CVE Vulnerability Catalog

A vulnerability in the Linux kernel's ALSA sequencer subsystem causes a divide-by-zero in initialize_timer(). An unprivileged user can set the timer resolution to a very large value (e.g., 2^63), causing the product to overflow and leading to a division by zero, which results in a system hang (oops with a held spinlock).

A vulnerability was found in the Linux kernel's ALSA timer subsystem. The SNDRV_TIMER_IFLG_DEAD flag is never cleared after a close operation completes, leading to a use-after-free when the same timer instance is reopened. An attacker with access to /dev/snd/timer and /dev/snd/seq can trigger this to escalate privileges or cause a system crash.

In the Linux kernel, ALSA UMP has a double free in snd_ump_attach_legacy_rawmidi(). After snd_rawmidi_new() fails, the out_cvts array is freed but the pointer is not cleared, leading to a second free during endpoint teardown.

In the Linux kernel, ALSA USB-audio has a use-after-free in ump_to_endpoint(). After registering a UMP endpoint, if a later creation step fails, the snd_usb_midi2_ump object is freed but the endpoint still points to it, causing a use-after-free read when the UMP node is opened.

In the Linux kernel, the ALSA USB-audio driver (RME Digiface) has a stack information leak. The status read function copies uninitialized stack memory to a buffer when the device responds with a short transfer, and this data is exposed to unprivileged users via /dev/snd/controlC*.

In the Linux kernel, ALSA USB-audio has an out-of-bounds write in snd_usbmidi_akai_output(). When a device advertises a small transfer size, the loop bound becomes negative, leading to writes past the URB buffer when writing to the MIDI node.

In the Linux kernel, ALSA USB-audio has an out-of-bounds DMA buffer write when the fill_max flag is set. The buffer size is calculated based on the original packet size, but transfers use a larger size, causing writes past the buffer by the USB controller.

In the Linux kernel, ALSA USB-audio lacks clamping of frame size in implicit-feedback mode. Received sync packet sizes are not limited to the maximum frame size, potentially causing packet transfers beyond hardware limits.

In the Linux kernel, the fou_create() function has a use-after-free vulnerability. The fou structure is published via sk_user_data before adding the port to the list, and on error it is freed while still reachable, allowing concurrent reads of freed memory.

In the igbvf driver, there is a memory leak in TX DMA error cleanup. Due to an off-by-one error, if some mappings succeed and then an error occurs, one DMA mapping (the head) is not unmapped, causing a leak.

In ksmbd (the SMB server in the Linux kernel), repeated SMB2 NEGOTIATE requests are not rejected. An unauthenticated client can send multiple such requests, leading to memory leaks because only the last allocation is freed.

A use-after-free vulnerability was found in the Linux kernel's SMC network module during link group termination. The issue arises from insufficient socket protection against concurrent close, potentially leading to memory corruption.

In netfilter ipset, there is an issue with updating comments from kernel-side operations. During table resize, comment pointers are copied, and a packet-side update can free a shared comment, leading to use of a dangling pointer.

In the Linux kernel, of_pci_range_parser_one() has a NULL pointer dereference. When a node has ranges but no local #address-cells, of_match_bus() returns NULL, causing a crash during iteration.

In TIPC, there is a use-after-free vulnerability in tipc_poll() during queue dumps via tracepoints. The tracepoint call without holding a lock allows access to freed packets.

In the Linux kernel's mac80211 subsystem, a use-after-free vulnerability was found in ieee80211_stop_tx_ba_cb(). After stopping a BA session, the tid_tx structure is freed via kfree_rcu(), and then the tid_tx->ndp field is read without proper RCU protection, potentially accessing freed memory. The issue occurs during local session teardown, e.g., on idle timeout, PTK rekey, suspend, or HW reconfig.

In the Linux kernel, the mwifiex driver has a vulnerability where the A-MSDU parent frame length is used instead of the subframe length when parsing TDLS frames. This leads to a use-after-free or out-of-bounds read, potentially exploitable by a remote attacker.

In binfmt_misc, there is an issue with restoring write access after removing an entry. Registering an entry with the MISC_FMT_OPEN_FILE flag blocks write access to the interpreter, and removing the entry does not restore access, causing persistent ETXTBSY errors.

In the Linux kernel, the binfmt_misc module has an inconsistency between deny_write_access() and exe_file_allow_write_access() when handling interpreter clones. This can lead to incorrect decrementing of i_writecount, making the interpreter unwritable even after the entry is removed.

In the Linux kernel's binfmt_misc module, a vulnerability allows an out-of-bounds read when the user-chosen field delimiter is also a flag character (P, O, C, or F). The flag parser fails to stop at the buffer padding and reads past the allocated memory. This is reachable by unprivileged users in a user namespace.