CVE Vulnerability Catalog

In the Linux kernel, in the DRM MSM driver (drm/msm), a vulnerability was found due to incorrect checking of the return value of iommu_map_sgtable(). A change in the iommu_map_sgtable() interface made it return ssize_t with negative values on errors instead of size_t with zero. The code did not store the result in the appropriate type and triggered a WARN instead of returning the error.

In the Linux kernel, a bug was found in the IOMMU subsystem where the error path of the map function calls iommu_unmap(), which triggers debug routines (iommu_debug_unmap_begin/end) without a prior iommu_debug_map() call. This causes unbalanced tracking and potential debugging issues. The fix moves error handling to iommu_map_nosync() and reorders operations to record the partial mapping before unmapping it.

In the Linux kernel, a vulnerability was found in the iommupt subsystem due to missing check for PAGE_SIZE in the pgsize_bitmap. The driver may drop PAGE_SIZE from the bitmap, which is technically allowed but violates design assumptions and may cause issues with the DMA API.

In the Linux kernel, the pds_core driver fixes two bugs in pdsc_devcmd_wait: firmware crash returned stale success instead of an error, and timeout overwrote the error code with stale status.

In the wilc1000 WiFi driver, a memory leak occurs in wilc_wlan_firmware_download(). The function allocates dma_buffer but fails to free it on the first bus acquire failure, returning directly instead of using the cleanup label.

In the Linux kernel's ksmbd filesystem, a null pointer dereference vulnerability exists in the compare_guid_key() function. During durable-handle session teardown, session_fd_check() sets the conn pointer in the opinfo structure to NULL but does not remove the opinfo from the lease list. When a new session is established with the same ClientGuid and an SMB2 CREATE request with a lease context is sent, find_same_lease_key() processes the stale opinfo, and compare_guid_key() attempts to read ClientGUID through a NULL conn pointer, causing a kernel panic.

In the Linux kernel ksmbd filesystem, a null pointer dereference vulnerability was found in proc_show_files(). When an SMB2 client opens a file with a durable v2 handle and then issues SMB2 SESSION_LOGOFF, the fp->tcon pointer is cleared but the entry remains in global_ft.idr. Reading /proc/fs/ksmbd/files during this window causes a kernel panic.

A vulnerability was found in the Linux kernel's ksmbd module, where SID identifiers (Owner and Group) in the parent directory's security descriptor are not validated during ACL inheritance. This flaw could allow an attacker to manipulate file access permissions.

In the Linux kernel, a vulnerability was found in the CIFS SWN netlink implementation. Missing capability flags for generic netlink operations allow any local process to send RESOURCE_CHANGE or CLIENT_MOVE notifications to the in-kernel witness handler. Additionally, the multicast group lacks protection, enabling unprivileged processes to join and receive registration messages containing username, domain, and password for NTLM-authenticated mounts.

In the Linux kernel, a vulnerability in the ALSA PCM subsystem was found where the iov_iter setup was incorrectly applied for silencing (NULL data), leading to a bogus iov_iter calculation. On RISC-V architecture, this causes a NULL pointer dereference.

In the Linux kernel, the ALSA asihpi driver has a vulnerability allowing out-of-bounds (OOB) array access when reading the cache. The find_control() function accesses the array without proper index validation, potentially leading to memory corruption.

In the Linux kernel, a vulnerability in the Bluetooth MGMT module allows an attacker with CAP_NET_ADMIN to trigger an out-of-bounds read by sending a short MGMT_OP_ADD_EXT_ADV_DATA command. The missing length validation can lead to data leakage or system crash.

In the Linux kernel, a vulnerability in the net:devmem mechanism lacks validation of page alignment for dma-buf size and SG segment length. This mismatch can cause out-of-bounds read of the tx_vec array during sendmsg() and desynchronization of num_niovs from the gen_pool region, affecting both RX and TX paths.

A use-after-free vulnerability was found in the Linux kernel's HSR (High-availability Seamless Redundancy) module. Generic-netlink operations running under rcu_read_lock() can access freed memory during HSR interface teardown (RTM_DELLINK) because the node list is removed with plain list_del() and freed immediately, while RCU readers may still hold pointers to those nodes.

In the Linux kernel's IFB driver, a slab-out-of-bounds read vulnerability was found when reporting ethtool stats. The issue occurs when the number of RX queues exceeds TX queues, causing indexing beyond allocated memory and potential data leak.

In the Linux kernel, a double-free vulnerability was found in the qed driver's qed_cxt_tables_alloc() function. When a CID bitmap allocation for PF or VF fails, qed_cid_map_alloc() frees previously allocated bitmaps, and then qed_cxt_tables_alloc() calls qed_cxt_mngr_free(), which frees them again. The fix sets bitmap pointers to NULL after freeing to prevent double free.

In the Linux kernel's mac80211 subsystem, a use-after-free vulnerability was found during mesh frame processing. The issue occurs when ieee80211_invoke_fast_rx() reads RX status via skb->cb, which is later overwritten by ieee80211_rx_mesh_data() with TX data, leading to access to freed or zeroed memory.

In the Linux kernel, the ipv6_hop_ioam() function lacked a NULL check for the pointer returned by __in6_dev_get(). During network interface teardown, this pointer can be NULL, leading to a NULL pointer dereference when processing an IOAM Hop-by-Hop option.

In the Linux kernel, a use-after-free (UAF) vulnerability was found in the vsock/vmci driver during connection handshake. When a peer sends a RST packet during handshake, the driver fails to properly remove the pending socket from the list, leading to double free and access to freed memory.

A vulnerability was found in the Linux kernel's IPv4 raw socket implementation. The raw_send_hdrinc() function fails to reject packets with ihl (Internet Header Length) less than 5, allowing malformed IP headers to be sent. This leads to an out-of-bounds memory access in ah_output() and a kernel panic.