CVE Vulnerability Catalog

A use-after-free flaw exists in the Linux kernel ftrace subsystem during process forking. The function graph state is initialized too late — after copy_exec_state() — so if the task_exec_state allocation fails, free_task() releases the parent's return stack (ret_stack), which the parent then accesses as freed memory.

In the Linux kernel, the ALSA us122l driver did not clear the VM_MAYWRITE flag for read-buffer mappings created with PROT_READ. A process with O_RDWR access to the hwdep node could later use mprotect() to make the mapping writable, then modify the read_size field and access pages beyond the allocation. The fix clears VM_MAYWRITE for read-buffer mappings.

In the Linux kernel, the UFS filesystem copied the cylinder group index and rotor positions from disk without validation, then used them as indices during allocation and free. A crafted image could set arbitrary values, causing writes outside the s_csp allocation or bitmap scans far past the cylinder group buffers. The fix rejects cylinder groups with mismatched index or out-of-group rotors.

In the Linux kernel, in the accel: ethosu driver, userspace can set the job SRAM size to 0 but still have SRAM accesses in the command stream. When the job SRAM size is 0, setting the region base register is skipped, leading to use of a stale base address from a prior job.

In the Linux kernel, the ASoC driver for Spreadtrum platforms (sprd) lacks validation of compress buffer sizes against fixed memory allocations. A local user can configure a logical buffer up to ~4GB, causing overflow of the IRAM (32K) or DDR (2M) buffers during copy operations from user space.

A use-after-free vulnerability exists in the Linux kernel's proc_flush_pid() function during process exit. Due to an incorrect assumption about holding a reference to thread_pid, the PID can be freed by an RCU callback before proc_flush_pid() completes. The vulnerability can be triggered by an unprivileged user via a race between wait4(-1) and setsid().

Rojo's "rojo serve" HTTP API (default port 34872) lacks Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open() with no user interaction beyond visiting the page.

A vulnerability in the Linux kernel's MPLS handling was found where the inner_protocol field is not cleared after popping the last MPLS label. This can lead to a negative network header offset, causing Open vSwitch to perform a massive memcpy out of bounds, resulting in a system crash (page fault).

In the Linux kernel's Open vSwitch module, there is a use-after-free vulnerability related to the flow table mask array. The function tbl_mask_array_realloc() retires the old array before it is fully out of use, allowing a read after free in a certain time window. The fix publishes the new array before retiring the old one.

A use-after-free vulnerability was found in the Linux kernel's netfilter cttimeout module during module unload. nf_ct_set_timeout() protects the timeout hook and policy lookup with rcu_read_lock(), but cttimeout_exit() unregisters per-net operations before clearing the hook, allowing access to freed memory. KASAN reported slab-use-after-free in ctnl_timeout_find_get.

A race condition in the Linux kernel's netfilter nf_log module allows a use-after-free when loggers are unregistered. The incorrect ordering lets a sysctl or netlink writer rebind a logger after per-net state is cleared but before the global backend is removed, leading to a dangling pointer.

A vulnerability in the Linux kernel's IPv6 packet fragmentation mechanism (inet: frags) was found. Improper flushing of fragment queues before their removal can lead to use of stale metadata, resulting in out-of-bounds access and heap corruption. An attacker with access to unprivileged network namespaces can exploit this for local privilege escalation.

In the Linux kernel's mac802154 subsystem, a use-after-free vulnerability was found in the RX frame queueing mechanism. The softirq producer adds beacon and MAC-command frames to lists without locking, and the worker processes them after the interface may have been freed, leading to dereferences of freed memory (sdata). The issue was confirmed by KASAN.

A use-after-free vulnerability was found in the Linux kernel's Landlock module, in the current_check_refer_path() function. During linkat() processing, the module accesses the source directory's parent without holding a reference or lock, allowing concurrent rename(2) and rmdir(2) to free and reuse memory. The issue is fixed by properly taking a reference on the parent dentry.

In the Linux kernel, the s390/crypto subsystem returns an incorrect code in asynchronous crypto engine callbacks. When crypto_finalize_hash_request() or crypto_finalize_skcipher_request() explicitly completes a request, the do_one_request callback must return 0; returning a negative error code causes a double completion.

In the Linux kernel, afs_lookup_server() incorrectly frees an existing server's endpoint state during candidate cleanup. The candidate record does not have an endpoint state at that point, so the free is unnecessary.

In the Linux kernel AFS subsystem, a use-after-free vulnerability was found due to improper clearing of peer app data during server address list updates, potentially leading to access of freed memory.

In the Linux kernel, the rkvdec HEVC driver has unbounded tile loops and PPS id in compute_tiles_uniform(), compute_tiles_non_uniform(), and assemble_hw_pps(). These functions may write out of bounds.

In the Linux kernel, the mediatek vcodec AV1 driver has an unbounded tile-start copy in vdec_av1_slice_setup_tile(). The function copies entries into mi_col_starts[] and mi_row_starts[] without bounds checking.

In the Linux kernel, the Verisilicon Rockchip VPU981 AV1 driver has an unguarded division and tile buffer write. The function rockchip_vpu981_av1_dec_set_tile_info() divides by tile_cols which can be zero, and writes descriptors without bounding to buffer capacity.