CVE Vulnerability Catalog

A use-after-free vulnerability was found in the Linux kernel's greybus raw driver. It occurs when a raw bundle is disconnected while an application still has its character device (cdev) open. When the application closes the file, it accesses freed memory, causing a kernel panic.

A use-after-free vulnerability was found in the Linux kernel's Greybus RAW driver. If a user writes to the character device after disconnect has been called, a NULL pointer dereference occurs causing a kernel panic. The issue is due to missing synchronization between write operations and connection destruction.

A potential race condition was found in the Linux kernel during TLB synchronization. The issue arises from missing page table lock while traversing and modifying page tables. The fix disables split page table lock for simplicity.

In the Linux kernel, the CCP (crypto: ccp) subsystem has a vulnerability where the IV buffer is overwritten during AES encryption in RFC3686 mode. The ccp_aes_complete() function restored 16 bytes (AES_BLOCK_SIZE) to the IV buffer, while the RFC3686 algorithm uses only an 8-byte IV, causing a buffer overrun.

In the Linux kernel, a use-after-free vulnerability was found in the taprio network scheduler's advance_sched() function during schedule switching. After switch_schedules() is called, the old oper schedule is freed via call_rcu(), but the 'next' pointer still points to an entry in the old schedule, causing a use-after-free.

A double-free vulnerability was found in the Intel ice network driver's ice_xmit_frame_ring() function. When ice_tso() or ice_tx_csum() fails, the skb is freed but the tx_buf pointer remains set, leading to a second free during transmit queue cleanup.

A vulnerability was found in the Linux kernel's SOCKMAP mechanism for AF_UNIX sockets. SOCKMAP can hide an inflight file descriptor from the garbage collector (GC), leading to memory leaks and potential use-after-free. An attacker could exploit this to escalate privileges or destabilize the system.

A vulnerability in the Linux kernel's sctp_getsockopt_peer_auth_chunks function fails to properly validate the user buffer size before writing data. Missing the 8-byte header of the sctp_authchunks structure leads to an out-of-bounds write that can overwrite adjacent user data.

A vulnerability in the Linux kernel's PPPoE driver allows dropping frames with Protocol Field Compression (PFC). An attacker can send a crafted frame with a 1-byte protocol field, shifting the payload by one byte and potentially causing unaligned access exceptions on some architectures.

In the Linux kernel's netfilter/nat subsystem, a vulnerability was found where NAT hook registration structures (ops) were not freed using kfree_rcu. This can cause use-after-free when userspace dumps active hooks via nfnetlink_hook (introduced in v5.14).

In the Linux kernel, a vulnerability was found in the netfilter nfnetlink_osf module, where the nf_osf_ttl() function accessed skb->dev without verifying the device pointer, potentially causing a NULL pointer dereference. The TTL check logic also incorrectly assumed packets from the same subnet would not have a decremented TTL, which is false in container and virtual switching environments.

In the Linux kernel, a vulnerability in the ADFS filesystem lacks validation of the zone count (nzones) in adfs_validate_bblk(), leading to an out-of-bounds write. A crafted disk image with zero zones triggers kmalloc_array(0, ...) returning ZERO_SIZE_PTR, followed by a write before the allocated buffer.

A race condition in the Linux kernel between pressure write and cgroup file release leads to a use-after-free vulnerability in the priv member of struct kernfs_open_file.

In the Linux kernel netfilter/nf_tables subsystem, a vulnerability was found where new hooks are published unsafely into the basechain/flowtable list during the commit phase. The lack of splice_list_rcu() can cause race conditions between netlink dump traversal and concurrent ruleset updates.

In the Linux kernel, the amdgpu driver has a double call to drm_exec_fini() in the userq validation function. When new_addition is true, exec is finalized first, and then on error from amdgpu_ttm_tt_get_user_pages(), drm_exec_fini() is called again, causing a double free. The issue was found by a static analysis tool and confirmed by code review.

In the Linux kernel, a vulnerability was found in the airoha network driver causing a BQL (Byte Queue Limits) imbalance in the TX path. The issue stems from incorrect TX queue indexing, where inflight packets are accounted only for a limited number of queues, while completions are accounted for all queues.

In the Linux kernel, the neigh_xmit function leaks an skb when called with an uninitialized neighbor table (e.g., NEIGH_ND_TABLE with IPv6 disabled). The function did not free the packet in that case, and its return value was ignored by callers like MPLS. The fix ensures full skb ownership and removes the last code path that neither transmits nor frees the packet.

Two bugs were found in the drm/xe graphics driver's xe_exec_queue_create_ioctl() function. The first leaves a dangling pointer when xe_hw_engine_group_add_exec_queue() fails. The second fails to remove the queue from the engine group after xa_alloc() failure, causing a use-after-free.

A data race was found in the Linux kernel's bonding 802.3ad (LACP) implementation due to missing RCU protection for the port->aggregator pointer. The fix adds the __rcu qualifier and proper RCU API usage.

A memory leak was discovered in the Linux kernel's TLS subsystem. During a failed attempt to switch TLS RX to hardware offload, the cleanup function did not free the anchor skb allocated by strparser. The issue was introduced after a change to the strparser implementation.