CVE Vulnerability Catalog

A vulnerability has been identified in the Bluetooth L2CAP module of the Linux kernel, leading to a use-after-free error in the l2cap_connect function. The issue was reported by Syzbot and involves reading memory after it has been freed.

In the Linux kernel, the xen-netback driver has a use-after-free vulnerability in xenvif_flush_hash. During list iteration in an RCU critical section, calling kfree_rcu may cause access to freed memory.

A vulnerability has been identified in the Linux kernel related to out-of-bounds access in SoC stats for the ath11k wifi module. The issue arises from incorrect usage of the SRNG ring ID, leading to errors in array access.

W jądrze Linuxa rozwiązano podatność związaną z rejestracją grup sysfs przez rdzeń sterownika. Umożliwiono uproszczenie obsługi błędów oraz czyszczenia, a także uniknięcie wyścigu UAF podczas wyrejestrowywania, gdzie atrybuty sysctl były dostępne po zwolnieniu struktury info.

In the Linux kernel, in the DRM subsystem for AMD Display, null pointer checks were added before using certain pointers. Previously, these pointers were null-checked earlier in the same function, indicating they might be null, and using them again without checks caused issues. This fixes three FORWARD_NULL issues reported by Coverity.

A use-after-free vulnerability in the jfs module of the Linux kernel has been fixed, which could lead to unexpected system behavior. The issue pertains to functions managing mutex locks.

In the JFS filesystem in the Linux kernel, an out-of-bounds read vulnerability was found in the dbSplit function. The issue occurs because dmt_leafidx can be greater than the number of leaves in the dmap tree. A check for dmt_leafidx was added in dbFindLeaf, covering control pages as well.

A vulnerability has been identified in the Linux kernel related to improper access to an uninitialized value in the lzo1x_1_do_compress function. The issue concerns the ea_buf variable, which was not properly initialized, potentially leading to unpredictable system behavior.

In the Linux kernel, the AMD GPU driver (amdgpu) has an out-of-bounds index vulnerability in the cm_helper_translate_curve_to_degamma_hw_format function. The index 'i' can exceed the number of transfer function points, leading to buffer overflow.

A vulnerability has been identified in the Linux kernel within the ext4 filesystem that may lead to a use-after-free error in the ext4_ext_show_leaf() function. This issue occurs when the 'path' pointer is used after being freed or reallocated, potentially leading to unpredictable system behavior.

In the Linux kernel, the nbd module has a race between timeout and normal completion. If timeout is handled by nbd_requeue_cmd(), normal completion must be stopped to avoid use-after-free. The fix clears NBD_CMD_INFLIGHT in nbd_requeue_cmd() and ensures cmd->lock is grabbed before clearing the flag and requeueing.

A use after free (UAF) vulnerability has been identified in the ether3 driver within the Linux kernel, caused by a race condition. The issue occurs in the ether3_probe function where a timer is initialized with a callback function, potentially leading to unsafe memory access when the module or device is removed.

A deadlock vulnerability was found in the Linux kernel's EROFS filesystem caused by crafted images with overlapping pclusters. The issue leads to a task hang due to improper handling of managed folios and I/O submission ordering.

A vulnerability has been identified in the Linux kernel related to injecting an error in the driver before stopping the queue. The issue is that the driver does not properly close the master ooo when the accelerator core reports a memory error.

In the Linux kernel, the f2fs filesystem did not wait for all direct write I/O operations to complete before block removal. This could lead to overwriting data in blocks that have been reallocated to another inode.

A vulnerability has been identified and resolved in the Linux kernel. It concerns the dbNextAG() and diAlloc() functions, where the lack of proper checks led to out-of-bounds memory access.

A vulnerability has been identified and resolved in the Linux kernel. The issue pertains to the 'rtw_wait_firmware_completion()' function, which improperly handled concurrent firmware loading, potentially leading to memory management errors.

A vulnerability in the Linux kernel's BPF subsystem causes a kernel crash during verification of BPF programs using sign-extension for packet data/data_end/data_meta fields. The issue stems from improper handling of 32-bit sign-extended operations on packet pointers, potentially leading to invalid addresses and runtime failures. The fix rejects verification of BPF programs that use sign-extension for these fields.

A vulnerability related to an out-of-bounds write error in the rtl2832 driver has been fixed in the Linux kernel. The issue was that the index in the rtl2832_pid_filter function could exceed the allowed range, leading to unauthorized access.

A vulnerability related to an out-of-bounds write error in the rtl2830 driver has been fixed in the Linux kernel. The issue was that the index in the rtl2830_pid_filter function could exceed the allowed range, leading to unauthorized access.