CVE Vulnerability Catalog

In the Linux kernel, the USB gadget uvc driver's uvc_function_bind() and uvc_function_unbind() leave dangling pointers uvc->control_req and uvc->control_buf after freeing. This leads to use-after-free.

In the Linux kernel, cxl_rch_get_aer_info() reads AER registers beyond the mapped block because sizeof(struct aer_capability_regs) exceeds the physical AER capability size. The over-read can also cause a second out-of-bounds in pcie_print_tlp_log().

In the Linux kernel, the HID sensor-hub driver's sensor_hub_get_feature() clamps the return value but the copy loop still copies field->report_size / 8 bytes per value. A malicious HID descriptor can cause an out-of-bounds write when an IIO caller supplies a small buffer.

In the Linux kernel, the media: cec: stm32 driver's stm32_rx_done() appends each received CEC byte to rx_msg.msg[] using rx_msg.len as the write index without checking it against the buffer size. The rx_msg.msg[] buffer is a fixed CEC_MAX_MSG_SIZE (16) byte array, and the number of bytes before RXEND is controlled by the remote CEC device, allowing an out-of-bounds write.

In the Linux kernel, the media: vicodec driver's fwht_encode_frame() encodes one plane per component, and an incompressible plane takes the FWHT_FRAME_UNENCODED path copying the plane verbatim. For a 4-component pixel format all four planes are full resolution, so a frame forcing the unencoded fallback writes more bytes than the buffer size, overrunning the plane by coded_w * coded_h.

A slab-out-of-bounds vulnerability was fixed in the Linux kernel's nilfs_direct_propagate() function in the nilfs2 filesystem. After truncating a file, a B-tree node block remained in the cache in a dirty state and was later incorrectly processed as a direct mapping entry, causing an out-of-bounds memory access. The issue was resolved by adding a nilfs_btree_discard() operation to delete the orphaned node block during mapping conversion.

In the Linux kernel, ubifs_sb_verify_signature() bounds the on-disk ubifs_sig_node->len field with the wrong sign, adding the header size instead of subtracting it. This accepts a declared length up to 2 * UBIFS_SIG_NODE_SZ larger than the node actually holds, leading to an out-of-bounds read past c->sbuf while processing the PKCS7 signature.

In the Linux kernel, a flawed WARN_ON_ONCE was removed from nfsd_mode_check(). The assumption justifying the warning is invalid for NFS reexport, where the function can encounter a dentry without i_op->lookup. Returning nfserr_notdir must remain to guard the lookup_one_unlocked() path against a NULL method pointer dereference.

In the Linux kernel, the nlmsvc_ops pointer was published and cleared with plain stores while lockd dereferenced it unguarded from dispatch sites in fs/lockd/svcsubs.c. After nfsd module removal, a stale load could result in a NULL dereference or a module-text use-after-free.

In the Linux kernel, nfsd_cross_mnt() jumped to the out label on a follow_down() error without releasing the path references taken by mntget() and dget(). This leaked references on each failed cross-mount, blocking umount and pinning dentries.

In the Linux kernel, the nfsd module failed to reset the write verifier when an async COPY writeback failed. When writeback failed, the server reported NFS_UNSTABLE to the NFS client but did not rotate the verifier, so after COMMIT the client treated the data as durable even though the write had failed.

In the Linux kernel, nfsd_dispatch() did not restore rq_status_counter to an even value on all exit paths (cache-hit, drop, encode-error). The counter left odd caused the lockless reader in nfsd_nl_rpc_status_get_dumpit() to treat rqstp fields as stable and read past the end of the 8-element ops array.

In the Linux kernel, _nfsd_copy_file_range() sampled the writeback error cursor (dst->f_wb_err) after the copy loop instead of before it. Concurrent COMMIT or stable WRITE could advance the cursor, so the writeback error went undetected and NFSD4_COPY_F_COMMITTED was set despite the failed write.

In the Linux kernel, nfsd4_decode_create() accepted an unbounded cr_datalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size (several MiB) per COMPOUND op. The VFS rejected oversized targets with ENAMETOOLONG, but the allocation had already occurred.

In the Linux kernel's nfsd module, a flaw allows subsequent operations to run after a FOREIGN PUTFH even when fh_dentry is NULL. A remote NFSv4.2 client can craft a COMPOUND request that triggers a NULL pointer dereference in the nfsd kernel thread. The issue affects configurations with CONFIG_NFSD_V4_2_INTER_SSC enabled.

In the Linux kernel's nfsd module, nfsd4_decode_posixacl() accepts an unbounded ACL entry count from the client and passes it to an O(n^2) bubble sort. A client can choose an arbitrarily large value, causing excessive CPU consumption on the server. The symmetric NFS_ACL_MAX_ENTRIES check present on the encoder side is missing in the decoder.

In the Linux kernel's nfsd module, nfsd_break_one_deleg() sets the NFSD4_CALLBACK_RUNNING bit, but when the recall queue attempt fails, the bit is not cleared. This permanently latches the bit, causing subsequent break_lease() calls on the same delegation to silently skip the recall, so the delegation is never broken and conflicting opens or locks stall. The fix clears the bit on the !queued branch.

In the Linux kernel's nfsd module, nfsd4_release_compoundargs() resets args->ops to the inline iops[8] array but leaves args->opcnt at its original value (up to 200 for NFSv4.1+). When rq_status_counter is stuck at an odd value, the dumpit handler reads up to 16 entries from args->ops[], reading past the array and leaking adjacent slab memory to userspace via netlink. The fix zeroes opcnt unconditionally.

In the Linux kernel's nfsd module, the args->ops buffer is freed synchronously via vfree() in nfsd4_release_compoundargs(), while the rpc_status netlink dumpit handler reads that buffer under rcu_read_lock. A concurrent compound completion can free the buffer while it is being read, causing a use-after-free on vmalloc memory. The fix replaces vfree() with kvfree_rcu_mightsleep(), deferring the free across an RCU grace period.

In the Linux kernel's nfsd module, nfsd_file_do_acquire() could use a file returned by dentry_create() that was not actually opened, because ->atomic_open may return success via finish_no_open(). The scenario is extremely unlikely, but the fix requires nfsd to use the file only when FMODE_OPENED is set.