CVE Vulnerability Catalog

In the Linux kernel, the cls_u32 classifier lacks validation of the offshift value, allowing shift-out-of-bounds during packet classification. An unprivileged user can trigger undefined behavior via user/network namespaces.

A memory leak in the Linux kernel's UDP tunnel NIC offload code (udp_tunnel_nic) was found. When network device registration fails, udp_tunnel_nic_unregister() returns early without freeing the allocated structure, causing a permanent leak. The fix removes the early return and synchronously cancels pending work before freeing memory.

In the Linux kernel, the netfs subsystem has a folio_queue allocation failure during writeback, causing a warning and potential crash. A mempool and gfp_t flags passing were added to handle allocation failures.

In the Linux kernel, Bluetooth ISO has a use-after-free vulnerability when detaching a connection from hcon. Failure to clear iso_data leads to later use after memory free.

In the Linux kernel, Bluetooth L2CAP has a use-after-free vulnerability in l2cap_le_connect_rsp. The channel is obtained without holding a reference, allowing a concurrent disconnect to free it, leading to use-after-free.

In the Linux kernel, Bluetooth ISO function iso_sock_getname does not hold the socket lock when accessing the conn field, leading to a race condition and potential use-after-free.

In the Linux kernel, Bluetooth ISO function iso_connect_ind does not hold the socket lock when accessing the conn field, leading to a race condition and potential use-after-free. Additionally, conn may be NULL if the socket has changed state.

In the Linux kernel, Bluetooth ISO function iso_conn_ready does not properly hold a reference to the socket when accessing conn->sk, leading to a use-after-free if the socket is concurrently closed.

In the Linux kernel, in the Bluetooth ISO subsystem, a socket reference leak was found after socket release. The early return condition in iso_sock_kill() is always true because sock_orphan() sets SOCK_DEAD, so the reference is never released and the socket destructor is never called. Additionally, the reference leaks when __iso_sock_close() does not set SOCK_ZAPPED, since iso_conn_del() does not call iso_sock_kill() after zapping.

In the Linux kernel, in the Bluetooth ISO subsystem, a potential deadlock was found in iso_sock_timeout(), which takes lock_sock and then synchronously disables the timer, potentially causing a deadlock. Additionally, iso_sock_timeout() may run concurrently with iso_conn_del(), leading to use-after-free (UAF) — one thread frees the hcon structure while another tries to access it.

In the Linux kernel, in the Bluetooth ISO subsystem, a reference counting bug was found in the iso_conn structure. A race between iso_conn_del() and iso_chan_del() can lead to a double-put of iso_conn, resulting in use-after-free (UAF). The issue stems from an extra put in iso_conn_del() for the case when iso_chan_add() fails.

In the Linux kernel, in the Bluetooth ISO subsystem, a race condition was found between kfree and kref_get_unless_zero on the hci_conn::iso_data field, which is accessed and modified without synchronization (lock or RCU). This can lead to use-after-free (UAF) and races between iso_conn_add() and iso_conn_free().

In the Linux kernel, in the Bluetooth subsystem (btintel driver), a missing length validation before accessing tlv->val[0] in btintel_diagnostics() was found. This can lead to reading data beyond the received frame, resulting in information disclosure or a crash.

In the Linux kernel, in the Bluetooth subsystem (hci_conn), a theoretical use-after-free (UAF) vulnerability was found in abort_conn_sync() if the connection (conn) is freed while the hci_sync task is running. There is no reference held to the connection.

In the Linux kernel, in the Bluetooth subsystem (hci_sync), a theoretical use-after-free (UAF) vulnerability was found in hci_connect_big_sync() if the connection (conn) is freed while the hci_sync task is running. There is no reference held to the connection. Additionally, if hcon is NULL, the function returns 0 and does nothing to match previous behavior.

In the Linux kernel, in the Bluetooth subsystem (hci_sync), a theoretical use-after-free (UAF) vulnerability was found in hci_connect_pa_sync() if the connection (conn) is freed while the hci_sync task is running. There is no reference held to the connection.

In the Linux kernel, in the Bluetooth subsystem (hci_sync), a theoretical use-after-free (UAF) vulnerability was found in hci_past_sync() if the connection (conn) is freed while the hci_sync task is running. This can lead to passing freed pointers to hci_conn_valid(), which kmalloc may have reused.

In the Linux kernel, in the octeontx2-af subsystem, a vulnerability was found that allows virtual functions (VFs) to overwrite special CGX PKIND state. When HiGig2 or EDSA parsing is enabled, a VF NIX LF allocation must not reset the LMAC RX PKIND or default TX parse config over the PF setup. Missing permission-checking functions.

In the Linux kernel, a potential deadlock was found in the mpi3mr driver in mpi3mr_fault_uevent_emit(). This function runs from the fault watchdog and reset paths where host I/O may already be blocked. GFP_KERNEL allocations, both local and inside kobject_uevent_env(), can trigger reclaim that waits on blocked I/O and deadlocks.

In the Linux kernel, a memory leak was found in the sxgbe network driver: when RX descriptor ring allocation fails, init_dma_desc_rings() only frees the partially allocated RX rings and returns, leaking the TX rings that were allocated earlier in the same function.