CVE Vulnerability Catalog

In the Linux kernel Bluetooth MGMT subsystem, a use-after-free vulnerability exists. The MGMT_OP_LOAD_CONN_PARAM operation stores a pointer to an hci_conn_params entry that can be freed by a subsequent request before the queued work executes. The fix stores a reference to hci_conn and revalidates parameters when the work runs.

In the Linux kernel's Bluetooth subsystem (hci_sync), a vulnerability was found where RCU-protected pointers are used outside critical sections without proper refcounting, potentially leading to use-after-free. The fix extends critical sections and adds rcu_read_lock() where needed.

In the Linux kernel's Bluetooth subsystem (mgmt), a locking issue was found in unpair_device and disconnect_sync. Dereferencing RCU-protected pointers outside critical sections can lead to use-after-free. The fix adds hdev->lock for hci_conn lookup and hci_abort_conn().

In the Linux kernel's Bluetooth subsystem (mgmt), a vulnerability was found where hci_conn is not properly referenced in mgmt_pending_cmds. Dereferencing RCU-protected pointers outside critical sections can lead to use-after-free. The fix adds appropriate locks and refcounting.

In the Linux kernel's Bluetooth subsystem (hci_sync), an issue was found where hdev->lock is not held during hci_conn_params lookups. Without this lock, list iteration or parameter access is not safe. The fix adds hdev->lock for parameter lookups.

In the Linux kernel, the Bluetooth hci_qca driver has a use-after-free vulnerability when handling an invalid dump size from the controller. When the controller reports a zero dump size, the error path frees the local object but does not clear the pointer in the qca structure, leading to later access to freed memory.

In the Linux kernel, the CAN raw subsystem has a race condition when modifying bitfield flags in the raw_sock structure. Read-modify-write operations in raw_setsockopt() can be executed concurrently, leading to unpredictable behavior.

In the Linux kernel, a vulnerability was found in the DRM/XE driver related to VF (Virtual Function) CCS attach/detach operations during BO (Buffer Object) moves. The issue is a race condition where CCS batch buffers are attached or detached without proper synchronization with the copy fence, leading to potential data corruption or incorrect behavior during VF migration.

In the Linux kernel, the DRM xe driver (drm/xe/guc) has a use-after-free vulnerability in the scheduler. The pointer to the queue name (q->name) is freed with the queue, while the scheduler may still reference it.

A vulnerability was found in the Linux kernel DRM/XE driver for Intel GPUs, related to the GuC execution queue. Queue destruction can run asynchronously, risking a deadlock during resource cleanup. The fix holds a device reference for the queue lifetime and moves destroy work to a dedicated workqueue.

In the Linux kernel, the accel/amdxdna driver has a use-after-free vulnerability of the mm_struct in the job scheduler. The pointer to mm_struct is stored without holding a reference, which can lead to access to freed memory during job execution.

In the Linux kernel, a TIME_WAIT socket reference leak was found on PSP policy failure in IPv4 and IPv6 receive paths. The missing release leads to memory leak of tcp_tw_bucket structures.

A use-after-free vulnerability was found in the Linux kernel's net/sched/act_tunnel_key module. The tunnel_key_release_params() function releases the metadata_dst of old parameters synchronously via dst_release(), while the params structure is freed asynchronously via kfree_rcu(). A concurrent reader in tunnel_key_act() may still hold a pointer to the old parameters and call dst_clone() after dst_release() has marked the dst as RCUREF_DEAD, leading to access to freed memory.

In the Linux kernel, the auth_hmacs array size in struct sctp_cookie is miscalculated, causing out-of-bounds copy during SCTP association initialization. This can corrupt the adjacent auth_chunks field, accept an invalid HMAC identifier, and lead to out-of-bounds read in sctp_auth_get_hmac().

In the Linux kernel, the USB subsystem lacks synchronization in bos_descriptors_read(), which accesses udev->bos. This field can be concurrently freed in usb_reset_and_verify_device(), leading to a race condition.

In the Linux kernel, the at76c50x-usb driver has a length underflow vulnerability in at76_guess_freq(). If a frame is shorter than the expected offset, the calculated IE length wraps, leading to an out-of-bounds read during scanning.

In the Linux kernel, the usb: musb: omap2430 driver's omap2430_probe() calls of_node_put() on a borrowed of_node pointer, leading to an unbalanced reference count for the platform device node.

In the Linux kernel, the USB gadget dummy_hcd driver has a vulnerability involving reuse of a shared USB request (fifo_req) during request giveback. An attacker can exploit a race condition between threads, leading to overwriting a callback function pointer and causing a page fault or general protection fault (GPF) in the kernel.

In the Linux kernel, the firewire net driver has a vulnerability in fragmented datagram reassembly. The fwnet_frag_new() function keeps a sorted list of received fragments. When checking adjacency, the code assumes the current fragment always has a real next or previous fragment, but at list edges it may be the list head, leading to incorrect merging of ranges. As a result, fwnet_pd_is_complete() may miss a complete datagram.

In the Linux kernel, the ath6kl driver has an out-of-bounds read vulnerability in the TX complete event handler. The firmware-controlled num_msg field (u8, 0-255) drives the loop without validation against buffer length, allowing reads up to 1020 bytes past the WMI event buffer.