CVE Vulnerability Catalog

In the Linux kernel, the hwmon (pwm-fan) driver has a use-after-free (UAF) issue during driver detach. The sampling timer can be rearmed and access freed data before it is stopped. The fix separates timer retirement from power cleanup and uses timer_shutdown_sync() to ensure safe shutdown.

In the Linux kernel, the hwmon (w83791d) driver does not remove optional sysfs files for fans/PWM 4-5 during normal driver removal. Leftover files can lead to access to freed driver data. The fix removes the sysfs group during normal teardown as well.

In the Linux kernel, the wifi brcmsmac driver has a use-after-free (UAF) issue in brcms_free_timer(). Timer cancellation does not wait for the callback to finish, which can lead to access to freed memory. The fix adds an explicit cancel_delayed_work_sync() to ensure the callback completes before freeing the timer structure.

In the Linux kernel, the wifi iwlegacy driver has a double-free issue of broadcast stations on the error path. The function il_dealloc_bcast_stations() does not clear all fields, leading to repeated deallocation. The fix clears the entire 'used' field.

In the Linux kernel, the wifi libertas_tf driver has a use-after-free (UAF) issue in lbtf_free_adapter(). The order of freeing command buffers and stopping the timer is incorrect, which can lead to access to freed memory. The fix swaps the order to stop the timer before freeing buffers.

In the Linux kernel, the wifi libipw driver has an out-of-bounds read issue during TKIP frame verification. Short frames can cause length wrap and read past the buffer. The fix checks for the presence of a full MIC before verification and uses the MICHAEL_MIC_LEN constant.

In the Linux kernel, the wifi wcn36xx driver has a potential use-after-free (UAF) issue during TX ack timer teardown. The function timer_delete() does not wait for the callback to finish, which can lead to access to freed data. The fix uses timer_shutdown_sync() to ensure safe shutdown.

In the Linux kernel, the wifi wlcore driver has a runtime PM reference leak during regulatory domain configuration failure. The function does not release the reference after failure, which can lead to power management issues. The fix releases the reference after handling the command result.

In the Linux kernel, the wifi wilc1000 driver has an out-of-bounds read issue in P2P public action frames. Short frames can lead to reading past the buffer and potentially crashing the system. The fix rejects frames shorter than the P2P public action header before processing.

In the wilc1000 driver in the Linux kernel, there is an out-of-bounds write vulnerability in wilc_wlan_handle_isr_ext(). The RX transfer size taken from the device interrupt status register is not compared against the rx_buffer size, allowing a malicious SDIO device to write data beyond the buffer. The fix drops transfers exceeding the RX buffer size.

In the Linux kernel, the wifi: p54 driver's p54_convert_rev0() and p54_convert_rev1() functions read calibration curve data from the device-supplied EEPROM entry using channel and points-per-channel counts taken verbatim from that same entry. An entry that declares more data than it carries drives an out-of-bounds read past the EEPROM buffer.

In the p54 driver in the Linux kernel, the PDR_INTERFACE_LIST loop only checks that the record start is within the entry before reading an entire struct exp_if. A truncated trailing record causes reads to cross the entry boundary into the heap beyond the EEPROM buffer. The fix advances only while a full record still fits in the entry.

In the mwifiex driver in the Linux kernel, the function mwifiex_search_oui_in_ie() reads a pairwise-cipher (PTK) count from a beacon/probe-response RSN or WPA information element and then walks that many 4-byte OUIs, comparing each with memcmp(). The count comes directly from the attacker-supplied IE and is never checked against the element's length, allowing an out-of-bounds read. The fix bounds the walk to the element length.

In the mwifiex driver in the Linux kernel, the function mwifiex_ret_802_11_scan() subtracts the fixed response fields and the firmware-provided BSS length from resp->size without first proving that either extent fits. A short response or oversized BSS length can underflow tlv_buf_size and make the TLV parser walk beyond the command response. The fix validates that the fixed fields and BSS data fit before deriving the TLV extent.

In the mwifiex driver in the Linux kernel, the function mwifiex_cfg80211_authenticate() derives the authentication frame length from req->ie_len and req->auth_data_len, both of type size_t, but stores it in a u16. The sum can exceed U16_MAX, leading to length truncation and a heap buffer overflow when copying authentication data. The fix computes the length in size_t, rejects values not representable in u16, and only then assigns to pkt_len.

In the Linux kernel's mac80211 subsystem, ieee80211_mesh_preq_size_ok() reads PREQ fields before checking if the element contains even the fixed header. An empty PREQ element causes a one-byte read beyond its declared payload. The fix moves the helper call after both size checks.

In the Linux kernel's mac80211 subsystem, a monitor interface can be set active without a TXQ, leading to a NULL pointer dereference in the ath9k driver. An attacker with CAP_NET_ADMIN can trigger a kernel crash. The fix refuses the flag when there is no queue.

In the Linux kernel's drm/gud driver, gud_plane_atomic_check() has an out-of-bounds write due to incorrect indexing in the property loop. A USB device can trigger the OOB by advertising the maximum number of properties. The fix removes the redundant '+ i'.

In the Linux kernel's drm/msm drivers, msm_ringbuffer and msm_gem_vm objects embed a GPU scheduler that is freed with plain kfree(), while userspace can still access the scheduler name via fences. This leads to a use-after-free reachable unprivileged through SYNC_IOC_FILE_INFO. The fix uses kfree_rcu().

In the Linux kernel's drm/amdgpu driver, amdgpu_pci_remove() calls drm_dev_unplug() before fini_sw(), so iounmap() is skipped, leaking the BAR mapping on each device removal. The fix unmaps unconditionally.