CVE Vulnerability Catalog

In the Linux kernel, the ASoC codec driver hdac_hdmi has a vulnerability due to lack of validation of the enum value before using it as an index into the texts array. hdac_hdmi_set_pin_port_mux() uses the enum value to index the array before calling snd_soc_dapm_put_enum_double(), which validates the range. An out-of-range value can cause an out-of-bounds read. The fix moves the lookup after the helper has accepted the value.

In the Linux kernel, the ASoC driver for Meson AIU has put callbacks for HDMI and internal codec muxes that use the written enum value before checking its validity. This can lead to improper behavior or potential errors.

In the Linux kernel, the ASoC driver for Freescale fsl_audmix has functions fsl_audmix_put_mix_clk_src() and fsl_audmix_put_out_src() that convert the user-provided enum value before checking if it is within range. This can lead to incorrect memory access or errors.

In the Linux kernel, the ASoC driver for Tegra210 AHUB has function tegra_ahub_put_value_enum() that reads e->values[item[0]] before checking if item[0] is within range. This allows an out-of-range read of the values array.

In the Linux kernel, the ASoC topology parser does not validate PCM and DAI name strings stored in fixed-size arrays for NUL termination before using them as C strings. A malformed topology blob can cause reads past the end of the field.

In the Linux kernel, the flow classifier cls_flow in map mode allows userspace to control parameters and observe the resulting classid, enabling recovery of the folded value of kernel pointers like skb->sk, skb_dst(), or skb_nfct(). The fix replaces XOR folding with a keyed siphash.

A use-after-free vulnerability was found in the Linux kernel's fib_leaf_notify() function for IPv4. During dumping of fib_info under RCU, functions like nsim_fib4_prepare_event() call fib_info_hold() without checking if the object still exists, leading to use-after-free. The issue was reported by syzbot.

In the Linux kernel, fib_rules_dump() calls fib_rule_get() during RCU dump, which can cause refcount issues if the rule is dying. The fix uses refcount_inc_not_zero().

In the Linux kernel, the SCTP functions sctp_verify_asconf() and sctp_verify_param() do not validate that the embedded address parameter length fits within the outer parameter bounds. This can lead to out-of-bounds reads when processing malformed INIT or ASCONF packets.

In the Linux kernel, PFCP network devices do not allocate per-CPU stats, leaving dev->tstats NULL. Creating a PFCP device can cause a NULL dereference when building RTM_NEWLINK notification.

In the Linux kernel, netif_rxq_cleanup_unlease() has reversed order: DMA mappings are revoked before stopping the queue. This can allow the device to DMA to a stale address. The fix swaps the calls.

A vulnerability was found in the Linux kernel's HFSC network scheduler (sch_hfsc). During a single dequeue, a class can be marked passive twice, leading to incorrect decrementing of the parent's active class counter. As a result, a parent with active child classes is removed from the vttree, and queues stop being processed (stall).

In the Linux kernel, TIPCv2 mutating netlink operations lacked admin permission checks, allowing unprivileged local processes to change TIPC state. The fix adds CAP_NET_ADMIN requirement.

In the Linux kernel TIPC subsystem, the CONN_ACK handler did not validate the ack count, allowing an oversized ack to underflow snt_unacked and permanently stall the connection's send side.

In the Linux kernel TIPC subsystem, peer-advertised service ranges were not validated for lower <= upper, allowing inverted ranges to leak memory in the binding table.

In the Linux kernel Marvell OcteonTX crypto driver, the DMA cleanup path used the wrong loop index, leaking mapped entries and repeatedly unmapping the failed one.

In the Linux kernel Cavium CPT crypto driver, the DMA cleanup error path used the wrong loop index, leaking mapped entries and repeatedly unmapping the failed one.

A vulnerability in the Linux kernel ALSA SEQ subsystem leaks a kernel heap address to userspace. The bounce_error_event() function sent SNDRV_SEQ_EVENT_KERNEL_ERROR with a raw pointer to all clients, including user clients, exposing the address via copy_to_user(). The issue affects the fixed-length branch not covered by a previous fix.

In the Linux kernel IOMMU DMA subsystem, the P2PDMA path incorrectly assigned the DMA length from the head segment instead of the current segment, corrupting lengths for multi-segment scatterlists.

A vulnerability was found in the Linux kernel's SPI driver for Xilinx devices. The driver incorrectly determines the FIFO buffer size, not accounting for the shift register, which leads to data loss and driver looping during SPI transfers in interrupt mode.