CVE Vulnerability Catalog

In the Linux kernel, the ppp driver lacks a requirement for CAP_NET_ADMIN in the target network namespace for unattached ioctls. A local unprivileged user can create a new user namespace, gain CAP_NET_ADMIN only in that namespace, and then issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against an inherited network namespace.

In the Linux kernel, a vulnerability was found in the Bluetooth stack where hci_conn_request_evt() calls hci_connect_cfm() without holding the hdev->lock when the protocol sets HCI_PROTO_DEFER. This can lead to a use-after-free (UAF) if the connection is deleted concurrently.

In the Linux kernel, missing channel lock in l2cap_ecred_reconf_rsp allows a remote BLE device to send a crafted L2CAP ECRED reconfiguration response, potentially corrupting the channel list while another thread iterates it.

A vulnerability in the Linux kernel's SCTP over UDP implementation fails to disable BH before calling tunnel xmit functions, causing unbalanced recursion counters and potential packet drops.

A null-pointer dereference vulnerability was found in the Linux kernel's xdp_master_redirect() function when redirecting XDP traffic to a master interface that has not been brought up. The issue occurs when a bond interface in round-robin mode is never opened (bond_open()), leaving the per-CPU rr_tx_counter uninitialized, leading to a kernel panic.

In the Linux kernel, the DRM komeda driver had an integer overflow vulnerability in AFBC framebuffer size validation. The minimum required buffer size calculation added AFBC payload size to the framebuffer offset without overflow checking, potentially allowing an undersized GEM object and out-of-bounds memory access.

In the Linux kernel PCI endpoint subsystem, a vulnerability was found in pci_epf_alloc_doorbell(). After a failed MSI vector allocation, the doorbell message array is freed but EPF structure pointers still point to freed memory, potentially causing a double-free. Additionally, missing checks for already allocated doorbells allow memory leaks or overwriting existing allocations.

In the Linux kernel, the SMQ cache policy for dm-cache devices lacks locks when invalidating cache blocks in passthrough mode. Concurrent invalidation operations from multiple workers can cause data races on the allocated blocks counter and use-after-free issues in internal data structures.

In the Linux kernel, a vulnerability in the dm log module causes an out-of-bounds write due to a 32-bit integer overflow in region_count. The variable cannot hold the 64-bit result of sector division, leading to undersized buffer allocation and subsequent heap memory corruption.

A missing TLB and context cache invalidation after updating DDT/PDT entries was found in the Linux kernel's RISC-V IOMMU driver. The RISC-V IOMMU specification (Sections 6.3.1 and 6.3.2) mandates these invalidations to ensure address translation consistency.

In the Linux kernel, a locking bug was found in the drm/msm driver's VM_BIND UNMAP operation. An incorrect argument caused objects involved in UNMAP operations not to be always locked. The issue affected non-_NO_SHARE buffer objects.

In the Linux kernel, a vulnerability was found in the AMD IOMMU subsystem's clone_alias() function. It incorrectly assumed the first argument (pdev) always points to the original device, while it could be an alias. This caused the wrong devid to be used when copying DTE entries, leading to incorrect or stale entries being propagated to the alias device.

A race condition in the Linux kernel's dquot_scan_active() function during quota deactivation was discovered. Under memory pressure, it can lead to use-after-free, causing system instability.

In the Linux kernel, a vulnerability in the soc/tegra: cbb driver uses incorrect ARRAY_SIZE in fabric lookup tables, potentially causing out-of-bounds access during target timeout lookup.

In the Linux kernel, a bug was found in the OCFS2 filesystem's listxattr() function. When an inode has both inline and block-based extended attributes and the inline names exactly fill the caller's buffer, the function may return a size larger than the buffer, causing a kernel panic (BUG).

In the Linux kernel, a vulnerability in the OCFS2 filesystem lacks validation of the bg_bits field during freefrag scan in the non-coherent path (OCFS2_INFO_FL_NON_COHERENT). A crafted filesystem can cause an out-of-bounds memory read (use-after-free) when processing the OCFS2_IOC_INFO ioctl.

In the Linux kernel, an off-by-one error was found in the check_imm function used by the ARM64 BPF JIT to validate immediate values for conditional and unconditional branches. The flaw allows values one bit wider than the signed N-bit field can hold, potentially causing incorrect instruction encoding and reversing branch direction.

A race condition in the Linux kernel's BPF sockmap for af_unix sockets causes a use-after-free when a BPF iterator updates a sockmap. The fix adds a state lock to ensure socket stability during the update.

A vulnerability was found in the Linux kernel in the arena_alloc_pages() function within the BPF subsystem. The function accepts a node_id as a plain int and forwards it through the allocation chain without any bounds checking.

In the Linux kernel NFSD subsystem, a bug in nfsd4_add_rdaccess_to_wrdeleg causes an extra increment of the nfs4_file access count when fp->fi_fds[O_RDONLY] is already set by another thread. This prevents the nfsd_file object from being freed, leading to a BUG in kmem_cache_destroy() when stopping the nfs-server service.