CVE Vulnerability Catalog

In the Linux kernel, the USB host max3421 driver has a shift-out-of-bounds vulnerability in max3421_hub_control(). An untrusted userspace process can send a USBDEVFS_CONTROL request with wValue greater than or equal to 32, causing an out-of-bounds bit shift and corrupting port_status, including immutable bits. The fix rejects requests with a value exceeding the shift width.

In the Linux kernel, the gpib driver has a double decrement of the descriptor_busy counter in command_ioctl(). The error path inside the loop decrements the counter and breaks, but then an unconditional decrement after the loop occurs, causing an underflow. This re-enables the use-after-free that the original fix intended to prevent. The fix removes the early decrement from the error path.

In the Linux kernel, the iio: magnetometer ak8975 driver has a potential kernel stack memory leak. If i2c_smbus_read_i2c_block_data_or_emulated() returns fewer bytes than the buffer size, uninitialized bytes remain in the buffer and are passed to IIO buffers, potentially leaking kernel memory to userspace. The fix adds a check that the return value equals the buffer size.

In the Linux kernel, the iio: adc xilinx-ams driver has an out-of-bounds read vulnerability in ams_event_to_channel(). The function may return a pointer past the end of dev->channels when no matching scan_index is found, leading to invalid memory access in ams_handle_event(). The fix adds a bounds check and returns NULL when no channel is found.

In the Linux kernel, the iio: accel mma8452 driver has an issue with handling I2C read errors in mma8452_read(). If the I2C read fails but mma8452_set_runtime_pm_state() succeeds, the function returns 0, causing the caller to use uninitialized stack memory. The fix adds proper checking of the I2C read return value and propagates errors to the caller.

In the Linux kernel, the NTFS3 filesystem has an out-of-bounds read vulnerability in run_get_highest_vcn(). The function parses a packed mapping-pairs buffer without any length bound, relying solely on a 0x00 terminator. A crafted $LogFile UpdateMappingPairs record can cause a read past the slab allocation, triggering a KASAN error during mount. The fix adds a run_buf_size parameter and rejects run headers whose payload would extend past the buffer end.

In the Linux kernel, the NTFS3 filesystem has an issue with error handling during file rename. Instead of calling _ntfs_bad_inode() when rename fails, the driver uses WARN_ON, which does not prevent further operations on the inconsistent inode. The fix replaces WARN_ON with a call to _ntfs_bad_inode() to prevent further operations on the corrupted inode.

In the Linux kernel, the dma_release_channel() function has a use-after-free vulnerability. The privatecnt check occurs after calling dma_chan_put(), which may release the last reference to the device if the DMA provider is already gone, leading to memory free. The fix moves dma_chan_put() before the check.

In the Linux kernel, the dma-axi-dmac driver has an issue with incomplete freeing of the axi_dmac_desc structure. In the error path after calling axi_dmac_alloc_desc() in axi_dmac_prep_peripheral_dma_vec(), the axi_dmac_free_desc() function is not used, leading to memory leak or incomplete release.

In the Linux kernel, the dma-axi-dmac driver has an issue with DMA descriptor management. Using dma_alloc_coherent() may cause memory remapping (vmalloc) on architectures like Microblaze or arm64, leading to a BUG() when calling dma_free_coherent() from softirq context. The fix uses a DMA pool to manage descriptors, avoiding direct dma_free_coherent() calls in interrupt context.

In the Linux kernel, a vulnerability was found in the xprtrdma subsystem related to improper lifecycle management of RPC requests. The issue was that a single reference counter (rl_kref) served two distinct lifetimes, which could lead to freeing a send buffer while the HCA might still be DMA-reading from it. The fix decouples these lifetimes by adding separate references for the RPC layer and the send side, ensuring the request returns to the free pool only after both owners have released it.

A vulnerability was found in the Linux kernel's NFS subsystem regarding protection of the file lock list. The issue involves improper use of flc_lock during iteration over the lock list, which may lead to use-after-free (UAF). The fix switches to using nfsi->rwsem for protection and moves the locks_lock_inode_wait call to avoid deadlocks.

In the Linux kernel, the NTFS3 filesystem has a vulnerability involving the use of an uninitialized variable lcn. When the sought VCN is not found in runs[0], run_lookup() returns false, leading to premature exit from attr_data_get_block_locked() without initializing lcn, triggering a KMSAN bug. The fix moves the clen check before the lcn check in ni_seek_data_or_hole().

In the Linux kernel's NTFS3 filesystem (fs/ntfs3), there is a buffer overflow vulnerability. During mounting of a dirty NTFS volume, log_replay() allocates one_page_buf using the host page size, then may adopt a larger on-disk page size from the restart area. If the on-disk page size is larger than the initial allocation, the buffer remains undersized, and a subsequent read of log->page_size bytes into it causes an overflow.

In the Linux kernel's xprtrdma subsystem, a vulnerability was found due to a kref imbalance when handling the ADDR_CHANGE event. If this event arrives before ESTABLISHED, an ep_put is called without a matching ep_get, leading to a kref underflow and use-after-free during disconnect.

In the Linux kernel, the xprtrdma module has a race condition during re_id initialization. rpcrdma_create_id() registers ep->re_rn before rpcrdma_ep_create() assigns ep->re_id, allowing a local administrator to trigger RDMA device removal in that window, leading to NULL pointer dereference in trace_xprtrdma_device_removal(). The fix assigns re_id before publishing re_rn.

In the Linux kernel, the xprtrdma module has a vulnerability where the return value of frwr_wp_create() is ignored during connection setup. If the function fails, ep->re_write_pad_mr remains NULL, and the connection is still considered successful, leading to NULL pointer dereference when encoding the write list. The fix checks the return value and fails the connection with -ENOTCONN.

In the Linux kernel's xprtrdma module, a vulnerability causes receive buffer leaks and Receive queue exhaustion. Improper decoding of short or malformed replies can misclassify frames as backchannel calls, leading to orphaned buffers and failure to repost receive slots.

In the Linux kernel's xprtrdma subsystem, a vulnerability exists where the reply credit grant is not sanitized before use. A malicious peer can send a reply with an unknown XID and an inflated credit, causing excessive allocation and posting of Receive WRs, exceeding the re_max_requests limit.

In the Linux kernel's xprtrdma subsystem, a vulnerability allows a remote peer to drain the client's posted Receive queue by sending a sustained stream of malformed replies (too short or with an unrecognized RPC/RDMA version). Each such reply consumes a posted Receive without replacing it, eventually stalling the transport until reconnect.