CVE Vulnerability Catalog

In the Linux kernel, in the Input ims-pcu driver, a type confusion vulnerability was detected in CDC union descriptor parsing. The driver trusts bMasterInterface0 from the CDC union descriptor without verifying that it matches the interface being probed. This could lead to overwriting the private data of another interface.

In the vub300 MMC driver, a use-after-free vulnerability exists during failed host addition. The error path bypasses the kref lifetime management after arming the inactivity timer, potentially leading to use of freed memory.

In the mlx5e driver for Mellanox network cards, a use-after-free vulnerability was found in MACsec handling. Deleting an RX SC freed the metadata_dst object without respecting the reference count, which could lead to use of freed memory by a concurrent packet receive process. Additionally, publishing an element in the xarray before metadata_dst initialization could expose incomplete data.

A use-after-free vulnerability was found in the Linux kernel's user_event_mm_dup() function related to the user_events mechanism. The issue occurs during fork() when the enabler list is traversed without locking while another thread removes an enabler, leading to use of freed memory. An unprivileged attacker can trigger this bug, resulting in a system crash or potential privilege escalation.

In the Linux kernel, the libertas_tf driver has a use-after-free vulnerability in lbtf_free_adapter(). The function uses timer_delete() instead of timer_delete_sync(), which does not wait for a running timer callback that may access freed memory during device removal.

In the Linux kernel, the RT locking mechanism has a use-after-free vulnerability due to incorrect RCU protection in rt_spin_unlock(). The function releases RCU protection before unlocking, enabling a race condition that leads to use of freed memory.

In the Linux kernel, the posix-cpu-timers mechanism has a multiplication bug in update_rlimit_cpu(). On 32-bit kernels, multiplying the CPU limit by NSEC_PER_SEC is done in 32-bit type, causing truncation for limits >= 5 seconds and incorrect programming of the process CPU timer.

In the Linux kernel, the CPU hotplug mechanism has a bug in cpuhp_invoke_callback() that hides the original error during rollback of earlier callbacks. The ret variable is reused to store the rollback result, which can mask the original error.

In the Linux kernel, the CPU hotplug mechanism has a buffer overflow vulnerability in states_show(). The function writes hotplug state names to a sysfs buffer using sprintf(), which can write past the end of the PAGE_SIZE buffer when many states are registered.

In the Linux kernel, the net: mana driver lacks validation of the packet length reported by the NIC in the RX CQE. The length is passed to skb processing without verification, which can lead to errors.

In the Linux kernel, the net: mana driver lacks DMA synchronization for page pool RX fragments in the receive path. When RX buffers are allocated from page pool fragments, they are not synced for CPU before being passed to the network stack, which can cause issues in configurations requiring explicit DMA sync.

In the Linux kernel, a vulnerability was found in the Tegra GPIO driver where pinctrl functions are called for GPIO direction, even though the GPIO driver programs direction registers directly. This redundant call enters the pinctrl core and can sleep in an atomic context when shared GPIO users hold a spinlock. The issue was confirmed by static analysis and manual code review.

In the Linux kernel, the GPIO driver for MT7621 modifies bank-shared fields like 'rising' and 'falling' using non-atomic read-modify-write operations. Concurrent calls for different IRQs on the same bank can overwrite each other's configuration. A lock 'gpio_generic_lock_irqsave' has been added to protect these fields.

In the Linux kernel, the SIT driver's ipip6_changelink() did not check CAP_NET_ADMIN in the tunnel's network namespace. A caller privileged in the device's netns but not in the tunnel's netns could modify the tunnel. Added rtnl_dev_link_net_capable() check at the beginning.

In the Linux kernel, the TI ICSSG driver's icssg_ndo_get_stats64() calls emac_get_stat_by_name() without checking if the PA stats block is present. When pa_stats pointer is NULL, thousands of log entries are generated and counters rx_errors, rx_dropped, tx_dropped are corrupted. Added proper guard.

In the Linux kernel, the T7xx WWAN driver's t7xx_cldma_late_init() creates a DMA pool before initializing TX and RX rings. If ring initialization fails, the DMA pool is not freed, causing a memory leak. Added destruction of the DMA pool on the error path.

In the Linux kernel, the ixp4xx_hss driver's ixp4xx_hss_probe() allocates two HDLC netdevs, but registers one and removes another. This leads to memory leak and improper removal. The fix allocates only one netdev and assigns it to port->netdev.

In the Linux kernel, the act_ct module's tcf_ct_handle_fragments() does not save and restore skb->cb during defragmentation. This causes loss of qdisc metadata like pkt_segs and can trigger WARN_ON_ONCE(). Added save and restore of tc_skb_cb.

In the Linux kernel, the ENA driver's create_queues_with_size_backoff() creates XDP TX queues before setting up regular TX queues. If regular TX queue setup fails, XDP TX queues are not destroyed, causing resource leak. Added explicit destruction of XDP TX queues at two missing failure points.

In the Linux kernel, the IP6VTI driver's vti6_changelink() did not check CAP_NET_ADMIN in the tunnel's network namespace. A caller privileged in the device's netns but not in the tunnel's netns could modify the tunnel. Added rtnl_dev_link_net_capable() check at the beginning.