CVE Vulnerability Catalog

A vulnerability was found in the Linux kernel's ALSA USB-audio driver related to MIDI 2.0. During a configuration error, MIDI 2.0 input URBs are not stopped before freeing endpoint memory, leading to a use-after-free in input_urb_complete(). The issue was observed as a KASAN error.

In the Linux kernel, the netfilter flowtable module has a vulnerability related to IP6IP6 tunnel handling. The function nf_flow_ip6_tunnel_proto() uses skb_header_pointer() instead of pskb_may_pull(), which may lead to incorrect packet processing. Additionally, the handling of extension headers was simplified, which may affect correctness.

A vulnerability in the Linux kernel causes a kernel-infoleak in dgram_recvmsg() for IEEE 802.15.4 protocol. The issue stems from an uninitialized pan_id field in the address structure when the address mode is IEEE802154_ADDR_NONE, leading to disclosure of kernel stack memory to user space.

In the Linux kernel, the md/raid1 module has a vulnerability involving writes_pending and barrier reference leaks on write failures. Some error paths in raid1_write_request() complete the bio without calling md_write_end(), leading to unbalanced counters.

In the Linux kernel, the md/raid10 module has a vulnerability involving writes_pending reference leak on write request failures. Some error paths in raid10_write_request() complete the bio without calling md_write_end(), leading to unbalanced counters.

In the Linux kernel, the md/raid10 module has a vulnerability involving writes_pending and barrier reference leaks on discard failures. Some error paths in raid10_handle_discard() complete the bio without calling md_write_end() or allow_barrier(), leading to unbalanced counters.

In the Linux kernel, the md/raid1 module has a vulnerability involving a leak of the r1_bio structure when a read with REQ_NOWAIT encounters a block during retry. When wait_read_barrier() fails, the bio is completed, but the pre-allocated r1_bio is not freed.

In the Linux kernel, the netfilter/ipset module used test_bit() in lockless RCU readers in hash types, which is a relaxed atomic operation without memory barrier guarantees. It was replaced with test_bit_acquire() where the operation may run concurrently with add/del/gc.

In the Linux kernel, in the netfilter/ipset module, kfree_rcu() was called before rcu_assign_pointer() when handling the comment extension, which is incorrect order. The order was fixed so that rcu_assign_pointer() is called first.

In the Linux kernel, in the netfilter/ipset module, when destroying a set, cancel_delayed_work_sync() was called while gc unconditionally calls queue_delayed_work(), which can prevent proper shutdown of gc. This was fixed.

In the Linux kernel, in the nft_meta_bridge module, there is a stack leak in NFT_META_BRI_IIFPVID. The fix requires checking for nonzero retval.

In the Linux kernel, the tpm_crb driver lacked a check of ACPI_COMPANION() against NULL during probe. This check was added to prevent issues when a device has no ACPI companion object.

In the Linux kernel, in the alloc_tag mechanism, there is a use-after-free in /proc/allocinfo after module unload. The iterator is not properly reinitialized, leading to references to freed module memory.

In the Linux kernel, in the net/sched: act_ct module, there is an nf_connlabels leak on two error paths. tcf_ct_fill_params() calls nf_connlabels_get(), but two later error sites use a bare return instead of goto err, skipping the nf_connlabels_put() cleanup.

In the Linux kernel, in ipv6: ioam, there is a type confusion of dst_entry. IOAM uses a dummy dst_entry (null_dst) to mark that the destination should not be changed, but this dst is stored in the IOAM lwt state and may be passed to dst_cache_set_ip6(), leading to invalid cast and potential invalid memory access.

In the Linux kernel, in BPF, there is a stack slot index error in nospec checks. check_stack_write_fixed_off() computes the byte slot as -off - 1, but the Spectre v4 sanitization pre-check uses slot_type[i] instead, which can lead to missing sanitization for some writes.

In the Linux kernel, in BPF, there is an effective prog array index error with BPF_F_PREORDER. replace_effective_prog() and purge_effective_progs() located the slot in the effective array by walking the program hlist and counting entries linearly, which does not match the array layout when a preorder program is present.

In the Linux kernel BPF mechanism, during cleanup of dead stack slots in 4-byte halves, when the high half of a STACK_SPILL slot is dead and the low half remains live, converting the low half to STACK_MISC or STACK_ZERO clears the spilled_ptr metadata. This is safe only for scalar spills, but for pointer spills it allows a later 32-bit fill from the live half to bypass the normal non-scalar register-fill check and be treated as an ordinary scalar stack read. The fix leaves non-scalar spill slots intact in this half-live shape, which is conservative for pruning and preserves the existing rejection path for partial fills from pointer spills.

In the Linux kernel ice driver, there is a resource leak of CTRL VSI when resetting all VFs with FDIR filters enabled. The ice_reset_all_vfs() function only invalidates CTRL VSIs but does not free them, leading to resource leak. The fix uses ice_vf_ctrl_vsi_release() instead of ice_vf_ctrl_invalidate_vsi(), aligning with the behavior of ice_reset_vf().

In the Linux kernel msc313 RTC driver, there is a NULL pointer dereference in the shared IRQ handler during probe. msc313_rtc_probe() calls devm_request_irq() with IRQF_SHARED and passes &pdev->dev as the cookie, but platform_set_drvdata() is called later. If another device on the same IRQ line triggers the handler in that window, the handler does dev_get_drvdata() on the cookie, gets NULL, and dereferences priv->rtc_base in interrupt context. The fix passes priv as the cookie directly so the handler reads it from dev_id without the lookup.