CVE Vulnerability Catalog

A vulnerability has been identified in the Linux kernel related to lack of bounds checking in the nci_hci_create_pipe() function. The 'pipe' variable coming from the network can lead to memory corruption if its value exceeds 127.

In the Linux kernel misc fastrpc driver, the page size calculation for non-registered buffers does not consider the offset, potentially leading to an incorrect page size and out-of-bounds memory access.

A vulnerability in the Linux kernel has been resolved by adding a gain range check in the 'wlc_phy_iqcal_gainparams_nphy()' function. This change aims to prevent potential out-of-bounds access to memory.

In the Linux kernel UFS subsystem for the BSG interface, the bsg_queue pointer is not set to NULL after removal. This could lead to a use-after-free (UAF) vulnerability.

In the Linux kernel NTFS3 filesystem, the mi_enum_attr() function did not mark the inode as bad immediately upon error detection. The fix extends the function interface with an ntfs_inode parameter to allow immediate marking.

A use-after-free (UAF) vulnerability in the Linux kernel's NBD (Network Block Device) driver allows reconnection after disconnection, leading to a race condition and access to freed nbd_config memory.

In the Linux kernel, a vulnerability in the rtw89 driver causes double initialization of the mgnt_entry list when WoWLAN fails during resume. This corrupts the list, leading to a kernel BUG and system crash.

A use-after-free vulnerability was identified in the Linux kernel in the padata_reorder function, which may lead to unexpected system behavior. The issue was detected during LTP testing, where a bug related to reading memory after it has been freed occurred.

A Use-After-Free (UAF) vulnerability has been identified in the Linux kernel within the reorder_work function, which may lead to unauthorized memory access. This issue occurs during the processing of cryptographic requests, potentially resulting in unpredictable system behavior.

In the Linux kernel, the CIFS/SMB client fails to handle an unset link speed (LinkSpeed) from the server, causing a division by zero error and a system oops when reading debug data.

A vulnerability in the Linux kernel related to a shift-out-of-bounds in the iova_bitmap_offset_to_index() function has been resolved. This issue could lead to undefined behavior when the shift value exceeds 31 bits.

A vulnerability was found in the Linux kernel's XFRM (IPsec) subsystem in packet offload mode. When IP forwarding is enabled, the secpath entry is not removed after policy check, causing the packet to be re-processed by the network driver with xfrm_offload set. This leads to a NULL pointer dereference and kernel panic, as observed in the mlx5 driver.

In the Linux kernel ipmr module, a vulnerability exists where mr_mfc_uses_dev() is called for unresolved (unres) entries, causing a wild pointer dereference and system crash. This issue has been present since the initial implementation and can be exploited to trigger a kernel panic.

A vulnerability was found in the Linux kernel's ROSE protocol implementation. ROSE timers did not check if the socket was owned by a user thread, leading to a race condition and use-after-free.

In the Linux kernel, the mlx5e driver (Mellanox ConnectX) was missing a cpu_to_node call before passing the CPU ID to kvzalloc_node. Operations on a CPU with index greater than MAX_NUMNODES caused out-of-bounds access and kernel panic.

W jądrze systemu Linux zidentyfikowano podatność w funkcji bitmap_get_stats(), która może prowadzić do awarii systemu. Problem wynika z możliwości wywołania tej funkcji w momencie, gdy bitmapa została zniszczona lub nie została w pełni zainicjowana, co może spowodować błąd ochrony ogólnej.

A vulnerability in the Linux kernel's TCP implementation can cause permanent connection deadlock under extreme memory pressure. When a socket temporarily advertises a zero window and fails to update its window size after memory is freed, the peer stops sending data, blocking transmission.

In the Linux kernel, during dup_mmap() failure handling, the mm_struct may be left incomplete, creating a race condition. Setting MMF_OOM_SKIP and MMF_UNSTABLE flags prevents access to the partially initialized mm_struct by other components, including uprobe.

A use-after-free vulnerability was found in the Linux kernel's PPS (Pulse Per Second) subsystem. The bug occurs during device removal when pps_device_destruct() frees memory before file operations on open descriptors complete, leading to system crashes.

In the Linux kernel's rdma/cxgb4 driver, an integer overflow vulnerability was found on 32-bit systems. The user-controlled 'gl->tot_len' variable can cause wrapping in addition, leading to a potential security flaw.