CVE Vulnerability Catalog

A vulnerability was found in the Linux kernel's skb_gro_receive_list() function, which calls skb_pull() without first ensuring data is in the linear area via pskb_may_pull(). For packets arriving via napi_gro_frags(), this can trigger a BUG_ON assertion failure and system crash.

A use-after-free vulnerability was found in the IBM EMAC network driver for the Linux kernel during device removal. Using devm_register_netdev() caused delayed unregister_netdev(), leading to access to freed hardware resources by interrupt handlers.

A double-free vulnerability was found in the Linux kernel's netdev_nl_bind_rx_doit() function. The error path incorrectly calls nlmsg_free(rsp) after genlmsg_reply() has already consumed the skb, causing a double-free. The fix propagates the error to the user instead of attempting to unbind.

In the Linux kernel, a vulnerability was found where sfp_bus_del_upstream() is not called in the probe failure path of the PHY driver. This leaves a dangling 'upstream' pointer in the sfp-bus structure, which may be later used during SFP events.

In the Linux kernel, a slab-out-of-bounds vulnerability was found in the mlx5 driver's mlx5_query_nic_vport_mac_list function. The firmware command buffer is sized based on PF capabilities, but querying a VF with a larger configuration causes the response to overflow the buffer.

In the mlx5e driver for Mellanox network cards, a DMA memory and XDP frame leak was discovered. When sending an XDP_TX packet in XSK mode, if the hardware queue is full, the function does not free the allocated frame or unmap the DMA address, leading to resource leakage.

A vulnerability in the Linux kernel's timestamp cmsg handling for AF_PACKET sockets was found. The incorrect assumption that the PACKET_OUTGOING flag uniquely identifies error queue packets allows reading AF_PACKET control buffer state as sock_exterr_skb, potentially leading to memory disclosure or kernel panic.

In the Linux kernel, the mvpp2 driver had a DMA synchronization bug for received packets. The CPU sync function started at an incorrect offset, missing data at the packet tail and syncing unused headroom. On non-coherent DMA systems, this can cause the CPU to read stale cache contents.

A use-after-free vulnerability was found in the Linux kernel's nft_tunnel module. The nft_tunnel_obj_destroy() function calls metadata_dst_free() which directly frees the metadata_dst memory, ignoring the dst_entry refcount. Packets that hold a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g., in a netem qdisc) are left with a dangling pointer, leading to use-after-free when dequeued.

A vulnerability was found in the Linux kernel's Bluetooth stack where hci_adv_bcast_annoucement() can cause a temporary buffer overflow when preparing Broadcast Announcement data. The issue occurs when existing advertising instances already hold the maximum extended advertising payload, and prepending service data exceeds the buffer capacity.

In the Linux kernel, the accel/ivpu driver now validates firmware log buffer read/write indices against buffer size. Missing bounds checks could allow out-of-bounds memory access when firmware supplies invalid indices.

In the Linux kernel, a buffer overflow check was added in the accel/ivpu driver's get_info_ioctl function. Missing validation of the size returned by firmware could lead to copying data beyond the allocated buffer.

In the Linux kernel, the accel/ivpu driver has a vulnerability due to signed integer truncation in the IPC receive function. Large unsigned values (>= 0x80000000) supplied by firmware are cast to signed int, causing negative values and subsequent stack buffer overflow during memcpy.

In the Linux kernel, an optimization that skipped exec queue schedule toggle during suspend was reverted because it bypassed GuC suspend, preventing context switch TLB flush for invalidated userptr VMAs. This caused page faults in userptr invalidation tests in LR/preempt-fence VM mode.

A vulnerability was found in the Linux kernel's KVM for ARM64, affecting the handling of the XN[0] bit when FEAT_XNX is not supported. The bug incorrectly uses FIELD_PREP() on the mask that clears XN[0], unconditionally granting execute permissions.

In the Linux kernel, the hv_netvsc driver used phys_to_virt() for mapping memory pages, which on 32-bit x86 with CONFIG_HIGHMEM=y causes memory access faults and system crashes. The fix replaces phys_to_virt() with kmap_local_page() to correctly handle pages outside the kernel direct map.

In the Linux kernel, a use-after-free vulnerability was found in ksmbd related to a deferred file_lock during double SMB2_CANCEL. A second cancel for the same AsyncId triggers the cancel callback on already freed memory, leading to a security breach.

In the Linux kernel, a vulnerability in the USB serial io_ti driver was found where build_i2c_fw_hdr() allocates a fixed-size buffer but copies user-controlled length data (up to 65535 bytes) without validation, causing a heap overflow.

In the Linux kernel's kl5kusb105 USB serial driver, a bulk-out buffer overflow vulnerability was found. The klsi_105_prepare_write_buffer() function copies data from the fifo into a 64-byte buffer without accounting for the two-byte header, causing an out-of-bounds write.

In the Linux kernel, a use-after-free vulnerability was found in the ALSA timer subsystem. When a timer object is freed via snd_timer_free, slave timer instances still point to the freed object, leading to potential memory corruption. The bug is easily triggered with the new userspace-driven timers (CONFIG_SND_UTIMER).