CVE Vulnerability Catalog

In the Linux kernel, the ath6kl driver has an out-of-bounds read vulnerability in the connect event handler. The firmware-controlled fields beacon_ie_len, assoc_req_len, and assoc_resp_len are not validated against buffer length, potentially causing OOB reads during IE parsing and corruption of wmi->is_wmm_enabled state.

In the Linux kernel, the ASoC tas2781 driver has an out-of-bounds read vulnerability when parsing firmware description strings. The parser uses strlen() without checking if the NUL terminator is present in the firmware buffer, which can cause reads past the end of the buffer with a malformed firmware image.

In the Linux kernel's ovpn, unlock_ovpn() uses llist_for_each_entry() to iterate over the release_list, but after freeing a peer inside the loop, it reads peer->release_entry.next after the peer may have been freed, leading to use-after-free.

In the Linux kernel's hwmon occ, the poll response parser uses the static backing-array capacity as the parse boundary instead of data_length, allowing reads beyond the current response when data is truncated.

In the Linux kernel's net/packet, packet_set_ring() may re-register the fanout hook after device unregistration if po->ifindex == -1 is not treated as an invalidated binding. This leads to re-adding the hook after the device has been unregistered.

A vulnerability was found in the Linux kernel's RDS (Reliable Datagram Sockets) subsystem. The destination socket lookup does not consider network namespaces, allowing a message to be delivered to a socket in a different namespace. This can lead to a use-after-free condition when the namespace is torn down, potentially causing a system crash or arbitrary code execution.

In the Linux kernel, the airoha network driver has a DMA direction bug for the NPU mailbox buffer. airoha_npu_send_msg() always maps the buffer with DMA_TO_DEVICE, but some callers expect the NPU to write response data back into the same buffer. On non-cache-coherent architectures, this can lead to reading stale data.

In the Linux kernel, a vulnerability in the iommu/amd driver was found in the iommu_completion_wait() function due to incorrect handling of the need_sync flag. In a multi-CPU scenario, the function could return early without waiting for all previously queued commands to complete, violating the synchronization contract.

In the Linux kernel, the mwifiex driver lacks validation of event length supplied by firmware, leading to potential out-of-bounds read or integer underflow when handling station association events in AP mode.

A vulnerability in the Linux kernel's TIPC subsystem affects the UDP replicast list. List updates were not serialized, which could lead to list corruption and a kernel panic. The issue is a race between adding entries from a softirq and deleting them during bearer cleanup.

In the Linux kernel, a vulnerability in the SCTP protocol involves an incorrect capacity check of the auth_chunk_list in sctp_auth_ep_add_chunkid. The limit set to 20 entries is larger than the actual capacity of the destination structure (16 entries), which can lead to a buffer overflow during copying in sctp_association_init().

In the Linux kernel, errors were detected in the element size calculation during command stream validation in the ethosu accelerator. For NHWC format, the element size is missing, and for OFM different precision bits are used than for IFM/IFM2, leading to an undersized calculation. This can result in improper validation and potential buffer overflow.

A vulnerability in the Linux kernel's SCTP implementation was found. The sctp_process_strreset_inreq() function does not validate the stream count in a RESET_IN_REQUEST from a peer, which can cause an overflow when generating the RESET_OUT_REQUEST. On interfaces with MTU larger than 65535 bytes (e.g., loopback with IPv6 jumbograms), this can lead to a __u16 overflow, undersized skb allocation, and a kernel BUG.

In the Linux kernel, a resource leak was detected in the mctp i3c module during failed driver registration. If I3C driver registration fails, the notifier and mctp_i3c_bus objects are not cleaned up, leading to memory leaks and leaving a notifier pointing into a module that failed to load. The fix adds cleanup in the error path.

In the Linux kernel, the drm/xe driver for Intel GPUs has a vulnerability due to missing drm_dev guards when detaching CCS read/write buffers. In certain scenarios, buffers are freed after the device is unbound, leading to a NULL pointer dereference and system crash.

In the Linux kernel vmxnet3 driver, vmxnet3_get_hdr_len() triggers BUG_ON for Geneve packets when the descriptor indicates an inner header instead of the outer. The fix checks the VMXNET3_RCD_HDR_INNER_SHIFT flag and safely returns 0 instead of triggering BUG_ON.

In the Linux kernel, in the DRM/XE driver for Intel GPUs, a memory leak was discovered in xe_vm_create(). On a reservation object allocation failure, resources initialized by xe_svm_init() are not freed, leading to memory leaks in both fault-mode and non-fault-mode VMs.

In the Linux kernel TIPC subsystem, MTU validation for media and bearers lacks an upper bound check, allowing values above U16_MAX, leading to truncation and division by zero. The fix rejects MTU values above U16_MAX.

In the Linux kernel for LoongArch, the BPF JIT sign-extends signed ALU32 div/mod results, leaving upper 32 bits set, inconsistent with the verifier model. The fix adds zero-extension of the result after the divide/modulo operation.

In the Linux kernel QRTR subsystem, socket creation is not restricted to the initial network namespace, allowing unprivileged processes in other namespaces to send QRTR datagrams to sockets in other namespaces, breaking isolation. The fix confines the socket family to the initial network namespace.