CVE Vulnerability Catalog

In the Linux kernel's ALSA core subsystem, there is a potential use-after-free (UAF) vulnerability after asynchronous sound card release. When the card is released asynchronously via snd_card_free_when_closed(), in-flight tasks may still access the card->dev device after disconnection, leading to UAF. The fix takes a refcount of card->dev at initialization and releases it at the destructor.

In the Linux kernel's ALSA usb-audio driver, a vulnerability was found that causes an out-of-bounds write when handling implicit feedback. The packet count for isochronous URBs is overwritten with a value from the sync source, leading to writes past the iso_frame_desc array. The fix clamps the packet count to the URB capacity.

In the Linux kernel's ALSA virtio driver, the virtsnd_remove() and virtsnd_freeze() functions delete the virtqueues before resetting the device. This allows the device to access freed vring memory. The fix resets the device before deleting the virtqueues to prevent access to freed memory.

In the Linux kernel's ASoC codec rt712-sdca-dmic, the stream_config structure is not initialized before being passed to sdw_stream_add_slave(). The type field may contain garbage, which is later copied to stream->type. The fix zero-initializes stream_config so type defaults to SDW_STREAM_PCM, and uses the snd_sdw_params_to_config() helper.

In the Linux kernel's AHCI driver (libahci), for controllers with the AHCI_HFLAG_32BIT_ONLY flag, the PxCLBU and PxFBU registers are not cleared, causing issues with JMicron JMB585 controllers. The fix explicitly clears these registers to ensure proper operation with 32-bit DMA.

In the Linux kernel's CIFS filesystem, the cifs_chan_skip_or_disable() function uses a server pointer after dropping the channel reference, leading to use-after-free. The fix signals the channel and primary server and captures the primary server pointer before dropping the channel reference.

A use-after-free vulnerability was found in the Linux kernel's POSIX timer cleanup mechanism during exec() by a non-leader thread. The bug occurs when operations after de_thread() (such as exec_mmap()) fail, leading to freeing a timer that is still queued, followed by a subsequent removal from the rbtree.

A vulnerability in the Linux kernel's fs/dax subsystem can cause a kernel panic during VM boot with DAX-enabled storage. The issue is the lack of a check for empty or zero entries in the xarray before calling dax_to_folio() in dax_associate_entry(), dax_disassociate_entry(), and dax_busy_page(). A previous fix (commit 98c183a4fccf) added guards but they still come after dax_to_folio(), leaving the problem unresolved.

In the Linux kernel, a race condition in POSIX CPU timers can lead to use-after-free (UAF). The issue stems from losing the distinction between 'timer on expiry list' and 'delivery canceled' after changing the 'firing' flag to boolean. The fix checks whether the timer is on the expiry list instead of relying on the flag.

In the Linux kernel, in RDS IB code, rds_ib_cm_connect_complete() calls rds_conn_destroy() on protocol version mismatch, leading to a deadlock in workqueue. The fix changes it to rds_conn_drop(), which schedules connection shutdown asynchronously.

A use-after-free vulnerability exists in the Linux kernel signal handling mechanism, caused by a race condition during exec() by a non-leader thread. A SIGEV_THREAD_ID timer created against the leader's tid may point to the thread calling execve() after tid exchange, leading to incorrect signal queueing and use of freed memory. The issue is fixed by flushing task pending signals earlier in exit_signals() and preventing signal queueing for tasks with PF_EXITING set.

In the Linux kernel, in TCP code, old ACKs (before SND.UNA) are excluded from the fast path and directed to the slow path, where they are properly validated according to RFC5961. This prevents acceptance of old ACKs and modification of connection state before validation.

In the Linux kernel, in swiotlb code, swiotlb_bounce() uses an incorrect address for highmem page lookup, which can lead to read/write from the wrong memory page. The fix uses the adjusted orig_addr for both operations.

In the Linux kernel, in RDMA/ucma code, there is a race between multicast join and leave operations that can lead to use-after-free (UAF). The fix holds the mutex throughout from join to copy_to_user to prevent leave from missing the join.

In the Linux kernel, in RDMA/core code, iwpm_get_nlmsg_request() initializes the refcount after adding to the global list, which can lead to a refcount bug. The fix initializes kref before list_add_tail() and initializes all fields before adding to the list.

In the Linux kernel, in openvswitch code, ovs_ct_get_conn_labels() may add a labels extension to a confirmed conntrack entry, which can lead to reallocation and freeing of the extension block during concurrent access. The fix adds the extension only for unconfirmed conntracks.

In the Linux kernel, in nfsd code, handling of NFSEXP_PNFS in the netlink codepath is incorrect because the move of the check to callers did not account for the new call in nfsd4_setup_layout_type(). The fix corrects this check.

In the Linux kernel on arm64, during hibernation, swsusp_arch_suspend_exit() fails to pass arguments to the HVC_SET_VECTORS call, leaving EL2 vectors incorrectly set after resume. This leads to a use-after-free of the vectors page, potentially causing a system hang after resuming from hibernation.

In the Linux kernel for arm64, percpu operations on 8- and 16-bit types using LSE instructions do not include the size suffix, causing incorrect 32-bit memory accesses instead of the intended 8 or 16 bits. The fix appends the 'sfx' suffix to the LSE instruction.

In the Linux kernel Bluetooth module (hci_codec), the Read Local Supported Codecs parsers do not properly validate the vendor codec count length, potentially leading to out-of-bounds reads. The fix uses skb_pull_data() to validate and consume codec headers before using their count.