CVE Vulnerability Catalog

In the Linux kernel for RISC-V, a vulnerability was found causing out-of-bounds page-table walk during memory hot-remove. Functions remove_pud_mapping() and remove_p4d_mapping() obtain a child table base with offset 0, then add the index for addr. With page-table folding, this can walk past the parent table and pass an invalid page to __free_pages(), causing a kernel BUG.

A deadlock was found in the qede driver of the Linux kernel during recovery after a TX timeout on NICs with VXLAN/GENEVE tunnel ports configured. The recovery process tries to re-lock the same mutex (qede_lock), causing the entire rtnetlink control plane to wedge and many system services to hang.

In the Linux kernel's SMB server (ksmbd), a use-after-free vulnerability was found in __close_file_table_ids(). A ksmbd_file can remain alive after logical close while another session holds a temporary reference. When the foreign holder performs the final put, the object is freed without being removed from its owner's idr, leading to a stale pointer dereference during file-table teardown.

In the Linux kernel's SMB server (ksmbd), a vulnerability was found in the comparison of ClientGUIDs. ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. Using strncmp() stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equal.

In the Linux kernel's iommu/iommufd subsystem, a use-after-free vulnerability was found in IOPF group ownership. IOPF groups are linked into the generic pending list before invoking the domain fault handler, and after acceptance they are also queued in the IOMMUFD deliver list without removal from the generic list. When detach or HWPT replacement drops the device's IOPF reference count to zero, groups can be freed, and later access leads to UAF.

In the Linux kernel's pinctrl subsystem for devicetree, a vulnerability was found causing freeing of uninitialized dev_name on error path. dt_remember_or_free_map() duplicates dev_name for each map entry. If kstrdup_const() fails, dt_free_map() frees dev_name in all entries, including uninitialized ones, leading to a double-free.

A vulnerability in the Linux kernel's hugetlb mechanism causes list corruption in allocate_file_region_entries(). The issue stems from using list_splice() instead of list_splice_init(), which under concurrent access to a shared mapping can lead to memory corruption or a system panic.

A vulnerability in the Linux kernel's KVM for x86 was found, involving delayed EOI (End of Interrupt) processing by the I/O APIC. If the delayed EOI work is processed after vCPUs are destroyed, a use-after-free (UAF) occurs, potentially leading to system crash or code execution.

A vulnerability in the Linux kernel's KVM/SVM was found where x2APIC MSR intercepts are not updated for L1 when AVIC is inhibited while L2 is active. This allows L1 to read host APIC state, send arbitrary interrupts, and change task priority, potentially leading to a host DoS.

In the Linux kernel, in the KVM subsystem for s390 architecture in PCI handling, a vulnerability was found where a request to enable interrupt forwarding is not rejected if it is already enabled for the zPCI device. The MPCIFC instruction does not allow re-registering interrupts without first unregistering. The fix adds a proper check, preventing overwriting and resource leaks when the ioctl is called multiple times for the same device.

In the Linux kernel, in the KVM subsystem for s390 architecture in PCI handling, a memory accounting issue was found for pinned/unpinned pages. The account_mem() and unaccount_mem() functions call get_uid() which increments the reference count of struct user_struct on every invocation, but free_uid() is not called to decrement it. Additionally, accounting is done against current->mm, which may be incorrect when unaccount_mem() is called from a different process context than the one that originally pinned the pages. The fix stores the pinning process's user_struct and mm_struct and frees these resources when unpinning.

A use-after-free vulnerability was found in the Linux kernel's dibs layer, affecting attach/detach/unregister operations for dmb_node in loopback mode. The issue stems from a race between hash table lookup and refcount operations, potentially leading to use of freed memory. The fix makes refcount transitions and hash table removal atomic under the write lock.

In the Linux kernel, in the audit module, a potential use-after-free vulnerability was found in audit_del_rule(). This function destroys e->rule.exe via audit_remove_mark_rule() before unlinking the rule from RCU-visible filter lists and waiting for a grace period. Concurrent readers in audit_filter() and audit_filter_rules() still dereference e->rule.exe, while the fsnotify mark can be freed on an independent lifetime path. The fix unlinks the rule from RCU-visible lists and invokes synchronize_rcu() before calling audit_remove_mark_rule() and other rule removal helpers.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

In the Linux kernel, in the Bluetooth subsystem (mgmt), a use-after-free vulnerability was found in pair command cancellation. The pairing completion and authentication failure callbacks look up the pending MGMT_OP_PAIR_DEVICE command by walking hdev->mgmt_pending, but without holding mgmt_pending_lock for the later dereference and removal. A concurrent MGMT_OP_CANCEL_PAIR_DEVICE request can remove and free the same pending command before the callback uses it. The fix transfers ownership of the pending command by removing it from hdev->mgmt_pending while holding mgmt_pending_lock, and the callbacks and cancel path then complete and free it directly.

A use-after-free vulnerability was found in the Linux kernel's Bluetooth subsystem (hci_sync). The hci_find_adv_instance() function returns a pointer to advertising data that is only valid while hdev->lock is held, but the HCI command-sync paths use it without that lock, which can lead to use of freed memory during an advertising termination event.

In the Linux kernel, in the Bluetooth HIDP subsystem, a vulnerability was found where data is read before checking if the frame contains a transaction header. The functions hidp_recv_ctrl_frame() and hidp_recv_intr_frame() read skb->data[0] before checking that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty basic-mode SDU, leading to use of an uninitialized byte. The fix pulls the transaction header with skb_pull_data() and discards frames that do not contain it.

In the Linux kernel, in the Bluetooth HIDP subsystem, a vulnerability was found where numbered report payloads are not validated. When hidp_get_raw_report() waits for a numbered report, hidp_process_data() compares the expected report number with skb->data[0]. A connected HIDP peer can reply with only a DATA transaction header, leaving the skb empty after the header is removed. The fix requires a payload byte before comparing a numbered report ID; unnumbered reports continue to accept an empty payload.

A Use-After-Free (UAF) vulnerability has been found in the Linux kernel's afs_make_call() function in the AFS filesystem. The issue arises from a race condition between sending asynchronous calls and their destruction, potentially leading to access to freed memory. The bug was reported by KASAN during tests with random CPU offlining.

In the Linux kernel, the ALSA 6fire driver failed to cancel a pending URB before freeing resources during probe error handling, potentially leading to a use-after-free. The fix applies a cleanup similar to the normal disconnect phase.