CVE Vulnerability Catalog

In the Linux kernel, the ASoC SOF subsystem for IPC3 topologies has an out-of-bounds access vulnerability in sof_get_control_data(). The function assumes bytes payload but can be called for other types, leading to incorrect memory reads.

In the Linux kernel, the fbdev defio driver has a vulnerability causing pagelist corruption due to a race between processes in fb_deferred_io_mkwrite() and fb_deferred_io_fault(). One process adds a page to the list while another initializes the same page without lock protection.

In the wl1251 WiFi driver in the Linux kernel, a vulnerability was found where stack parameters are used for DMA, which after the introduction of vmap'ed stacks leads to kernel panic. The issue occurs in several places in the driver, e.g., when accessed via SDIO, making it unusable on platforms like OpenPandora.

In the Linux kernel, the mt76 driver had a race condition leading to use-after-free on station removal. In a small race window, ongoing tx activity can cause an skb to be added to the status tracking idr after it has been cleaned up, keeping the wcid linked in the status poll list.

In the rtw89 driver (for WiFi cards), the rtw89_phy_cfo_parse() function did not validate mac_id before accessing an array, leading to an out-of-bounds read. The fix adds an index check before array access.

In the Linux kernel, the arm_scmi firmware subsystem has a vulnerability due to improper validation of the number of protocols during protocol list enumeration. The check uses a sum of unsigned integers that can overflow and bypass the validation. The fix avoids the addition in the validation.

In the f2fs filesystem in the Linux kernel, a vulnerability was found involving dereferencing a stale list iterator after the loop body. If no break is hit, the iterator becomes a bogus pointer, and dereferencing it (e.g., cur->page) could load out-of-bounds/undefined values, which may be exploited by an attacker.

In the Linux kernel's mac80211 module, a use-after-free was found in channel context (chanctx) code. After freeing the old context in ieee80211_vif_use_reserved_reassign(), further referencing it leads to UAF.

In the staging r8188eu WiFi driver in the Linux kernel, a vulnerability was found due to missing check before writing to the ->Ssid array in the rtw_wx_set_scan() function. There is a check to prevent read overflow, but no check to prevent writing beyond the end of the array, which can lead to buffer overflow.

In the f2fs filesystem in the Linux kernel, a vulnerability was found due to missing sanity check on block address in the f2fs_do_zero_range() function. After fuzzing the filesystem image, block mapping info in the inode can be inconsistent with the SIT table, leading to kernel panic when updating SIT with an invalid block address.

In the Linux kernel, a vulnerability was found in the ext4 filesystem that allows cycles in the h-tree stored inside a directory. A maliciously corrupted filesystem can lead to kernel corruption of tree nodes and access to unallocated memory. The issue is fixed by verifying that traversed block numbers are unique.

In the Linux kernel, in ip_gre, the check was revised to test csum_start instead of the transport header. This prevents overflow in lco_csum when GRE packets with TUNNEL_CSUM are processed.

In the Linux kernel, in the drm/etnaviv driver, a check was added for reaped mappings in etnaviv_iommu_unmap_gem. If the mapping is already reaped, the unmap is a no-op to avoid double removal and data structure corruption.

A use-after-free vulnerability was found in the Linux kernel's mt76 driver (for MediaTek Wi-Fi cards). The issue involves a wcid pointer in mt76_txq_schedule that was not protected by RCU, leading to a reference to freed memory during transmission scheduling.

In the Linux kernel, a fix was made for accessing tp->snd_cwnd in TCP, which could be set to an illegal value, leading to warnings and potential bugs.

In the Linux kernel, in the xprtrdma module, when an RDMA server returns a fault format reply, the NFSv3 client may treat it as a callback (bcall) when the bc service does not exist. This leads to a NULL pointer dereference in rpcrdma_bc_receive_call. The fix treats all calls as not a bcall when bc_serv is NULL.

In the Linux kernel, in ALSA OSS, the PCM OSS buffer allocation overflow was fixed. A 1MB limit for period size was added and array_size() and array3_size() are used for multiplications to prevent integer overflow.

In the Linux kernel, a vulnerability was found in the access_ok() function on three architectures, where checking the end of a user access against the address limit does not account for possible integer overflow. Passing a negative length or another overflow returns success when it should not.

In the Linux kernel, there is a vulnerability involving integer overflow on 32-bit systems in the operation 'len * sizeof(*p)' in the NFSD module. This could lead to incorrect behavior or potential exploitation.

In the Linux kernel, a bug in the OCFS2 filesystem caused a crash when mounting with quota enabled. The issue occurred during initialization of dqi_gqlock when the corresponding dqi_type and dqi_sb were not properly initialized. The bug was introduced by commit 6c85c2c72819, which aimed to avoid accessing uninitialized variables in error cases. The fix properly initializes global quota info.