CVE Vulnerability Catalog

In the Linux kernel, a vulnerability was found in bio_integrity_copy_user() where overwriting bip_vcnt with nr_vecs breaks the bip_vcnt <= bip_max_vcnt invariant. On WRITE this causes out-of-bounds read of the bip_vec[] flex array, and on READ it reads incorrect data.

In the Linux kernel, the accel/qaic driver lacks an overflow check in remap_pfn_range during mmap, allowing a buffer object (BO) that is too large to map beyond the VMA region. This can cause use-after-free issues when munmap() unmaps only the VMA region.

In the Linux kernel, a vulnerability was found due to mixing devm and drmm memory management functions in the MSM DPU graphics driver. This causes a use-after-free condition during driver teardown when userspace holds a reference to the DRM device.

In the Linux kernel's SMC-D subsystem, a vulnerability exists where a malicious peer can reply to an SMC-Dv2 proposal with CHID=0, matching an empty slot in the ism_dev[] array. This leads to a NULL pointer dereference in smc_conn_create(), causing a kernel panic.

In the Linux kernel, a security flaw was found in the ovpn TCP driver's ovpn_tcp_close() function. It used the sock->peer pointer outside the RCU section, leading to a race condition and potential use-after-free.

In the Linux kernel's ovpn (OpenVPN) driver, a vulnerability was found due to improper reference counting (kref) handling in the error path of the CMD_NEW_PEER command. For TCP connections, a new peer may be accessible via the socket before being added to the hash table, and calling ovpn_peer_release() directly instead of ovpn_peer_put() leads to a use-after-free condition.

A vulnerability in the Linux kernel's VFIO/PCI driver allows exporting unallocated BAR resources via DMABUF. Lack of reservation verification before export may lead to unauthorized memory access.

In the Linux kernel, a buffer overflow vulnerability was found in the fs210x audio codec driver. The fs210x_effect_scene_info() function used strscpy with an incorrect destination size (strlen(SRC)+1 instead of sizeof(DST)), which can lead to out-of-bounds write.

In the Linux kernel, a vulnerability was found in the MSM DRM driver's snapshot code. Internal 16-byte alignment caused incorrect dumping of DSI data (shifted by 4 bytes) and 16x memory overallocation. The fix removes length alignment and accurately prints last registers.

A vulnerability was found in the Linux kernel's cgroup/rstat mechanism, where the css_rstat_updated() function exposed as a BPF kfunc does not validate the CPU number provided by the caller. A BPF program with appropriate capabilities can pass an invalid CPU value, leading to an out-of-bounds array access.

A use-after-free vulnerability was found in the Linux kernel's bridge multicast implementation when removing a bridge port. The issue occurs when per-VLAN multicast snooping is enabled and global multicast snooping is toggled, causing both per-port and per-VLAN multicast contexts to be active simultaneously. When such a port is removed, the per-port context is not disabled, leading to use of freed memory.

A race condition was found in the Linux kernel's EROFS filesystem managed cache for unaligned extents. Two threads may simultaneously add the same folio to the cache, leading to an inconsistent state. This only affects data compression with the -E48bit option (e.g., zstd).

In the Linux kernel's mac80211 subsystem, a vulnerability was found due to missing bounds checking of the link_id in ieee80211_ml_epcs. An attacker WiFi 7 AP can send a crafted EPCS Enable Response frame with link_id=15, causing an out-of-bounds read and kernel crash.

In the Linux kernel ALSA sequencer UMP subsystem, a use-after-free vulnerability exists during output teardown. Lack of synchronization between event processing and rawmidi connection closing can lead to access to already freed memory.

A vulnerability in the Linux kernel's network shaping mechanism (net: shaper) arises from non-atomic storage of the VALID flag relative to the XArray entry, causing a data race. This can lead to a use-after-free (UAF) during rollback operations.

A vulnerability in the Linux kernel's rxrpc mechanism causes pagecache corruption when locally transmitting DATA packets via splice(). The fix copies data to a temporary buffer before decryption in recvmsg().

In the Linux kernel, the gpio: aggregator driver has a use-after-free vulnerability. On error, dev_id in aggr->lookups was freed before removing the entry from the lookup table, allowing a concurrent thread calling gpiod_find() to access freed memory via strcmp().

A memory leak of dma_vec allocation was found in the Linux kernel's nvme-pci driver when using P2P memory. The allocation was not freed upon completion because P2P memory is not unmapped.

A use-after-free vulnerability was found in the Linux kernel's blk-mq mechanism. The issue occurs when a task sleeps after peeking a cached request but before popping it, leading to memory being freed and potential exploitation.

In the Linux kernel, a vulnerability was found in the key lookup mechanism where find_key_to_update() calls assoc_array_find() without holding the RCU read lock. This causes security issues, especially with persistent keys that use a different locking model than regular keys.