CVE Vulnerability Catalog

In the Linux kernel, the HID RMI driver is vulnerable to out-of-bounds (OOB) access due to undersized report buffers. The driver allocates buffers based on device-declared report sizes without a minimum bound, then reads/writes at fixed offsets, leading to memory corruption. Additionally, the read loop can hang indefinitely if the device returns zero-length replies, blocking the probe worker.

OpenMeter before v1.0.0-beta.228 contains an SQL injection vulnerability in ClickHouse-backed meter definitions. A remote unauthenticated attacker can access or modify metering event data and potentially cause denial of service.

In the Linux kernel, the wacom_intuos_pro2_bt_irq() function in the HID wacom driver did not validate the received report length before parsing. A malicious or malfunctioning Bluetooth device impersonating a Wacom tablet can send an undersized report, causing an out-of-bounds read and leaking data to userspace via evdev.

A race condition exists in the Linux kernel device-mapper subsystem when loading and unloading a table concurrently. dm_setup_md_queue walks &md->table_devices without any lock, so racing with dm_table_destroy can lead to access to invalid memory.

A race condition exists in the Linux kernel device-mapper subsystem between resume and remove ioctls. If a user issues resume and remove at the same time, the device may be resumed after being suspended in __dm_destroy, so the table is destroyed without calling the postsuspend method, breaking dm target expectations and potentially causing use-after-free (e.g. in dm-integrity).

In the Linux kernel, dma_direct_alloc_from_pool() returns a CPU address instead of a struct page *, which does not match the expectations of dma_direct_alloc_pages(). The bug was introduced by commit 5b138c534fda and can lead to incorrect behavior or a crash.

In the Linux kernel, the fsl-edma dmaengine driver tracing events store a pointer to struct fsl_edma_engine and dereference it when printing a log entry, at which point the pointer may no longer be valid. Event injection (e.g. via the inject file) can trigger a kernel crash.

In the Linux kernel, dt_idle_pd_alloc() allocates memory for the full node path and then sets pd->name to point to the basename of that string. dt_idle_pd_free() frees pd->name, which no longer points to the start of the allocation, leading to an invalid free.

In the Linux kernel, __within_kprobe_blacklist() traverses the kprobe_blacklist without holding kprobe_mutex. When a module is unloaded, entries are immediately freed, leading to a use-after-free in a concurrent call to within_kprobe_blacklist().

In the Linux kernel, alloc_pages_bulk_weighted_interleave() hardcodes GFP_KERNEL when allocating the temporary weights array, even when called in atomic/RCU context. This can trigger a might_alloc() splat due to a sleeping allocation in an invalid context.

In the Linux kernel, memcg_reparent_objcgs() assumes that a folio's objcg matches its node. Folio migration across nodes breaks this assumption, leading to inconsistency and potential use of the wrong LRU lock, which can cause data corruption or crashes.

In the Linux kernel, the ALSA harmony driver has an issue with lock initialization before IRQ registration. The IRQ is registered before h->lock and h->mixer_lock are initialized, which can lead to the interrupt handler using uninitialized locks.

A race condition exists in the Linux kernel between non-atomic ALSA PCM operations (hw_params, hw_free, prepare) and the atomic trigger-start operation. While one thread performs a non-atomic operation, another thread can trigger the PCM start, leading to state inconsistencies and ODEBUG warnings reported by syzkaller. The fix prevents trigger-start during non-atomic operations by checking the runtime->buffer_accessing value.

In the Linux kernel's nvme-fc subsystem, a double free of fabrics options occurs when nvme_add_ctrl() fails. The bug was introduced by commit 1a9e218195a5 and can be triggered under memory pressure or fault injection, leading to use-after-free.

In the Linux kernel, nvme_tcp_handle_c2h_data() failed to check the data direction of a C2HData PDU. A malicious or misbehaving NVMe/TCP controller could respond to a write command with a C2HData frame, triggering a kernel warning (WARN_ON_ONCE) and resetting the controller. No data is copied, so this is not memory corruption.

A vulnerability exists in the Linux kernel NVMe driver's error handling. The nvme_update_ns_info_block() function only checks for negative error codes, ignoring positive NVMe status codes returned by nvme_query_zone_info(). When a device, firmware, or NVMe-oF target fails the Identify command, setup continues with zero-initialized zone info, leading to a shift-out-of-bounds with a negative exponent and continued I/O submission to a zoned queue with a zero zone size.

A vulnerability was found in the Linux kernel's nvmet-tcp subsystem. The NVMe-over-TCP target accepts unsolicited H2CData PDUs without checking whether an R2T was sent for the command. A remote attacker can exploit this to cause a double-add of the command to the response list, leading to a system hang (soft-lockup) or kernel panic (kernel BUG).

In the Linux kernel, migrate_device_range() and migrate_device_pfns() clear entries following a compound folio without limiting them to the number of slots remaining in the npages-sized array. If a compound folio extends beyond the end of the caller-provided range, the loops cause an out-of-bounds write.

In the Linux kernel, the nfree field in the BTT info block is read from the medium without validation. btt_freelist_init() and btt_rtt_init() size the freelist[] and rtt[] arrays by nfree, but the I/O path indexes them by the lane bounded by num_lanes rather than nfree. An arena with nfree below the lane count causes an out-of-bounds write.

In the Linux kernel, vmemmap_populate_compound_pages() on powerpc manually advanced addr_pfn in a way that did not match the loop's progression through vmemmap addresses. This caused pfn_offset to be computed from the wrong PFN and led to incorrect head/tail mapping decisions for compound pages.