CVE Vulnerability Catalog

In the Linux kernel USB gadget UAC1/UAC2 module, configfs rate-list attributes did not validate the input length before storing values into fixed-size arrays of UAC_MAX_RATES (10) entries. Supplying more than ten rates caused an out-of-bounds write past p_srates[] or c_srates[], leading to memory corruption. Additionally, freeing the advanced strsep() cursor caused a memory leak or an interior pointer free.

In the Linux kernel, the error paths for endpoint-disabled (ESHUTDOWN) and request-allocation failure (ENOMEM) in ffs_dmabuf_transfer() of the USB gadget f_fs driver called dma_fence_put() on a fence that had only been kmalloc'd, without dma_fence_init() having been called. Calling dma_fence_put() on such an uninitialized object leads to undefined behavior. The fix replaces it with kfree().

In the Linux kernel, the error path labels in asus_wmi_add() of the platform/x86 asus-wmi driver are out of order relative to the subsystem registration sequence. As a result, failures in asus_wmi_custom_fan_curve_init() or asus_screenpad_init() skip cleanup calls for previously registered resources, leaking them. The fix reorders the labels to match the reverse order of allocations.

In the Linux kernel, bpf_cpumask_populate() writes to its destination with bitmap_copy(), but the destination is typed as struct cpumask *. This allows the verifier to accept borrowed cpumask pointers returned by read-only kfuncs (e.g., scx_bpf_get_online_cpumask()) as a writable destination. The fix changes the destination type to struct bpf_cpumask * so it follows the same ownership rule as other mutating cpumask kfuncs.

In the Linux kernel, the tracing_multi link does not set ftrace_managed, causing failure to release the tracing_multi link when attaching a tracing_multi link followed by an fentry link. This triggers a warning in bpf_trampoline_multi_detach and potential resource leaks. The fix sets 'ftrace_managed = true' in register_fentry_multi().

A flaw in the Linux kernel RDMA/rxe module causes the same packet to be reprocessed after a QP enters the error state. When a QP transitions to error while a packet is being completed (e.g. an rdma_cm disconnect racing with receive processing), the responder state machine loops and repeatedly posts the same IB_WC_SUCCESS completion, eventually dereferencing a NULL pointer and panicking the kernel. The duplicate completions are indistinguishable from real receives, breaking RC exactly-once delivery.

In the Linux kernel, esp_ssg_unref() releases page references held on the source scatterlist after the AEAD operation completes. It calls skb_page_unref() on every frag page for out-of-place transforms and in the error path of esp_output_tail(). This is wrong when the skb carries managed frags (SKBFL_MANAGED_FRAG_REFS), which are owned by a zerocopy ubuf and the skb does not hold a per-frag page reference. The missing guard causes a page reference count underflow and frees a page still in use.

Vulnerability in the HFS+ filesystem in the Linux kernel involves missing validation of the thread record before rebuilding the delete key. When hfsplus_delete_cat() is called with str == NULL, it reconstructs the key from thread.nodeName without checking if the record is valid. A corrupted image can provide an oversized name length, leading to a buffer overflow. The fix uses hfsplus_brec_read_cat(), which bounds the record read and verifies the record size.

In the Linux kernel, the cxl/features module's cxlctl_get_feature() sizes its output buffer from the user's fwctl_rpc.out_len but tells the device to write cxl_mbox_get_feat_in.count bytes, where count is a separate user-controlled value. Nothing bounds count against out_len, so a small out_len with a large count overflows the kvzalloc()'d buffer, causing a heap out-of-bounds write reachable from FWCTL_RPC.

In the Linux kernel, the dax/fsdev module's __fsdev_dax_direct_access() uses virt_addr + linear_offset instead of __va(phys) for the kaddr return. For multi-range devices with physical gaps between ranges, this linear arithmetic crosses the gap and produces a wrong kernel virtual address.

In the Linux kernel, the media ipu6 driver freed pdata after auxiliary device initialization, which could lead to a double free of the same object. Error paths already call put_device() and auxiliary_device_uninit(), which trigger release via ipu6_bus_release().

In the Linux kernel wifi iwlwifi mei driver, the SAP message size was not checked before reading the message. The lack of size verification could lead to a buffer overflow.

In the Linux kernel, the uio driver has a stale info pointer issue in the failed registration path. After device_add(), the UIO device is visible to userspace and /dev/uioX can be opened. If a later setup step fails, __uio_register_device() unwinds the device but leaves idev->info pointing at the caller-owned struct uio_info. This is unsafe when an opener races with the failed registration path, leading to use-after-free. The fix handles post-device_add() failures like unregister: removes UIO attributes, clears idev->info under info_lock, and wakes waiters before removing the device.

In the Linux kernel, the software_node_get_reference_args() function incorrectly checked the index bounds when UINT_MAX was passed, leading to an out-of-bounds access in the property array. The fix extends the bounds check to also cover the UINT_MAX case.

In the Linux kernel, bpf_arena_free_pages() accepted arena addresses below the arena base, which after masking to the low 32 bits and reconstructing the user address led to freeing a range outside the arena mapping. The fix rejects such frees before computing the clipped range.

In the Linux kernel, the dmaengine dw-edma driver called vchan_cookie_complete() on a deferred STOP, scheduling a callback for the active descriptor and leaving other descriptors queued. A late callback after dmaengine_terminate_sync() could dereference freed client state, and leftover descriptors could restart into reused buffers. The fix moves all issued and submitted descriptors to the terminated list without scheduling callbacks.

In the Linux kernel, the ASoC meson driver's meson_card_reallocate_links() grows the DAI link and private data arrays with two consecutive krealloc() calls, updating owner pointers only after both succeed. If the first krealloc() moves the data and the second fails, card->dai_link points to an already freed block, leading to a use-after-free and double free.

In the Linux kernel, the RDMA hfi1 driver's set_txreq_header_ahg() ignores the return value of sdma_txinit_ahg(). When initialization fails, tx->txreq is not initialized, yet the caller continues processing the request as though it had succeeded.

HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, intended solely for data portability, to deploy and execute malicious code on the underlying application server host.

In the Linux kernel, the RDMA rxe driver's rxe_requester() does not validate num_sge/cur_sge for WQEs from a user queue. A local unprivileged user can post a WQE with an out-of-range cur_sge or oversized num_sge, forcing an out-of-bounds read of the per-WQE sge array in copy_data() (vmalloc OOB read).