CVE Vulnerability Catalog

In the Linux kernel's staging rtl8723bs driver, the WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg_txt buffer, potentially causing overflow or underfill.

In the Linux kernel's staging rtl8723bs driver, rtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and reads the 802.11 frame control field without checking that a base 802.11 header remains, potentially causing out-of-bounds reads or insufficient data.

In the Linux kernel's fastrpc module, there is a potential race condition during buffer unmap operations. The buffer is removed from the list only after the unmap operation, which can cause issues when multiple threads invoke unmap concurrently. The fix moves the list removal before the unmap, re-adding the buffer if unmap fails.

In the Linux kernel's fastrpc module, the fl->lock is not held when moving memory mappings after an interrupted invoke. The list_del() and list_add_tail() operations run without this lock, which can cause races with other operations on the mmaps list. The fix adds the lock around the move.

In the Linux kernel's DAMON_LRU_SORT module, there is a division by zero vulnerability when the active_mem_bp parameter is set to a value greater than 10000. The target value for cold memory is calculated as '10000 - active_mem_bp + 2', which becomes zero for 10002, causing a divide error. The fix returns an error when starting DAMON with >10000.

In the Linux kernel's DAMON module, there is an issue with folios when the migration target is invalid (e.g., NUMA_NO_NODE). Functions damon_pa_migrate() and damos_va_migrate() isolate folios, but when target_nid is invalid, folios are not returned to the LRU, causing reference leaks and pages staying off the LRU. The fix adds putting folios back on the invalid-nid path.

A vulnerability in the Linux kernel's DAMON_SAMPLE_MTIER sample module allows a user to trigger a division by zero in damos_quota_score(). This occurs when the node0_mem_free_bp or node0_mem_used_bp parameter is set to zero, leading to a kernel Oops and potential system crash.

In the Linux kernel's ALSA USB driver, there is a use-after-free (UAF) vulnerability in delayed release of MIDI2 endpoints. The previous fix for UAF in ump_to_endpoint() causes another UAF because it tries to dereference the UMP endpoint object, which may already be released in a delayed context. The fix adds private_free to clear associated data.

In the Linux kernel, the ALSA usx2y driver (for USB US-X2Y sound cards) lacks offset validation in the mmap function for the hwdep interface. An attacker can supply an arbitrary offset, leading to access to kernel memory outside the allocated region, and in extreme cases to a system oops.

A vulnerability in the Linux kernel's ALSA FCP driver causes an out-of-bounds write in fcp_meter_ctl_get(). The issue stems from an incorrect map size limit (255 instead of 128), allowing writes beyond the allocated buffer. An attacker with CAP_SYS_RAWIO can install an oversized map, and any process with access to /dev/snd/controlC0 can trigger the out-of-bounds write.

In the Linux kernel, the ALSA driver for the us144mkii device has a use-after-free vulnerability. When resubmitting capture URBs in capture_urb_complete(), the URBs were not re-anchored, leaving the anchor list empty after the first completion. This caused cleanup functions like tascam_free_urbs() to fail to stop the URBs, leading to writes to freed memory and dereferencing of a freed driver object.

In the Linux kernel, the V3D DRM driver (drm/v3d) has a vulnerability due to lack of serialization of timeout handlers for different hardware queues (BIN, RENDER, TFU, CSD). Since the reset is global, concurrent timeout handling can lead to inconsistent job credit counts, resulting in GPU hang and UI freeze.

A use-after-free vulnerability was found in the Linux kernel's perf subsystem, related to improper sibling event detachment from a group. When a sibling event is detached (e.g., during CPU hot-unplug), its group_leader pointer remains pointing to the old leader, which may be freed, leading to dereferencing freed memory during a PERF_IOC_FLAG_GROUP ioctl. The issue was reproduced by running the perf event fuzzer, CPU hotplug, and a stress workload concurrently.

A race condition between event_define_fields() and update_event_fields() in the Linux kernel was found during concurrent module loading. Lack of event_mutex protection for the event field list in trace_event_update_all() can lead to a kernel panic.

In the Linux kernel fbdev driver, the bit_cursor() function did not validate the glyph index read from the screen buffer, which could lead to an out-of-bounds memory read. The issue was reported by Syzkaller and affects the write path to /dev/vcsa.

In the Linux kernel, ring_buffer_subbuf_order_set() frees buffer pages, which is not allowed when resizing is disabled. A non-consuming reader is at risk of use-after-free in rb_advance_iter(). The function now returns -EBUSY when resize_disabled is set, matching ring_buffer_resize() behavior.

In the Linux kernel, a NULL pointer dereference occurs in the tracing module when removing events from the module cache. A module-specific event filter such as ':mod:foo' is cached with a NULL pointer when the module is not loaded. A later attempt to remove a specific match from the same module passes this NULL to strcmp(), causing a NULL pointer dereference.

A subtle race condition in the Linux kernel's huge_zero_folio implementation can cause the huge_zero_pfn to be overwritten with an invalid sentinel value by the shrinker, leading to misidentification of the huge zero page as a regular THP folio. This may result in incorrect splitting and handling of the huge zero folio.

In the Linux kernel, smc_rx_splice() has a lifetime imbalance issue for splice entries. The function passes pages to splice_to_pipe() before taking references, which can lead to use-after-free due to refcount underflow.

In the Linux kernel, in6_dev_get() can resurrect an inet6_dev object after it has been freed. It reads dev->ip6_ptr under RCU and then unconditionally increments its refcount. If device teardown clears the pointer and drops the last reference between these operations, the increment can resurrect an object whose RCU free has already been queued, leading to use-after-free.