CVE Vulnerability Catalog

In the Linux kernel's amba-pl011 driver, RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel both timers.

In the Linux kernel's staging rtl8723bs driver, rtw_get_wpa_ie() reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short trailing IE.

In the Linux kernel's staging rtl8723bs driver, the WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg_txt buffer, potentially causing overflow or underfill.

In the Linux kernel's staging rtl8723bs driver, rtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and reads the 802.11 frame control field without checking that a base 802.11 header remains, potentially causing out-of-bounds reads or insufficient data.

In the Linux kernel's fastrpc module, there is a potential race condition during buffer unmap operations. The buffer is removed from the list only after the unmap operation, which can cause issues when multiple threads invoke unmap concurrently. The fix moves the list removal before the unmap, re-adding the buffer if unmap fails.

In the Linux kernel's fastrpc module, the fl->lock is not held when moving memory mappings after an interrupted invoke. The list_del() and list_add_tail() operations run without this lock, which can cause races with other operations on the mmaps list. The fix adds the lock around the move.

In the Linux kernel, the ALSA usx2y driver (for USB US-X2Y sound cards) lacks offset validation in the mmap function for the hwdep interface. An attacker can supply an arbitrary offset, leading to access to kernel memory outside the allocated region, and in extreme cases to a system oops.

A vulnerability in the Linux kernel's ALSA FCP driver causes an out-of-bounds write in fcp_meter_ctl_get(). The issue stems from an incorrect map size limit (255 instead of 128), allowing writes beyond the allocated buffer. An attacker with CAP_SYS_RAWIO can install an oversized map, and any process with access to /dev/snd/controlC0 can trigger the out-of-bounds write.

A use-after-free vulnerability was found in the Linux kernel's perf subsystem, related to improper sibling event detachment from a group. When a sibling event is detached (e.g., during CPU hot-unplug), its group_leader pointer remains pointing to the old leader, which may be freed, leading to dereferencing freed memory during a PERF_IOC_FLAG_GROUP ioctl. The issue was reproduced by running the perf event fuzzer, CPU hotplug, and a stress workload concurrently.

In the Linux kernel fbdev driver, the bit_cursor() function did not validate the glyph index read from the screen buffer, which could lead to an out-of-bounds memory read. The issue was reported by Syzkaller and affects the write path to /dev/vcsa.

In the Linux kernel, ring_buffer_subbuf_order_set() frees buffer pages, which is not allowed when resizing is disabled. A non-consuming reader is at risk of use-after-free in rb_advance_iter(). The function now returns -EBUSY when resize_disabled is set, matching ring_buffer_resize() behavior.

A subtle race condition in the Linux kernel's huge_zero_folio implementation can cause the huge_zero_pfn to be overwritten with an invalid sentinel value by the shrinker, leading to misidentification of the huge zero page as a regular THP folio. This may result in incorrect splitting and handling of the huge zero folio.

In the Linux kernel, smc_rx_splice() has a lifetime imbalance issue for splice entries. The function passes pages to splice_to_pipe() before taking references, which can lead to use-after-free due to refcount underflow.

In the Linux kernel, in6_dev_get() can resurrect an inet6_dev object after it has been freed. It reads dev->ip6_ptr under RCU and then unconditionally increments its refcount. If device teardown clears the pointer and drops the last reference between these operations, the increment can resurrect an object whose RCU free has already been queued, leading to use-after-free.

In the Linux kernel, the net/dibs module has a double-free and use-after-free (UAF) issue with dmb_clientid_arr. An interrupt handler can be active after dibs_dev_del() and still access the array. In case of failure in dibs_dev_add(), the array is freed twice.

In the Linux kernel, the zerocopy_fill_skb_from_devmem() function lacks a check to prevent mixing net_iov and page-backed fragments in a single skb. Such mixing can cause a crash in the network stack.

In the Linux kernel, the ntb_netdev driver's ntb_netdev_rx_handler() hands the received skb to the network stack before allocating its replacement. If allocation fails, the buffer is not reposted, gradually depleting the RX queue and potentially stalling reception.

In the Linux kernel's netfilter bridge subsystem, a nftables ct zone rule can attach a conntrack template to an skb before nf_ct_bridge_pre() processes it. For non-IP EtherTypes, the function overwrites the conntrack state without releasing the template reference, causing memory leaks.

In the Linux kernel's netfilter nf_conntrack, TCP and SCTP paths can emit invalid-packet logs while holding ct->lock. If logging is routed to nfnetlink_log and conntrack export is enabled, a deadlock can occur.

A vulnerability in the Linux kernel's net/sched/act_ct module causes an sk_buff leak when header checks reject a packet. The function tcf_ct_handle_fragments() returns errors without freeing the skb, and the caller treats all non-zero returns as ownership transfer, leading to a memory leak. Reproduced on v7.2-rc6, each malformed packet leaks a 232-byte skbuff_head_cache object plus a 704-byte data buffer.