CVE Vulnerability Catalog

A vulnerability in the Linux kernel's fib6_select_path() function for IPv6 can cause an infinite loop. The issue arises from a race condition between list_del_rcu() operations on the fib6_siblings list and concurrent softirq readers, preventing the loop terminator from being reached.

In the Linux kernel, __get_vm_area_node() incorrectly triggers a BUG() when bottom halves (BH) are disabled, causing a kernel panic during normal bridge operations like FDB entry addition.

In the Linux kernel, a vulnerability in the HPFS filesystem causes a crash when hpfs_map_dnode_bitmap fails. The issue is calling hpfs_brelse4 on an uninitialized quad buffer head, leading to memory corruption.

In the Linux kernel, a vulnerability in memfd allows SEAL_WRITE to be implied via SEAL_EXEC before checking for existing writable mappings, breaking the write-seal contract. This enables an attacker to pass a memfd that appears write-sealed but remains modifiable.

A use-after-free vulnerability was found in the Linux kernel's zram subsystem in the zram_writeback_endio function. A race condition between the bio completion handler and the writeback task can cause a kernel crash.

In the Linux kernel, a vulnerability in try_to_unmap_one in mm/rmap fails to initialize nr_pages at the start of each loop iteration, allowing reuse of a stale value from a previous folio_unmap_pte_batch() call. This can corrupt folio refcount/mapcount when combining MAP_DROPPABLE, MADV_FREE, and HMM_DMIRROR_EXCLUSIVE, leading to a kernel crash.

In the Linux kernel Bluetooth HIDP subsystem, missing length validation in hidp_input_report() allows an out-of-bounds read when a paired device sends a truncated packet. This can cause phantom key presses or spurious mouse movements.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's Bluetooth ISO stack in the iso_recv_frame function. It reads the socket pointer under a lock but uses it after releasing the lock, allowing a concurrent iso_sock_kill() to free the memory.

In the Linux kernel's Bluetooth ISO subsystem, a race condition was found in iso_sock_clear_timer(). The function reads the connection pointer without holding the socket lock, which can lead to a NULL pointer dereference or use-after-free (UAF) when the socket is being closed concurrently.

In the Linux kernel Bluetooth subsystem, a use-after-free (UAF) vulnerability was found in hci_le_create_cis_sync. The conn pointer is dereferenced after releasing RCU and hci_dev_lock locks, allowing a concurrent disconnect to free memory before read. The cancellation mechanism in hci_conn_del() fails because queue and dequeue data mismatch.

A race condition was found in the Linux kernel's parport subsystem between port and client registration. Ports are registered before full initialization, allowing clients like lp to attach to incomplete ports, causing system crashes.

A vulnerability was found in the Linux kernel's KVM for ARM64, related to incorrect capping of the ZCR_EL2 register by a guest hypervisor. The issue occurs when the guest updates ZCR_EL2 via ZCR_EL1 without proper sanitization, allowing L2 guests to access unauthorized vector lengths (VL).

In the Linux kernel, a vulnerability was found in the KVM SEV component due to missing READ_ONCE() when reading entries/indices from the guest-accessible Page State Change (PSC) buffer. This allows a TOCTOU (Time-of-Check Time-of-Use) attack by a malicious guest.

A use-after-free vulnerability was found in the Linux kernel's IIO hardware consumer error path. The list_for_each_entry() macro accesses freed memory after iio_buffer_put() releases a buffer during cleanup in iio_hw_consumer_alloc().

In the Linux kernel, a use-after-free vulnerability was found in the USB dwc2 driver's debug code. The issue occurs because the 'urb' structure is dereferenced after calling usb_hcd_giveback_urb(), which is not allowed.

In the Linux kernel, a bug was found in the BPF sockmap's bpf_msg_push_data() function. When inserting data into a scatterlist entry, the right fragment offset was incorrectly advanced by the global insertion point instead of the local offset within the entry, causing split layout inconsistency.

In the Linux kernel's macsec module, a vulnerability bypasses replay protection at XPN lower-PN wrap. When PN reaches 0xFFFFFFFF, incrementing overflows to 0, failing to update next_pn_halves, allowing an attacker to replay a captured frame indefinitely.

In the Linux kernel, the octeontx2-af driver has a vulnerability allowing out-of-bounds memory write. The rvu_mbox_handler_rep_event_notify function does not validate the pcifunc field in the request, enabling an attacker to write past the allocated PF/VF structure array.

In the Linux kernel VTI (Virtual Tunnel Interface) driver for IPv6, a vulnerability allows an unprivileged user in a network namespace to hijack a VTI tunnel from another namespace. The issue stems from using dev_net(dev) instead of t->net in the tunnel lookup within vti6_siocdevprivate(), enabling hash table manipulation after tunnel migration.

In the Linux kernel, a vulnerability in IPv6 extension header handling allows an unprivileged user to trigger a slab-out-of-bounds read via nftables payload-write, as the header length is not re-validated before copying to cmsg.