CVE Vulnerability Catalog

In the Linux kernel zram module, the slot lock bit is set in the wrong position on 64-bit big-endian systems. Instead of landing in the flags field, it lands in ac_time, so with ZRAM_TRACK_ENTRY_ACTIME enabled, storing the access time wipes out the held lock bit and lets another CPU take the same slot lock. An access time value with that bit set can make the slot appear locked forever. The fix shifts the lock bit into the flags half on big-endian 64-bit.

In the Linux kernel, the HID sony driver fails to remove a controller from the device list when HID core input device registration fails. The devres-managed sony_sc is freed while its list node remains linked, leading to use-after-free when the next matching controller is handled.

In the Linux kernel, the media: usbtv driver has a use-after-free. ALSA PCM callbacks store driver state in pcm->private_data, and an open PCM file can outlive USB disconnect because usbtv_audio_free() uses snd_card_free_when_closed(). The disconnect path can free struct usbtv before ALSA releases the substream, causing a use-after-free in snd_usbtv_pcm_close().

In the Linux kernel, the usb: dwc3 driver has an issue with the forceRM bit when issuing EndTransfer. On DWC_usb31 v2.00a and v2.10a controllers with forceRM=1, a transfer aborted via ep_dequeue remained active after EndTransfer completion, and a subsequent StartTransfer triggered writes associated with the aborted transfer, causing an SMMU fault because the transfer buffer had already been unmapped. Using forceRM=0 eliminates the issue.

In the Linux kernel, the usb: typec: qcom-pmic-typec driver has an issue with cc_debounce_dwork on stop. cc_debounce_dwork is queued from set_cc() and start_toggling() callbacks, and port_stop() returns before tcpm_unregister_port() destroys the worker. The delayed work can then run after devres has freed pmic_typec_port. The fix uses disable_delayed_work_sync() in port_stop().

In the Linux kernel, the usb: typec: qcom-pmic driver has an issue cancelling reset_work on stop. pdphy_stop() disables IRQs but leaves reset_work pending. If the IRQ handler schedules it just before disable_irq(), the work runs after remove() frees the struct via devm. The fix calls cancel_work_sync() after disabling IRQs.

In the Linux kernel, the usb: typec: ucsi: displayport driver has an out-of-bounds (OOB) altmode array index. The driver indexes the connector's port altmode array with the GET_CURRENT_CAM response after checking it is not 0xff. The array is UCSI_MAX_ALTMODES elements long, so if the PPM returns an invalid response above UCSI_MAX_ALTMODES and not equal to 0xff, the kernel may crash with an OOB index error.

In the Linux kernel, f_midi2_opts_str_show() in the USB gadget driver has a use-after-free. Callers dereference the opts->info.<field> pointer before taking the lock, racing with f_midi2_opts_str_store(), which frees the old string under the lock. A concurrent attribute write can cause a read of a freed pointer.

The rtw_get_wps_attr() function in the Linux kernel's staging rtl8723bs driver fails to validate the WPS attribute length taken from a wireless management frame. This attacker-controlled length is used unchecked as the size for a memcpy(), causing a heap out-of-bounds read and a stack buffer overflow. The flaw can be triggered by a crafted WPS IE in a beacon or probe response processed during scanning.

In the Linux kernel, the staging rtl8723bs driver's rtw_action_frame_parse() does not check the frame_len parameter before indexing into the frame body. Reading frame_body[0] and frame_body[1] requires frame_len >= 26, so a shorter frame (e.g. 24 bytes) causes a 1-2 byte out-of-bounds read. This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx().

In the Linux kernel, the staging rtl8723bs driver's rtw_restruct_wmm_ie() scans the in_ie buffer for a WMM IE. When the 'i + 5 < in_len' check fails near the end of the buffer, execution falls through to 'i += (in_ie[i + 1] + 2)', which at i == in_len - 1 causes a 1-byte out-of-bounds read. A previous fix added the guard only to the match condition, not to the advance.

In the Linux kernel, the newly added show_event_filters and show_event_triggers files do not take a reference to the trace_array they display. Without this reference, the trace_array may be freed via 'rmdir' while a task is reading the file, causing a use-after-free. The fix makes opening both files take the reference via trace_array_get().

A use-after-free vulnerability was found in the Linux kernel tracing mechanism. Opening an options file did not take a reference to the trace_array structure, which could lead to use of freed memory when one process opened the file while another removed the instance. The issue was fixed by adding the trace_array_options_get() function that takes a reference before use.

In the Linux kernel, the scsi bsg completion copies scmd->sense_len to the user response buffer without honoring max_response_len. After a valid sense, the midlayer sets sense_len to the real length (up to SCSI_SENSE_BUFFERSIZE), overrunning a smaller user buffer.

In the Linux kernel, the scsi bsg function scsi_bsg_uring_cmd() reads bsg_uring_cmd from the shared mmap'd SQE, allowing userspace to change a field between check and use (TOCTOU). request_len can grow past sizeof(scmd->cmnd) after the bound check and overflow scmd->cmnd in copy_from_user().

In the Linux kernel, the megaraid_sas driver's megasas_make_prp_nvme() builds a command's PRP list in cmd->sg_frame without checking the buffer bound. After the default BLK_DEF_MAX_SECTORS_CAP was increased to 4 MiB, NVMe transfers require more entries than fit in the frame, causing an out-of-bounds write, a page fault, or silent corruption of a neighbouring DMA pool entry.

In the Linux kernel, the scsi pm8001 driver function pm8001_request_msix() uses index i instead of j in the rollback loop when request_irq() fails, passing the wrong IRQ/dev_id pair to free_irq(). Earlier registered handlers remain installed.

A use-after-free vulnerability exists in the Linux kernel's futex implementation during requeue PI operations on PREEMPT_RT kernels. A race between an early wakeup of a waiting task and a PI requeue can cause the requeue task to call rcuwait_wake_up() on a futex_q structure that has already been freed from the waiter's stack. The issue is resolved by skipping rcuwait_wake_up() in the Q_REQUEUE_PI_LOCKED case.

A use-after-free bug exists in the Linux kernel ftrace subsystem. The set_ftrace_filter and set_ftrace_notrace files for trace instances use the ftrace_ops pointer from inode->private, which can be freed concurrently by an rmdir on the instance, leading to a use-after-free and kernel crash.

In the Linux kernel, a race condition exists in the HID BPF subsystem between the device destruction path (__hid_bpf_ops_destroy_device) and the unregistration path (hid_bpf_unreg), which can double-put the same device reference. This frees the hid_device structure while hid_destroy_device() is still using it, resulting in a use-after-free. The fix serializes the reference release decision under the prog_list_lock.