CVE Vulnerability Catalog

A use-after-free (UAF) vulnerability was found in the Linux kernel's sk_clone() function for BPF sockets. On early bailout, the pointer to the parent socket's BPF storage remains in the cloned socket, leading to its deallocation when the clone is freed and subsequent use of freed memory by the parent socket.

A use-after-free vulnerability exists in the Linux kernel's PPP subsystem, specifically in the pppol2tp receive path. The issue arises from missing RCU grace period before freeing the internal PPP channel, potentially leading to memory corruption. The bug is reachable by an unprivileged user.

A vulnerability was found in the Linux kernel's net/iucv subsystem where a socket found in afiucv_hs_rcv() is not properly referenced. After releasing the lock, the socket can be closed and freed before the event handler uses it, leading to use-after-free.

In the Linux kernel Bluetooth MGMT subsystem, a use-after-free vulnerability exists. The MGMT_OP_LOAD_CONN_PARAM operation stores a pointer to an hci_conn_params entry that can be freed by a subsequent request before the queued work executes. The fix stores a reference to hci_conn and revalidates parameters when the work runs.

In the Linux kernel's Bluetooth subsystem (hci_sync), a vulnerability was found where RCU-protected pointers are used outside critical sections without proper refcounting, potentially leading to use-after-free. The fix extends critical sections and adds rcu_read_lock() where needed.

In the Linux kernel's Bluetooth subsystem (mgmt), a locking issue was found in unpair_device and disconnect_sync. Dereferencing RCU-protected pointers outside critical sections can lead to use-after-free. The fix adds hdev->lock for hci_conn lookup and hci_abort_conn().

In the Linux kernel's Bluetooth subsystem (mgmt), a vulnerability was found where hci_conn is not properly referenced in mgmt_pending_cmds. Dereferencing RCU-protected pointers outside critical sections can lead to use-after-free. The fix adds appropriate locks and refcounting.

In the Linux kernel's Bluetooth subsystem (hci_sync), an issue was found where hdev->lock is not held during hci_conn_params lookups. Without this lock, list iteration or parameter access is not safe. The fix adds hdev->lock for parameter lookups.

In the Linux kernel, the Bluetooth hci_qca driver has a use-after-free vulnerability when handling an invalid dump size from the controller. When the controller reports a zero dump size, the error path frees the local object but does not clear the pointer in the qca structure, leading to later access to freed memory.

In the Linux kernel, the CAN raw subsystem has a race condition when modifying bitfield flags in the raw_sock structure. Read-modify-write operations in raw_setsockopt() can be executed concurrently, leading to unpredictable behavior.

In the Linux kernel, a vulnerability was found in the DRM/XE driver related to VF (Virtual Function) CCS attach/detach operations during BO (Buffer Object) moves. The issue is a race condition where CCS batch buffers are attached or detached without proper synchronization with the copy fence, leading to potential data corruption or incorrect behavior during VF migration.

In the Linux kernel, the DRM xe driver (drm/xe/guc) has a use-after-free vulnerability in the scheduler. The pointer to the queue name (q->name) is freed with the queue, while the scheduler may still reference it.

A vulnerability was found in the Linux kernel DRM/XE driver for Intel GPUs, related to the GuC execution queue. Queue destruction can run asynchronously, risking a deadlock during resource cleanup. The fix holds a device reference for the queue lifetime and moves destroy work to a dedicated workqueue.

In the Linux kernel, the accel/amdxdna driver has a use-after-free vulnerability of the mm_struct in the job scheduler. The pointer to mm_struct is stored without holding a reference, which can lead to access to freed memory during job execution.

In the Linux kernel, a TIME_WAIT socket reference leak was found on PSP policy failure in IPv4 and IPv6 receive paths. The missing release leads to memory leak of tcp_tw_bucket structures.

A use-after-free vulnerability was found in the Linux kernel's net/sched/act_tunnel_key module. The tunnel_key_release_params() function releases the metadata_dst of old parameters synchronously via dst_release(), while the params structure is freed asynchronously via kfree_rcu(). A concurrent reader in tunnel_key_act() may still hold a pointer to the old parameters and call dst_clone() after dst_release() has marked the dst as RCUREF_DEAD, leading to access to freed memory.

In the Linux kernel, the auth_hmacs array size in struct sctp_cookie is miscalculated, causing out-of-bounds copy during SCTP association initialization. This can corrupt the adjacent auth_chunks field, accept an invalid HMAC identifier, and lead to out-of-bounds read in sctp_auth_get_hmac().

In the Linux kernel, the USB subsystem lacks synchronization in bos_descriptors_read(), which accesses udev->bos. This field can be concurrently freed in usb_reset_and_verify_device(), leading to a race condition.

In the Linux kernel, the at76c50x-usb driver has a length underflow vulnerability in at76_guess_freq(). If a frame is shorter than the expected offset, the calculated IE length wraps, leading to an out-of-bounds read during scanning.

In the Linux kernel, the usb: musb: omap2430 driver's omap2430_probe() calls of_node_put() on a borrowed of_node pointer, leading to an unbalanced reference count for the platform device node.