CVE Vulnerability Catalog

A vulnerability has been identified in the Linux kernel affecting the mtk_jpeg_release() function. The issue arises from freeing the context (ctx) without first canceling any pending or running work, leading to race conditions and potential access to freed memory.

A vulnerability in the Linux kernel related to error handling in the rxgk_extract_token() function has been fixed. If rxgk_decrypt_skb() returns -ENOMEM, the function should return that error instead of continuing, which could lead to an abort.

A vulnerability has been identified in the Linux kernel related to a u32 overflow in the relocation bounds check in drm/nouveau. The issue occurs during offset validation, potentially leading to system instability.

A vulnerability has been identified in the Linux kernel within the caiaq driver, concerning improper error handling during the probe procedure in the setup_card() function. Errors are not handled correctly, potentially leading to a use-after-free (UAF) situation in further calls.

A vulnerability in the Linux kernel has been fixed in the pt5161l_read_block_data() function, which could lead to buffer overrun and incorrect return values on length mismatch.

A vulnerability has been identified in the Linux kernel within the z_erofs_lz4_handle_overlap() function, which may lead to improper memory access during LZ4 decompression. Specifically crafted images can cause out-of-bounds access, resulting in data access errors.

In the Linux kernel, a use-after-free (UAF) vulnerability was found in the rxrpc module after a failed skb_unshare() call. If skb_unshare() fails to duplicate a packet due to an allocation error, the skb pointer in the parent function (rxrpc_io_thread()) is set to NULL, which may cause a system crash when trace_rxrpc_rx_done() is called.

A vulnerability related to use-after-free in the SPI subsystem has been fixed in the Linux kernel. The issue occurred during the deregistration of the controller, which could lead to improper freeing of driver data.

A vulnerability related to the use of the user_struct in the io_free_rbuf_ring() function has been fixed in the Linux kernel. The issue was that this structure was being freed before the ring was destroyed, which could lead to improper memory management.

A vulnerability has been identified in the Linux kernel within the command_file_write function, leading to out-of-bounds reads due to missing size checks. An attacker can exploit this flaw to leak kernel memory.

A vulnerability has been identified in the Linux kernel related to improper management of partition descriptors in UDF images. Repeatedly appending the same descriptors can lead to out-of-bounds writes, potentially causing security issues.

A vulnerability has been identified in the Linux kernel within the testdrv_probe() function, leading to a use-after-free error. The issue arises from an incorrect release of the 'dn' pointer, which may result in the use of a freed object.

A use-after-free vulnerability was discovered in the Linux kernel's GFS2 filesystem inline data write path. The metadata buffer head (dibh) is released prematurely in gfs2_iomap_begin() while iomap->inline_data still points to its data, leading to a write to freed memory. This can compromise system integrity.

A vulnerability has been identified in the Linux kernel related to job scheduling in hardware context during resource release. This can lead to use-after-free errors and system crashes.

A use-after-free (UAF) vulnerability was identified in the Linux kernel's rlb_arp_recv function, which may lead to a null pointer dereference during rapid bond up/down cycles.

A vulnerability in the Linux kernel has been fixed that could lead to system crashes due to incorrect usage of the cleanup function kfree. The issue stemmed from incorrectly annotating a local pointer variable, resulting in the wrong address being passed to kfree.

A vulnerability has been identified in the Linux kernel that allows direct dereferencing of a user pointer in the vidi_connection_ioctl() function. This enables access to kernel memory from user space.

A vulnerability was identified in the Linux kernel that led to an infinite loop in the rcu_read_unlock() function due to IRQ work. It has been fixed by introducing a flag before calling raise_softirq_irqoff().

A vulnerability has been identified in the Linux kernel within the vidi_connection_ioctl() function, which may lead to errors such as null pointer dereferences and out-of-bounds errors. The issue arises from incorrectly obtaining the vidi context pointer from the wrong master device.

A vulnerability has been identified in the Linux kernel related to the llbitmap_suspend_timeout() function. When a timeout occurs, this function fails to resurrect the percpu_ref, leading to its permanent blocking.