CVE Vulnerability Catalog

In the Linux kernel, in the crypto qat module, a parameter check was added for DH to reject requests with a source buffer larger than the key size. This prevents a possible integer underflow when copying the scatterlist.

In the Linux kernel, in the crypto qat module, a parameter check was added for RSA to reject requests with a source buffer larger than the key size. This prevents a possible integer underflow when copying the scatterlist.

In the Linux kernel, KVM for x86 has a vulnerability in updating guest PTE A/D bits. The use of mapping the PTE into kernel address space is broken for VM_PFNMAP, potentially leading to access to random page frames.

In the Linux kernel, the exFAT filesystem has a vulnerability causing an out-of-bounds read in exfat_clear_bitmap. The issue is triggered by a truncate operation with size 0, leading to memory corruption. The fix adds validation of cluster numbers before using them in bitmap operations.

In the Linux kernel, the Bluetooth hci_qca driver has a vulnerability where del_timer() is used instead of del_timer_sync() before freeing, which can lead to corruption of the timer list. Additionally, the wake_retrans_timer can be rearmed via the work queue.

In the Linux kernel, in the NTFS3 filesystem, validation was added for the sectors_per_clusters field in the BOOT sector. An overly large value can lead to negative shifts or shifts larger than the field size, causing a UBSAN error.

In the Linux kernel, in ALSA USB-audio, when closing a MIDI substream, there might be pending work that accesses the released runtime object. The fix cancels the pending work at closing.

In the Linux kernel, the lpfc (SCSI) driver had a null pointer dereference after failing to issue FLOGI and PLOGI. If FLOGI or PLOGI fails and there is pending dev-loss-evt work, the node may be released prematurely, leading to use-after-free.

In the Linux kernel, the ath11k driver has a buffer overflow vulnerability when processing Wi-Fi scan requests. The maximum number of SSIDs is reported as 16, but the scan_req_params structure can only hold 10, leading to overwriting the extraie pointer. The fix sets the maximum SSID and BSSID counts according to firmware capabilities.

A vulnerability in the Linux kernel's ath10k driver causes a double free crash during system suspend when the driver is in the RESTARTING state after firmware recovery. The issue occurs when a suspend event happens during the restart process, leading to two calls to ath10k_halt() and a kernel panic.

In the Linux kernel, the ASoC SOF subsystem for IPC3 topologies has an out-of-bounds access vulnerability in sof_get_control_data(). The function assumes bytes payload but can be called for other types, leading to incorrect memory reads.

In the Linux kernel, the fbdev defio driver has a vulnerability causing pagelist corruption due to a race between processes in fb_deferred_io_mkwrite() and fb_deferred_io_fault(). One process adds a page to the list while another initializes the same page without lock protection.

In the wl1251 WiFi driver in the Linux kernel, a vulnerability was found where stack parameters are used for DMA, which after the introduction of vmap'ed stacks leads to kernel panic. The issue occurs in several places in the driver, e.g., when accessed via SDIO, making it unusable on platforms like OpenPandora.

In the Linux kernel, the mt76 driver had a race condition leading to use-after-free on station removal. In a small race window, ongoing tx activity can cause an skb to be added to the status tracking idr after it has been cleaned up, keeping the wcid linked in the status poll list.

In the rtw89 driver (for WiFi cards), the rtw89_phy_cfo_parse() function did not validate mac_id before accessing an array, leading to an out-of-bounds read. The fix adds an index check before array access.

In the Linux kernel, the arm_scmi firmware subsystem has a vulnerability due to improper validation of the number of protocols during protocol list enumeration. The check uses a sum of unsigned integers that can overflow and bypass the validation. The fix avoids the addition in the validation.

In the f2fs filesystem in the Linux kernel, a vulnerability was found involving dereferencing a stale list iterator after the loop body. If no break is hit, the iterator becomes a bogus pointer, and dereferencing it (e.g., cur->page) could load out-of-bounds/undefined values, which may be exploited by an attacker.

In the Linux kernel's mac80211 module, a use-after-free was found in channel context (chanctx) code. After freeing the old context in ieee80211_vif_use_reserved_reassign(), further referencing it leads to UAF.

In the staging r8188eu WiFi driver in the Linux kernel, a vulnerability was found due to missing check before writing to the ->Ssid array in the rtw_wx_set_scan() function. There is a check to prevent read overflow, but no check to prevent writing beyond the end of the array, which can lead to buffer overflow.

In the f2fs filesystem in the Linux kernel, a vulnerability was found due to missing sanity check on block address in the f2fs_do_zero_range() function. After fuzzing the filesystem image, block mapping info in the inode can be inconsistent with the SIT table, leading to kernel panic when updating SIT with an invalid block address.