CVE Vulnerability Catalog

In the Linux kernel, in the udp_tunnel subsystem, a vulnerability was fixed involving double queueing of work in udp_tunnel_nic_device_sync, leading to a use-after-free. The fix involves returning early if the work_pending flag is already set.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's TIPC UDP media bearer. The cleanup_bearer() function destroys the dst_cache before synchronizing with RCU readers, which can lead to system crashes or rcuref warnings. Additionally, freeing the ub structure after synchronize_net() without closing the socket first leaves a window for UAF for concurrent receivers.

In the Linux kernel, in the ALSA FCP subsystem, a NULL pointer dereference vulnerability was fixed during interface lookup. A malicious USB device can provide an interface without endpoint descriptors, leading to memory safety issues.

In the Linux kernel, in the BPF subsystem, a vulnerability was fixed where BPF verifier logs did not mask pointer values for certain pseudo-source types, potentially leaking kernel addresses. The fix extends masking to all pseudo types.

In the Linux kernel, in the BPF subsystem, a memory leak in the verifier error handling path was fixed. When allocation of env->succ fails, freeing of env->insn_aux_data is skipped, leading to a memory leak. The fix moves the freeing to the err_free_env label.

In the Linux kernel, seg6_validate_srh() lacks a minimum length check before reading fixed SRH fields. The BPF SEG6 encap path can supply a too-short buffer, leading to an out-of-bounds read.

In the Linux kernel's enetc driver, the number of BDs needed for xdp_frame is not checked. The xdp_redirect_arr array has size ENETC_MAX_SKB_FRAGS, but the number of fragments in xdp_frame can be greater or equal, leading to an out-of-bounds array access.

In the Linux kernel's SCTP protocol, when cookie authentication is disabled, the INIT after cookie unpacking is not re-verified. This could allow processing of tampered data. Added INIT verification after unpacking and chunk type check in cookie.

In the Linux kernel's hwmon subsystem (pmbus/core), pmbus_data2reg_vid() always uses VR11 encoding, ignoring the configured vrm_version. This can lead to sending wrong codes to PMBUS_VOUT_COMMAND, resulting in incorrect voltage.

In the Linux kernel's adm1275 hwmon driver, i2c_smbus_read_block_data() reads up to 32 bytes into an uninitialized stack array without appending a null terminator. The strncasecmp() comparison may read beyond the returned length, leading to an uninitialized stack memory read.

In the Linux kernel's hwmon subsystem (pmbus), regulator events are passed to the regulator core as a combined bitmask. If multiple distinct faults occur, the mask does not match any case in regulator_handle_critical(), bypassing the critical hardware protection trigger.

In the Linux kernel's aspeed-g6-pwm-tach hwmon driver, aspeed_tach_val_to_rpm() does not check if the tachometer value is zero before dividing. This can lead to a divide-by-zero and kernel panic.

In the Linux kernel's fbnic driver, fbnic_tx_lso() calls skb_cow_head() which may reallocate the skb including shared info. The pointer calculated before the call becomes stale, leading to a use-after-free.

In the Linux kernel's IPv6 fib6, during multi-batch dump, inet6_dump_fib() saves progress as a positional index within the current hash chain. A concurrent insertion of a new table can shift entries, leading to a wrong pointer and NULL dereference in fib6_walk_continue(), causing a kernel panic.

In the Linux kernel's sfp driver, sfp_i2c_mdiobus_destroy() does not free the allocated mii_bus, leading to a memory leak when an SFP module is removed.

A vulnerability in the Linux kernel's net/sched sch_teql module involves missing synchronization of the teql master's slaves list, leading to race conditions and use-after-free (UAF) during concurrent queue operations. This can compromise memory integrity.

A use-after-free vulnerability was found in the Linux kernel's bridge subsystem related to STP. Missing IFF_UP check in br_topology_change_detection() allows arming the topology change timer while the bridge is administratively down, leading to use-after-free when the bridge is deleted.

In the Linux kernel's Panthor DRM driver, a locking issue was found with dma_fence objects. Since these objects can be shared with other subsystems and accessed from hardirq context, the IRQ-safe variant must be used when acquiring the lock.

In the Linux kernel's Panthor DRM driver, a potential invalid pointer dereference was found in group_process_tiler_oom(). If heaps is an ERR_PTR(), panthor_heap_pool_put() will dereference an invalid pointer.

In the Linux kernel's Panthor DRM driver, a memory leak was found when a group is evicted before the tiler OOM is serviced. A group reference is tied to the pending tiler_oom_work, so it must be released if the cancellation was effective.