CVE Vulnerability Catalog

A vulnerability was found in the Linux kernel's xfrm module related to transport-mode packet processing. During deferred transport reinjection, a pointer to the network namespace (netns) stored in skb->cb may become invalid if the namespace is removed before the callback executes.

In the Linux kernel's L2TP module, a vulnerability was found where l2tp_session_get_by_ifname() uses plain refcount_inc() instead of refcount_inc_not_zero(). This can cause a race condition returning a pointer to a session with a zero reference count, leading to a use-after-free.

A vulnerability in the Linux kernel's VTI6 (Virtual Tunnel Interface for IPv6) driver was found. After moving a VTI6 interface between network namespaces (netns), the vti6_changelink() and vti6_update() functions use a stale network reference (dev_net instead of t->net), leaving a stale entry in the original namespace's hash table. This causes a kernel BUG when cleaning up that namespace, allowing an attacker in an unprivileged container to crash the system.

A vulnerability was found in the Linux kernel's HID driver for Wacom tablets. The wacom_hid_set_device_mode() function assumes that the HID_DG_INPUTMODE usage is always in the first field of the report, which can lead to an out-of-bounds (OOB) write if the usage is located in a different field.

In the Linux kernel, an out-of-bounds read vulnerability exists in the NFC HCI stack within nfc_hci_recv_from_llc() and nci_hci_data_received_cb(). A malicious NFC peer can send a zero-length HCP frame, causing an out-of-bounds heap read and potentially a skb_over_panic during reassembly.

In the Linux kernel, a vulnerability was found in the XFRM (IPsec) migration mechanism. Functions sending migration notifications (xfrm_send_migrate and pfkey_send_migrate) incorrectly routed them to the default network namespace (init_net) instead of the caller's namespace. This caused IKE daemons in other namespaces to never receive their own migration notifications, while daemons in init_net received notifications from all namespaces.

A vulnerability in the Linux kernel's netfilter conntrack TCP module allows an RST packet with an invalid sequence number to force a connection into the CLOSE state without proper direction validation. This can prematurely terminate active NAT entries.

In the Linux kernel, the xfrm iptfs module has a vulnerability due to improper cloning of runtime state when copying Security Associations (SAs). The iptfs_clone_state() function copies runtime objects such as skb queues, timers, and spinlocks that should not be shared with the original SA, leading to use-after-free and double-free memory issues.

A use-after-free (UAF) vulnerability was found in the Linux kernel's dma_buf_fd() function related to a tracepoint. After FD_ADD() returns, the file descriptor becomes live in the descriptor table, allowing another thread to close it before DMA_BUF_TRACE() executes, causing a use-after-free of the dma_buf structure.

In the Linux kernel's ksmbd filesystem, a regression causes an out-of-bounds (OOB) read in the ACE-walk loop of smb_check_perm_dacl(). The flaw stems from a transposed bounds check that never breaks the loop, allowing a 2-byte heap OOB read past the allocated pntsd buffer during SMB2_CREATE operations.

A use-after-free vulnerability was found in the Linux kernel's USB MUSB driver for the OMAP2430 platform. The omap2430_probe() function calls of_node_put(np) before the last access to the node, potentially leading to use of freed memory.

In the Linux kernel, a use-after-free vulnerability exists in the USB gadget f_fs subsystem. The ffs_epfile_dmabuf_io_complete() function frees a USB request without clearing the priv->req pointer, leading to usb_ep_dequeue() being called on freed memory. The fix moves the deallocation to ffs_dmabuf_cleanup() with proper locking.

In the Linux kernel Thunderbolt driver, a vulnerability was found where a 32-bit sum wraps during property entry validation. A malicious XDomain peer can exploit this to read memory beyond the allocated block, leading to data leakage.

A vulnerability in the Linux kernel's SCSI Fibre Channel (FC) transport subsystem allows an attacker with FC fabric access to send a crafted FPIN ELS frame, causing an infinite loop in the FC transport driver and resulting in a denial of service (DoS). The issue stems from using an 8-bit counter for a 32-bit pname_count field, which wraps at 256 and keeps the loop condition true indefinitely.

In the Linux kernel, a race condition in the DRM GEM driver between change_handle and handle_delete operations was fixed. During the window between releasing and re-acquiring the IDR table lock, a concurrent delete of the old handle could decrement the reference count to zero and free the GEM object while the new handle still references it in the IDR.

In the Linux kernel i915 driver, a use-after-free (UAF) vulnerability was found during TTM object purge. The issue arises because the bo->ttm pointer may be changed by ttm_bo_validate(), leading to dereference of an invalid object and general protection faults.

A race condition in the Linux kernel's qcom_geni serial driver causes a kfifo underflow when uart_flush_buffer() runs before the DMA completion IRQ. This results in stale buffer data being transmitted on the next DMA transfer.

In the Linux kernel, the amdkfd driver has an integer overflow vulnerability in the get_queue_ids() function. The array size calculation as num_queues * sizeof(uint32_t) can overflow on 32-bit systems, leading to potential security issues.

In the Linux kernel, a bug in the amdgpu_hmm_range_get_pages function of the amdgpu driver was fixed. The notifier sequence was read multiple times, which could lead to working with invalid pages. The coding style was also improved by removing the pre-initialized return value and using the common define for the 2G range.

In the Linux kernel for ARM64 architecture, a vulnerability was found in the TLB walk cache invalidation mechanism. The tlb_flush() function did not check the unshared_tables flag, causing the wrong instruction (VALE1IS instead of VAE1IS) to be used after PMD table unsharing (huge_pmd_unshare), leaving stale non-leaf entries in the walk cache. This could lead to incorrect page table walks.