CVE Vulnerability Catalog

A use-after-free vulnerability was found in the Linux kernel's NFC LLCP stack in the llcp_sock_release() function. The issue occurs when a socket in the connecting state is removed from the wrong list, potentially leading to memory corruption.

A race condition in the Linux kernel's NFC LLCP stack during CC packet processing can cause a use-after-free of a socket when handled concurrently with socket release.

A vulnerability in the Linux kernel's xfrm_state_mtu function can cause an out-of-bounds write in the ESP component. An unprivileged attacker can install an IPv4 ESP tunnel with a large authentication key, small interface MTU, and large XFRMA_TFCPAD, triggering an arithmetic underflow that results in writing a massive amount of zeros to memory.

In the Linux kernel's rocket driver, a use-after-free (UAF) vulnerability was found due to a dangling GEM handle left after a failed buffer object creation. The bug occurs when rocket_ioctl_create_bo() creates a GEM handle before performing fallible operations, and on error frees the object without removing the handle from the IDR.

In the Linux kernel, a vulnerability was found in the SMC (Shared Memory Communications) module. The smc_init() function unnecessarily and dangerously re-initializes the smc_v*_hashinfo.ht hashtables, which can corrupt the hash list if entries already exist and are in use.

A vulnerability in the Linux kernel's locking mechanism for the .getsockopt function in AF_IUCV sockets was found. Missing proper locking allows a race condition between recvmsg() and getsockopt(SO_MSGSIZE), leading to a NULL pointer dereference and system crash.

In the Linux kernel SCSI subsystem, a vulnerability was found where scsi_run_host_queues() failed to run queues for devices in SDEV_CANCEL state, potentially causing the device removal process to hang. The issue stems from using the shost_for_each_device() macro which skips devices being removed, leaving requeued requests unhandled.

In the Linux kernel, a vulnerability in IPv4 frees net->ipv4.sysctl_local_reserved_ports too early before unregister_net_sysctl_table(). This can cause a use-after-free when accessing /proc/sys/net/ipv4/ip_local_reserved_ports.

In the Linux kernel, a vulnerability in the ethtool cmis module allows a malicious SFP module to respond with a reply length (rpl_len) larger than expected by cmis_cdb_process_reply(), causing an out-of-bounds (OOB) write. This affects potentially malicious hardware as well as buggy or corrupted modules.

In the Linux kernel's ethtool driver for CMIS modules, a vulnerability was found due to missing validation of the data size received from the module. A malicious module can return an inflated start_cmd_payload_size value, leading to an out-of-bounds (OOB) write in cmis_fw_update_start_download().

In the Linux kernel, a vulnerability in ethnl_update_profile() in ethtool allows out-of-bounds write because the index 'i' used to write to new_profile array is not bounded, while the number of Netlink nest entries is user-controlled. The destination buffer is allocated for NET_DIM_PARAMS_NUM_PROFILES (5) entries.

In the Linux kernel, the Netlink fallback path for reading module EEPROM lacked validation that the requested range (offset + length) stays within the total EEPROM size. Additionally, the buffer passed to drivers was not zeroed, potentially leading to data leaks.

A vulnerability was found in the Linux kernel's handshake mechanism for TLS connections. The handshake_req_cancel() function can be called from softirq context by the NVMe over TCP driver, causing a deadlock when acquiring the hn_lock with plain spin_lock(). The fix converts all hn_lock operations to use spin_lock_bh/spin_unlock_bh to disable softirqs.

In the Linux kernel, the change_work mechanism in the dpll zl3073x driver was removed due to a race condition during device teardown. It was replaced with a direct call to __dpll_device_change_ntf(), preventing use-after-free on a freed dpll_dev pointer.

In the Linux kernel's Bluetooth L2CAP stack, a vulnerability exists where chan->ident is not cleared after a successful ECRED reconfiguration. This allows a remote attacker to replay a failure response with the stale ident, causing the kernel to destroy an already-established channel.

A vulnerability in the Linux kernel's Bluetooth L2CAP stack may cause a system crash when handling ECRED connection response. The issue occurs when a destination channel ID (dcid) is already assigned, and attempting to delete the channel can corrupt the list structure used for iteration.

In the Linux kernel Bluetooth subsystem, a vulnerability was found where the HCI_CMD_DRAIN_WORKQUEUE flag is not set during device close. This can cause unnecessary timeouts to be queued during reset, leading to incorrect behavior.

In the Linux kernel's MANA network driver, a vulnerability was found where mana_detach() is called unconditionally on an already-detached port, causing a NULL pointer dereference during queue teardown.

A race condition in the Linux kernel's SCTP sctp_wait_for_connect() function allows another thread to peel off the association to a new socket while waiting, causing incorrect lock usage. The fix adds a check to detect migration and return an error.

Vulnerability in the Linux kernel in the vsock/virtio driver related to incorrect uarg binding before filling zerocopy skb. Can lead to improper memory management and potential data leak.