue is fixed by taking rfcomm_mutex around rfcomm_dlc_accept() and re-checking the session.

In the Linux kernel, the iommu/tegra241-cmdqv driver has a use-after-free vulnerability during teardown. The CMDQ queue is freed before arm_smmu_impl_remove() runs, which then attempts to issue a CMD_SYNC on the freed memory, potentially causing a system crash.

A vulnerability in the Linux kernel's iommu/iommufd subsystem causes a NULL pointer dereference in iommufd_ioas_change_process when racing with iopt_map_file_pages. The issue arises from a window between IOAS area creation and pages pointer assignment, leading to a kernel crash.

In the Linux kernel's ALSA FCP (USB) driver, a shared URB intended for another endpoint was used, leading to initialization errors and potential crashes. A separate URB and proper synchronization initialization were added.

In the Linux kernel, the ALSA driver for 2nd-generation Focusrite Scarlett devices has a vulnerability where a shared URB is used for the notification endpoint, causing initialization to be skipped and cmd_done to remain zeroed. This can lead to a crash in wait_for_completion_timeout() during the init sequence.

In the Linux kernel, the rndis_host driver lacks an overflow check in rndis_rx_fixup(). This can allow an out-of-bounds read of the USB data buffer.

In the Linux kernel, the nvmet subsystem's nvmet_execute_identify_nslist() function dereferences a NULL pointer when handling an Identify command with CNS 07h. This occurs because req->ns is not set and then used for comparison.

In the Linux kernel, the ALSA dummy driver's snd_dummy_probe() does not validate the card index value. If the device is bound manually via sysfs, the index can be -1, leading to out-of-bounds array access.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

In the Linux kernel's io_uring/rsrc subsystem, a vulnerability was found in io_vec_fill_bvec() due to an integer overflow when calculating folio size. Using a plain int instead of unsigned long for bit shifting leads to undefined behavior for folio shifts of 32 or more, causing out-of-bounds writes. The issue mainly affects systems with gigantic hugetlb pages (e.g., 16G on arm64).

In the Linux kernel, the OCFS2 filesystem lacks metadata reservation for large extended attributes (xattrs). This can lead to a kernel panic during lsetxattr() on a fragmented filesystem when the file already has an external xattr block.

In the Linux kernel, the ext4 filesystem has a vulnerability causing an infinite retry loop in ext4_xattr_block_set() when selecting a cached extended attribute entry. A corrupted filesystem can cause an entry with a saturated reference count to be selected repeatedly, leading to a task hang and blocking rmdir operations on the parent directory.

In the Linux kernel, the nilfs2 filesystem lacks range validation of parameters in the nilfs_vdesc structure used by the GC ioctl. This can lead to inserting a page with index ULONG_MAX into the page cache, causing list corruption and a crash.