CVE Vulnerability Catalog

In the Linux kernel, in Bluetooth hci_conn, the SCO setup context is allocated with a NULL destroy callback, leading to memory leaks when an entry is cancelled. Additionally, the context stores a bare hci_conn pointer, potentially leading to use-after-free. The fix holds the connection and releases it from a destroy callback.

In the Linux kernel, a vulnerability in AppArmor's verify_tags() function allows an integer overflow in the bounds check, enabling an out-of-bounds read when loading a crafted policy. The issue is reachable by an unprivileged user in a nested user namespace if unprivileged_userns_apparmor_policy=1 is enabled.

A locking issue exists in the Linux kernel's iommu/dma subsystem around the msi_page_list. When multiple devices assigned to a VM via the legacy VFIO type1 container share the same IOMMU domain (e.g. ARM SMMU with IOMMU_RESV_SW_MSI), concurrent calls to iommu_dma_get_msi_page() can corrupt that list. The fix restores the static msi_prepare_lock.

In the Linux kernel's iommu/vt-d subsystem, there is an issue with clearing the Present bit before tearing down a copied context entry. Zeroing the entry while Present is still set leaves a window where hardware can fetch a torn entry, leading to unpredictable behavior or spurious faults.

In the Linux kernel's iommu/vt-d subsystem, on device probe failure, scalable-mode context entries are not torn down before freeing the PASID table. This can lead to the IOMMU referencing freed memory. The fix performs teardown before freeing the table, similar to the device release path.

In the Linux kernel's iommu/vt-d subsystem, during DMA alias teardown, the function intel_context_flush_no_pasid() uses an incorrect SID (always the device's requester ID instead of the alias). This causes context cache entries for aliases not to be invalidated, potentially leading to the IOMMU using freed memory.

A vulnerability was fixed in the Linux kernel's netfilter nft_ct module related to custom expectation support. The previous implementation could corrupt the expectations list through stale pointers after conntrack extension reallocation. The fix moves expectation handling to an internal conntrack helper and introduces the nf_conntrack_helper_release() function.

In the Linux kernel's NFS subsystem, when the client fails to record a delegation received from the server, it does not send DELEGRETURN. This causes the server to believe the client still holds the delegation, leading to issues with delegation recall and loops in the client's state manager. The fix returns the delegation in these error paths.

A flaw in the Linux kernel AppArmor subsystem affects the unconfined user namespace restriction when a task is already confined by a profile stack. The restriction is not correctly applied, allowing an escape if two transitions through an unconfined profile can be executed. The fix moves the check into the per-profile label build so it is always evaluated against unconfined.

In the Linux kernel's nvme-apple driver, the admin queue allocated with blk_mq_alloc_queue() was never destroyed on controller removal. This left the timeout timer and work armed on a queue that was about to be freed, eventually causing an oops inside blk_mq_timeout_work(). The issue could only be triggered when the controller failed to come up and was then immediately torn down.

In the Linux kernel nvmet subsystem, nvmet_execute_identify_ns_zns() calls bdev_is_zoned() on req->ns->bdev, which is NULL for a file-backed namespace. A host can send an Identify command with CNS 05h and CSI 02h, causing a NULL pointer dereference and kernel oops. The fix rejects the command when the namespace is not backed by a block device.

In the Linux kernel, the NVME_IOCTL_SUBMIT_IO command never calls nvme_cmd_allowed(), unlike IO_CMD and IO64_CMD. Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. The fix passes flags and open_for_write and rejects disallowed commands with -EACCES.

In the Linux kernel NFC LLCP subsystem, nfc_llcp_getsockopt() reads llcp_sock->local before acquiring the socket lock and then dereferences the cached pointer inside the locked region. A race with an in-flight bind() can cause a use-after-free. The fix moves the read and NULL check inside the lock_sock() region.

In the Linux kernel NFC NCI subsystem, nci_close_device() and nci_rx_work can concurrently call nci_data_exchange_complete(), leading to a double sock_put() and refcount underflow that frees a socket still in use (use-after-free). The fix replaces clear_bit() with test_and_clear_bit() so only the first caller proceeds.

In the Linux kernel NFC LLCP subsystem, nfc_llcp_recv_snl() walks the SNL TLV list without bounding reads to the actual skb data, causing length underflow, out-of-bounds reads, and a bug in strncmp()/nfc_llcp_sock_from_sn(). A nearby NFC device can reach this without authentication since LLCP link activation happens automatically after NFC-DEP. The fix walks the TLV list by pointer bounded by skb_tail_pointer() and validates lengths.

In the Linux kernel, the BPF verifier's iterator type comparison during state pruning does not distinguish MEM_RCU from PTR_UNTRUSTED. This can let the verifier prune an unsafe path and accept a dangerous BPF program.

In the Linux kernel, a use-after-free exists in bpf_trampoline_multi_attach_free when a BPF trampoline update fails. When bpf_trampoline_update() fails before modify_fentry_multi()/unregister_fentry_multi() is called, cur_image remains unchanged and ftrace still calls into it, so freeing old_image causes a UAF. The fix only frees old_image when it differs from cur_image.

A vulnerability in the Linux kernel's ALSA sequencer MIDI rawmidi input teardown involves a race condition during rawmidi substream closing. The snd_midi_input_event() function may run concurrently with the closing, leading to a NULL pointer dereference and kernel crash. The issue is fixed by serializing the teardown with event_input using RCU.

In the Linux kernel, a vulnerability in the OCFS2 filesystem was found due to missing validation of the orphan slot during inode read. A corrupted dinode with OCFS2_ORPHANED_FL can carry an invalid orphan slot number, leading to out-of-bounds memory access (use-after-free) during inode wipe operations.

In the Linux kernel, the ocfs2 filesystem has a use-after-free due to missing validation of the i_dio_orphaned_slot field during inode read. A corrupted append-DIO dinode can carry an out-of-range slot value for the mounted filesystem, leading to an invalid pointer and a UAF in ocfs2_get_system_file_inode(). The fix rejects an active i_dio_orphaned_slot outside the slot range during dinode validation.