CVE Vulnerability Catalog

A vulnerability in the Linux kernel's statmount_mnt_idmap function can cause an out-of-bounds write on the seq buffer. The issue occurs because manual increment of seq->count after seq_printf() bypasses overflow detection, leading to a NULL byte write beyond the allocated buffer.

In the Linux kernel on PREEMPT_RT, a use-after-free vulnerability was found in irq_work_single(). After clearing the BUSY flag via atomic_cmpxchg(), the code still dereferences the work structure, which can be freed prematurely by another thread calling irq_work_sync().

In the Linux kernel, the netfs_read_folio() function fails to wait for ongoing writeback to complete. This can lead to data corruption because the function trusts the dirty flag and folio->private data, which may be cleaned up before the writeback flag is cleared.

In the Linux kernel, the AFS filesystem has a vulnerability due to incorrect locking when handling symbolic links. This allows races between multiple get_link() calls, potentially leading to memory leaks or incorrect symlink content reads.

In the Linux kernel, a vulnerability was found in bio_integrity_copy_user() where overwriting bip_vcnt with nr_vecs breaks the bip_vcnt <= bip_max_vcnt invariant. On WRITE this causes out-of-bounds read of the bip_vec[] flex array, and on READ it reads incorrect data.

In the Linux kernel, the accel/qaic driver lacks an overflow check in remap_pfn_range during mmap, allowing a buffer object (BO) that is too large to map beyond the VMA region. This can cause use-after-free issues when munmap() unmaps only the VMA region.

In the Linux kernel, a vulnerability was found due to mixing devm and drmm memory management functions in the MSM DPU graphics driver. This causes a use-after-free condition during driver teardown when userspace holds a reference to the DRM device.

In the Linux kernel's SMC-D subsystem, a vulnerability exists where a malicious peer can reply to an SMC-Dv2 proposal with CHID=0, matching an empty slot in the ism_dev[] array. This leads to a NULL pointer dereference in smc_conn_create(), causing a kernel panic.

In the Linux kernel, a security flaw was found in the ovpn TCP driver's ovpn_tcp_close() function. It used the sock->peer pointer outside the RCU section, leading to a race condition and potential use-after-free.

In the Linux kernel's ovpn (OpenVPN) driver, a vulnerability was found due to improper reference counting (kref) handling in the error path of the CMD_NEW_PEER command. For TCP connections, a new peer may be accessible via the socket before being added to the hash table, and calling ovpn_peer_release() directly instead of ovpn_peer_put() leads to a use-after-free condition.

A vulnerability in the Linux kernel's VFIO/PCI driver allows exporting unallocated BAR resources via DMABUF. Lack of reservation verification before export may lead to unauthorized memory access.

In the Linux kernel, a buffer overflow vulnerability was found in the fs210x audio codec driver. The fs210x_effect_scene_info() function used strscpy with an incorrect destination size (strlen(SRC)+1 instead of sizeof(DST)), which can lead to out-of-bounds write.

In the Linux kernel, a vulnerability was found in the MSM DRM driver's snapshot code. Internal 16-byte alignment caused incorrect dumping of DSI data (shifted by 4 bytes) and 16x memory overallocation. The fix removes length alignment and accurately prints last registers.

A vulnerability was found in the Linux kernel's cgroup/rstat mechanism, where the css_rstat_updated() function exposed as a BPF kfunc does not validate the CPU number provided by the caller. A BPF program with appropriate capabilities can pass an invalid CPU value, leading to an out-of-bounds array access.

A use-after-free vulnerability was found in the Linux kernel's bridge multicast implementation when removing a bridge port. The issue occurs when per-VLAN multicast snooping is enabled and global multicast snooping is toggled, causing both per-port and per-VLAN multicast contexts to be active simultaneously. When such a port is removed, the per-port context is not disabled, leading to use of freed memory.

A race condition was found in the Linux kernel's EROFS filesystem managed cache for unaligned extents. Two threads may simultaneously add the same folio to the cache, leading to an inconsistent state. This only affects data compression with the -E48bit option (e.g., zstd).

In the Linux kernel's mac80211 subsystem, a vulnerability was found due to missing bounds checking of the link_id in ieee80211_ml_epcs. An attacker WiFi 7 AP can send a crafted EPCS Enable Response frame with link_id=15, causing an out-of-bounds read and kernel crash.

In the Linux kernel ALSA sequencer UMP subsystem, a use-after-free vulnerability exists during output teardown. Lack of synchronization between event processing and rawmidi connection closing can lead to access to already freed memory.

A vulnerability in the Linux kernel's network shaping mechanism (net: shaper) arises from non-atomic storage of the VALID flag relative to the XArray entry, causing a data race. This can lead to a use-after-free (UAF) during rollback operations.

A vulnerability in the Linux kernel's rxrpc mechanism causes pagecache corruption when locally transmitting DATA packets via splice(). The fix copies data to a temporary buffer before decryption in recvmsg().