CVE Vulnerability Catalog

In the Linux kernel, the ASoC tas2562 driver's tas2562_volume_control_put() function does not validate the value written by userspace. This value is used as an index into a fixed-size array, which can lead to buffer overflow and writing incorrect data to the device.

A vulnerability in the Linux kernel's ASoC SOF subsystem affects IPC payload handling for copier widgets. After suspend/resume, the ipc_config_data buffer is not refreshed, causing stale DMA channel assignments to be sent to firmware, leading to errors and crashes. The fix refreshes copier_data and dma_config_tlv before sending the IPC message.

In the Linux kernel, the optee ffa driver's optee_ffa_lend_protmem function does not check if the allocated pointer is NULL. Under memory pressure, this can lead to a null pointer dereference.

In the Linux kernel, the clk spacemit k3 driver does not mark the HDMA clock as critical. This clock is responsible for the internal TCM access path of the X100 RISC-V core, and turning it off can cause the system to hang, e.g., on a page fault during vector access.

In the Linux kernel, the crypto tegra driver's tegra_gcm_do_one_req() function incorrectly calculates rctx->cryptlen, which can lead to a write beyond the rctx->dst_sg buffer during decryption if ctx->authsize remains zero.

In the Linux kernel, the af_unix function unix_del_edge() does not unlink the scc_entry before freeing the vertex, which can lead to partial freeing of a dead SCC by the garbage collector, causing errors.

In the Linux kernel, the ovpn driver's ovpn_crypto_kill_key function assumes both crypto slots are populated and dereferences each slot before checking it. This can lead to a NULL pointer dereference when a peer has only one key or when the key to be removed is not present.

In the Linux kernel, the ovpn driver's crypto completion callbacks hold references to the key slot and peer. If the peer reference is released before the callback finishes, it can lead to use-after-free or scheduling an RCU callback after rcu_barrier has run, risking a crash.

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of the host application via crafted prompt inputs that cause the model to generate executable Python expressions evaluated without a sandbox.

In the Linux kernel, the SCSI core subsystem reads the shost->eh_noresume flag twice in one error handling iteration, which can lead to unmatched runtime PM get and put calls, causing a usage count underflow.

In the Linux kernel, the perf subsystem's perf_event_open() accepts events in the EXIT state as group leaders, which can lead to use-after-free when the leader is closed and a new sibling retains a pointer to the freed event.

In the Linux kernel's SCTP protocol, the COOKIE_ECHO state restoration does not properly validate AUTH fields (RANDOM, HMACS, CHUNKS) originating from peer-controlled cookie bytes. Forged lengths or identifiers can lead to out-of-bounds reads and even a write past a buffer, potentially enabling local privilege escalation.

In the Linux kernel for RISC-V, the ZBB-optimized strnlen loop may read one word past the count boundary when the start address is aligned and count is a multiple of word size. This can cause a page fault if the next page is unmapped.

In the Linux kernel's ovpn module, key slot crypto freeing is performed from an RCU callback, which is unsafe because crypto_free_aead can sleep (e.g., for hardware implementations). The fix defers the freeing to a workqueue where sleeping is allowed.

In the Linux kernel's rseq mechanism, rseq_grant_timeslice_extension() calls hrtimer_rearm_deferred_tif() with interrupts enabled, while __hrtimer_rearm_deferred() expects interrupts disabled. This can lead to a livelock and is caught by lockdep.

A vulnerability in the Linux kernel netfilter ipset module involves a race condition between list:set garbage collection and set swap operations. The issue causes a reference count decrement on a set whose reference has already moved to another index, leading to a BUG_ON and kernel panic.

In the Linux kernel's IPVS module, ip_vs_nat_icmp() does not revalidate the ihl field after reading from skb fragments, which can lead to out-of-bounds access. A local process can change the ihl field, causing issues in ip_send_check() calls.

In the Linux kernel, the netfilter flowtable module has a vulnerability where the original-direction tuple node is published before the reply node, allowing the garbage collector to observe and free a flow while it is still being installed. This can lead to slab-use-after-free in the flowtable/rhashtable path, detected by KASAN.

In the Linux kernel, the bnxt driver has a deadlock vulnerability when canceling the IRQ affinity notifier. The notifier restarts the queue under the netdev instance lock, and cancellation waits for the callback, causing a deadlock.

In the Linux kernel, ipvlan interfaces do not inherit needed_headroom and needed_tailroom from the physical device, which can lead to insufficient space reservation for headers and trailers. This results in buffer overflows, headroom underflows, or KASAN slab-use-after-free crashes.