CVE Vulnerability Catalog

In the Linux kernel's mac80211 subsystem, leaving a mesh network does not abort an ongoing channel switch (CSA), leading to a crash due to invalid memory access. The issue occurs when the channel context is released while the CSA finalize work is still running.

In the Linux kernel's mac80211 subsystem, when starting an access point (AP) fails, the interface state is not reset, leading to divide errors and warnings during scanning. The issue involves leaving beaconing enabled after a failed AP start.

In the Linux kernel's mac80211 subsystem, when bringing up an interface fails, the LED state is not reset, causing a timer to remain active and potentially be freed, leading to warnings and possible crashes. The issue involves the TPT trigger timer.

In the Linux kernel's mac80211 subsystem, the ieee80211_tdls_oper() function can operate on the AP station, leading to warnings when the AP station is removed or later confused for a TDLS peer. There is no check that the station is actually a TDLS peer.

In the Linux kernel's mac80211 subsystem, interfaces are not removed from the local->interfaces list when their netdev is unregistered without going through ieee80211_if_remove(). This can lead to a BUG in wiphy_to_rdev() during interface removal.

In the Linux kernel's cfg80211 subsystem, when a network namespace is destroyed, moving the wiphy to the initial namespace can fail, leaving a garbage netns pointer. This leads to a kernel fault when notifying about the wiphy.

In the Linux kernel's mac80211 subsystem, frames injected on a monitor interface can carry a radiotap field requesting a bandwidth wider than the actual channel bandwidth, leading to a warning in hwsim. Such frames should be dropped.

In the Linux kernel's mac80211 subsystem, the scan elements length (scan_ies_len) does not account for the HE 6 GHz Band Capability element, which can lead to failure in building probe requests and trigger a WARN_ON during scanning.

In the Linux kernel's mac80211 subsystem for mesh networks, the CSA state (ifmsh->csa) is not reset when leaving the mesh, leading to memory leaks and incorrect state (csa_role, chsw_ttl). The fix resets the state when leaving the mesh.

In the Linux kernel's mac80211 subsystem for mesh networks, if starting the mesh fails, the channel context is not released, leading to warnings and potential crashes during interface removal. The fix correctly releases the channel on start failures.

In the Linux kernel, the mac80211 subsystem had an issue with early TX info initialization, leading to improper error reporting to userspace. The fix initializes skb->cb[] earlier, enabling the use of ieee80211_free_txskb() and unifying the error handling path.

In the Linux kernel, the pxa DMA engine driver had a double counting issue of hardware descriptors after conversion to kzalloc_flex(). The fix explicitly sets the nb_desc counter and removes the increment to avoid errors in processing loops.

In the Linux kernel, the RDMA/siw driver has an out-of-bounds (OOB) write vulnerability caused by improper length limiting of fragmented header copies. The fix uses the number of already received header bytes to calculate the next copy length.

In the Linux kernel, the netfilter nft_nat module has an uninitialized memory issue in nft_nat_setup_netmap() for IPv4 mapping. The fix zero-initializes the entire new_addr structure to avoid using uninitialized data.

In the Linux kernel, the netfilter nf_nat module has a memory leak when hook registration fails. The fix postpones setting nat_hook_ops and simplifies the error path to ensure hooks are released.

In the Linux kernel, the netfilter flowtable module has an issue with premature release of conntrack reference, potentially leading to use of an invalid object. The fix holds the reference until flow release after RCU grace period and adds rcu_barrier() on module exit.

In the Linux kernel, the DRM subsystem has a leak of drm_pending_vblank_event in the error path for out_fence_ptr. The fix releases the event and sets crtc_state->event to NULL to avoid memory leak.

In the Linux kernel, the SMB client has a buffer overflow vulnerability when processing absolute native symlink targets. The fix validates the NT drive prefix before accessing fixed offsets to prevent memory overwrites.

A vulnerability in the Linux kernel was found in the validation of the NDTPA_INTERVAL_PROBE_TIME_MS parameter for neighbor tables (e.g., ARP). Missing validation allows setting 0 or very large values (e.g., 4294967296), leading to incorrect timer behavior and potential security bypass.

In the Linux kernel, the ALSA bcd2000 driver has a race between rawmidi operations and USB disconnect, potentially leading to use-after-free (UAF). The fix introduces a spinlock covering rawmidi operations and handling in the callback to ensure safety.