CVE Vulnerability Catalog

In the Linux kernel's xfrm subsystem, a use-after-free vulnerability exists during async resumption. xfrm_rcv_cb may change skb->dev to a tunnel device without taking a reference, and subsequent resumption decrements the tunnel device's refcount, leading to use-after-free and refcount leak.

In the Linux kernel's AppArmor module, a race condition exists in Unix socket mediation when peer_path is used. Accessing the path outside the state lock allows a race with unix_release_sock(), potentially leading to use-after-free.

In the Linux kernel's AppArmor module, a refcount leak exists when updating sk_ctx. update_sk_ctx() transfers the plabel reference, but the caller unconditionally puts it, leading to a refcount imbalance.

In the Linux kernel's AppArmor module, a vulnerability exists where the label build is checked before the no_new_privs test. aa_change_profile() builds a replacement label that can return NULL or ERR_PTR, but the result is passed to aa_label_is_unconfined_subset() before the IS_ERR_OR_NULL() check, potentially dereferencing an invalid label.

In the Linux kernel's AppArmor module, a resource leak exists in aa_label_alloc(). The function allocates a secid before allocating or taking the label proxy. If the later proxy step fails, the error path only frees the label memory, leaking resources initialized by aa_label_init().

In the Linux kernel's AppArmor module, a NULL pointer dereference vulnerability exists in unpack_pdb. If unpack_dfa fails, pdb->dfa could be NULL, causing a NULL pointer dereference.

In the Linux kernel's AppArmor module, a vulnerability exists in unpack_pdb where a failed ACCEPT2 allocation is not handled correctly. If the allocation fails, it sets an error message but jumps to the success path, returning a policydb missing the required table.

In the Linux kernel, the AppArmor module's get_current_exe_path() leaks exe file and path references when aa_path_name() fails. The fix routes error handling through the common cleanup path to always release resources.

In the Linux kernel, the AppArmor module has a bug where an uninitialized pointer is passed to audit_log_untrustedstring(). The bug was introduced by commit 4a134723f9f1 and can lead to a page fault during file operations when the path is replaced by aa_null.dentry. The issue was observed on kernel 7.0.2 openSUSE Tumbleweed.

In the Linux kernel, the MIPI I3C HCI driver has a race in i3c_hci_addr_to_dev() that traverses the I3C device list without proper locking. The fix introduces a dedicated lookup table and synchronization via hci->lock.

In the Linux kernel's regcache mechanism, when the populate() callback returns an error and cache operations include an exit callback, the error code is overwritten with the return value of exit(). This hides the error from the caller of regcache_init() and can lead to NULL pointer dereferences.

In the Linux kernel's i915 (drm) driver, intel_crtc_put_color_blobs() releases CRTC color blob references but does not clear the pointers. This can lead to double-free when the CRTC state is cleaned up again.

In the Linux kernel's xfrm module, there is a race during state cache insertion. The state validity check occurs before acquiring the global xfrm_state_lock, allowing a dead state to be inserted into the cache.

In the Linux kernel's xfrm module, xfrm_selector_match() can perform a shift-out-of-bounds for an AF_UNSPEC selector with a large prefixlen. The fix adds validation of families and prefix lengths.

In the Linux kernel's amdkfd (drm) driver, kfd_criu_resume_svm() does not remove elements from the list before freeing memory, leading to use-after-free and double-free. The fix adds list_del() before kfree().

In the Linux kernel's octeontx2-pf driver, otx2_free_sq_res() does not free the SQ timestamp buffer (sq->timestamps), leading to memory leak during interface teardown or device removal.

In the Linux kernel's SCTP_DIAG module, endpoint dumping does not hold the socket lock, leading to a race and potential leak of uninitialized memory to userspace. The fix adds proper locking and serialization.

In the Linux kernel, the ALSA USB-audio driver for Qualcomm platforms has a vulnerability due to missing validation of the interface index in the stream disable path. A disable request with an invalid interface can lead to NULL pointer dereference or out-of-bounds memory access, potentially causing a system crash or memory corruption.

In the Linux kernel, the ALSA USB-audio driver for Qualcomm platforms has a vulnerability where the 'opened' flag is not cleared when stream enable fails. If service interval validation fails, the substream remains in a blocked state, preventing its reuse.

A vulnerability in the Linux kernel's flow_dissector mechanism unconditionally reads Ethernet addresses (ETH_ADDRS) from the packet header, even when the device has no link-layer header (e.g., TUN in L3 mode). This leads to reading uninitialized skb memory, which can be used as a key in a rhashtable, potentially causing unpredictable TC filter matching. The fix adds checks for device type (ARPHRD_ETHER) and whether the MAC header is set.