CVE Vulnerability Catalog

In the Linux kernel, the USB gadget dummy_hcd driver has a vulnerability involving reuse of a shared USB request (fifo_req) during request giveback. An attacker can exploit a race condition between threads, leading to overwriting a callback function pointer and causing a page fault or general protection fault (GPF) in the kernel.

In the Linux kernel, the firewire net driver has a vulnerability in fragmented datagram reassembly. The fwnet_frag_new() function keeps a sorted list of received fragments. When checking adjacency, the code assumes the current fragment always has a real next or previous fragment, but at list edges it may be the list head, leading to incorrect merging of ranges. As a result, fwnet_pd_is_complete() may miss a complete datagram.

In the Linux kernel, the ath6kl driver has an out-of-bounds read vulnerability in the TX complete event handler. The firmware-controlled num_msg field (u8, 0-255) drives the loop without validation against buffer length, allowing reads up to 1020 bytes past the WMI event buffer.

In the Linux kernel, the ath6kl driver has an out-of-bounds read vulnerability in the connect event handler. The firmware-controlled fields beacon_ie_len, assoc_req_len, and assoc_resp_len are not validated against buffer length, potentially causing OOB reads during IE parsing and corruption of wmi->is_wmm_enabled state.

In the Linux kernel, the ASoC tas2781 driver has an out-of-bounds read vulnerability when parsing firmware description strings. The parser uses strlen() without checking if the NUL terminator is present in the firmware buffer, which can cause reads past the end of the buffer with a malformed firmware image.

In the Linux kernel's ovpn, unlock_ovpn() uses llist_for_each_entry() to iterate over the release_list, but after freeing a peer inside the loop, it reads peer->release_entry.next after the peer may have been freed, leading to use-after-free.

In the Linux kernel's hwmon occ, the poll response parser uses the static backing-array capacity as the parse boundary instead of data_length, allowing reads beyond the current response when data is truncated.

In the Linux kernel's net/packet, packet_set_ring() may re-register the fanout hook after device unregistration if po->ifindex == -1 is not treated as an invalidated binding. This leads to re-adding the hook after the device has been unregistered.

A vulnerability was found in the Linux kernel's RDS (Reliable Datagram Sockets) subsystem. The destination socket lookup does not consider network namespaces, allowing a message to be delivered to a socket in a different namespace. This can lead to a use-after-free condition when the namespace is torn down, potentially causing a system crash or arbitrary code execution.

In the Linux kernel, the airoha network driver has a DMA direction bug for the NPU mailbox buffer. airoha_npu_send_msg() always maps the buffer with DMA_TO_DEVICE, but some callers expect the NPU to write response data back into the same buffer. On non-cache-coherent architectures, this can lead to reading stale data.

In the Linux kernel, a vulnerability in the iommu/amd driver was found in the iommu_completion_wait() function due to incorrect handling of the need_sync flag. In a multi-CPU scenario, the function could return early without waiting for all previously queued commands to complete, violating the synchronization contract.

In the Linux kernel, the mwifiex driver lacks validation of event length supplied by firmware, leading to potential out-of-bounds read or integer underflow when handling station association events in AP mode.

A vulnerability in the Linux kernel's TIPC subsystem affects the UDP replicast list. List updates were not serialized, which could lead to list corruption and a kernel panic. The issue is a race between adding entries from a softirq and deleting them during bearer cleanup.

In the Linux kernel, a vulnerability in the SCTP protocol involves an incorrect capacity check of the auth_chunk_list in sctp_auth_ep_add_chunkid. The limit set to 20 entries is larger than the actual capacity of the destination structure (16 entries), which can lead to a buffer overflow during copying in sctp_association_init().

In the Linux kernel, errors were detected in the element size calculation during command stream validation in the ethosu accelerator. For NHWC format, the element size is missing, and for OFM different precision bits are used than for IFM/IFM2, leading to an undersized calculation. This can result in improper validation and potential buffer overflow.

A vulnerability in the Linux kernel's SCTP implementation was found. The sctp_process_strreset_inreq() function does not validate the stream count in a RESET_IN_REQUEST from a peer, which can cause an overflow when generating the RESET_OUT_REQUEST. On interfaces with MTU larger than 65535 bytes (e.g., loopback with IPv6 jumbograms), this can lead to a __u16 overflow, undersized skb allocation, and a kernel BUG.

In the Linux kernel, a resource leak was detected in the mctp i3c module during failed driver registration. If I3C driver registration fails, the notifier and mctp_i3c_bus objects are not cleaned up, leading to memory leaks and leaving a notifier pointing into a module that failed to load. The fix adds cleanup in the error path.

In the Linux kernel, the drm/xe driver for Intel GPUs has a vulnerability due to missing drm_dev guards when detaching CCS read/write buffers. In certain scenarios, buffers are freed after the device is unbound, leading to a NULL pointer dereference and system crash.

In the Linux kernel vmxnet3 driver, vmxnet3_get_hdr_len() triggers BUG_ON for Geneve packets when the descriptor indicates an inner header instead of the outer. The fix checks the VMXNET3_RCD_HDR_INNER_SHIFT flag and safely returns 0 instead of triggering BUG_ON.

In the Linux kernel, in the DRM/XE driver for Intel GPUs, a memory leak was discovered in xe_vm_create(). On a reservation object allocation failure, resources initialized by xe_svm_init() are not freed, leading to memory leaks in both fault-mode and non-fault-mode VMs.