CVE Vulnerability Catalog

In the Linux kernel, the skfp FDDI network driver has a NULL pointer dereference vulnerability when setting the MAC address on a down interface. skfp_ctl_set_mac_address() calls ResetAdapter() without checking netif_running(), leading to access to uninitialized transmit queues and a kernel oops.

In the Linux kernel network bridge, br_mst_set_state() calls switchdev_port_attr_set() while holding rcu_read_lock(), which may sleep in RCU context and cause potential issues.

A race condition exists in the Linux kernel's tcp_v6_do_rcv() function between checking the TCP_LISTEN socket state and calling skb_clone_and_charge_r(). A concurrent close() can change the state from TCP_LISTEN to TCP_CLOSE, causing the function to be called without locking and triggering a warning in inet_sock_destruct(). The issue affects IPv6 TCP listening sockets being closed concurrently.

A vulnerability in the Linux kernel allows net.ipv4.tcp_rmem to be set below 4096, causing a divide-by-zero error in tcp_rcvbuf_grow() and tcp_rcv_space_adjust(). This can lead to a kernel crash. The issue is fixed by enforcing a minimum value of 4096 for tcp_rmem.

In the Linux kernel DMA driver mmp_pdma, mmp_pdma_prep_slave_sg() reads entry length from the list head instead of the current entry, causing errors with varying lengths.

In the Linux kernel Bluetooth (hci_core), hci_send_acl(), hci_send_sco(), and hci_send_iso() queue tx_work unconditionally, which during device shutdown can cause warnings and work loss.

In the Linux kernel Bluetooth driver btintel_pcie, btintel_pcie_send_sync() does not validate packet length before copying to DMA buffer, which can lead to buffer overflow.

In the Linux kernel, a vulnerability in the Bluetooth coredump subsystem allows dump work to remain active after device unregister, leading to a use-after-free condition.

In the Linux kernel, the hci_qca Bluetooth driver has a vulnerability where it writes to a closed serial port. If hci_dev_open_sync() fails after a successful qca_setup(), the port is closed but power->vregs_on remains true, leading to a write to the closed port during driver removal. This results in a NULL pointer dereference, potentially causing a system crash.

In the Linux kernel, a reference leak in the Bluetooth ISO subsystem occurs in iso_conn_ready() when child socket allocation fails, causing memory leak.

In the Linux kernel, the Bluetooth drivers btmtksdio and btmtkuart lack validation of WMT event length before accessing structure fields, leading to out-of-bounds read.

In the Linux kernel, the Bluetooth btintel_pcie driver has an off-by-one bounds check in RX submission, allowing access to an element past the end of the FRBD array.

In the Linux kernel, a potential socket lock inversion in the Bluetooth RFCOMM listener cleanup can lead to a deadlock.

A vulnerability in the Linux kernel's af_unix mechanism was found, related to incorrect assignment of SCC indices in Tarjan's algorithm. In certain cases, vertices within one SCC may have different scc_index values, leading to incorrect garbage collection and potential memory leaks.

In the Linux kernel, the stmmac network driver has a TSO header length truncation issue because it stores the length in a u8, causing wraparound for headers longer than 255 bytes.

In the Linux kernel, the pppoatm driver lacks ensuring a writable skb header and linear data, which can lead to out-of-bounds reads or unbalanced buffer operations.

In the Linux kernel, a vulnerability was found in the drop_monitor module where per-CPU timers are stopped using timer_delete_sync() during teardown, which does not prevent concurrent workers from re-arming the timer. Under memory pressure, a worker can re-arm the timer after timer_delete_sync() returns, and after module unload, the timer fires in freed memory, causing a kernel panic or use-after-free.

In the Linux kernel, a bug in the bridge VLAN deletion handling was found when switchdev blocks the operation. Allowing switchdev to prevent VLAN deletion leads to inconsistent state, memory leaks, and NULL pointer dereference. The fix logs the error and continues with software VLAN deletion, consistent with 8021q behavior.

In the Linux kernel, a vulnerability was found in the netlink subsystem where netlink_realloc_groups() can free the old group bitmap before lockless readers finish using it. Two read paths (sk_diag_dump_groups() and /proc/net/netlink) can access freed memory, leading to use-after-free or out-of-bounds read.

In the Linux kernel, KVM for PowerPC (Book3S HV) has a use-after-free vulnerability in kvmhv_emulate_tlbie_all_lpid(). The function iterates nested-guest IDs without holding a reference, allowing a race with a concurrent vCPU that can free the memory. The fix increments the reference count before dropping the lock and releases it after the work.