CVE Vulnerability Catalog

In the Linux kernel, in the Bluetooth subsystem (hci_conn), a theoretical use-after-free (UAF) vulnerability was found in abort_conn_sync() if the connection (conn) is freed while the hci_sync task is running. There is no reference held to the connection.

In the Linux kernel, in the Bluetooth subsystem (hci_sync), a theoretical use-after-free (UAF) vulnerability was found in hci_connect_big_sync() if the connection (conn) is freed while the hci_sync task is running. There is no reference held to the connection. Additionally, if hcon is NULL, the function returns 0 and does nothing to match previous behavior.

In the Linux kernel, in the Bluetooth subsystem (hci_sync), a theoretical use-after-free (UAF) vulnerability was found in hci_connect_pa_sync() if the connection (conn) is freed while the hci_sync task is running. There is no reference held to the connection.

In the Linux kernel, in the Bluetooth subsystem (hci_sync), a theoretical use-after-free (UAF) vulnerability was found in hci_past_sync() if the connection (conn) is freed while the hci_sync task is running. This can lead to passing freed pointers to hci_conn_valid(), which kmalloc may have reused.

In the Linux kernel, in the octeontx2-af subsystem, a vulnerability was found that allows virtual functions (VFs) to overwrite special CGX PKIND state. When HiGig2 or EDSA parsing is enabled, a VF NIX LF allocation must not reset the LMAC RX PKIND or default TX parse config over the PF setup. Missing permission-checking functions.

A deadlock was found in the qede driver of the Linux kernel during recovery after a TX timeout on NICs with VXLAN/GENEVE tunnel ports configured. The recovery process tries to re-lock the same mutex (qede_lock), causing the entire rtnetlink control plane to wedge and many system services to hang.

In the Linux kernel's SMB server (ksmbd), a use-after-free vulnerability was found in __close_file_table_ids(). A ksmbd_file can remain alive after logical close while another session holds a temporary reference. When the foreign holder performs the final put, the object is freed without being removed from its owner's idr, leading to a stale pointer dereference during file-table teardown.

In the Linux kernel's iommu/iommufd subsystem, a use-after-free vulnerability was found in IOPF group ownership. IOPF groups are linked into the generic pending list before invoking the domain fault handler, and after acceptance they are also queued in the IOMMUFD deliver list without removal from the generic list. When detach or HWPT replacement drops the device's IOPF reference count to zero, groups can be freed, and later access leads to UAF.

In the Linux kernel's pinctrl subsystem for devicetree, a vulnerability was found causing freeing of uninitialized dev_name on error path. dt_remember_or_free_map() duplicates dev_name for each map entry. If kstrdup_const() fails, dt_free_map() frees dev_name in all entries, including uninitialized ones, leading to a double-free.

A vulnerability in the Linux kernel's hugetlb mechanism causes list corruption in allocate_file_region_entries(). The issue stems from using list_splice() instead of list_splice_init(), which under concurrent access to a shared mapping can lead to memory corruption or a system panic.

A vulnerability in the Linux kernel's KVM/SVM was found where x2APIC MSR intercepts are not updated for L1 when AVIC is inhibited while L2 is active. This allows L1 to read host APIC state, send arbitrary interrupts, and change task priority, potentially leading to a host DoS.

In the Linux kernel, in the KVM subsystem for s390 architecture in PCI handling, a vulnerability was found where a request to enable interrupt forwarding is not rejected if it is already enabled for the zPCI device. The MPCIFC instruction does not allow re-registering interrupts without first unregistering. The fix adds a proper check, preventing overwriting and resource leaks when the ioctl is called multiple times for the same device.

A use-after-free vulnerability was found in the Linux kernel's dibs layer, affecting attach/detach/unregister operations for dmb_node in loopback mode. The issue stems from a race between hash table lookup and refcount operations, potentially leading to use of freed memory. The fix makes refcount transitions and hash table removal atomic under the write lock.

In the Linux kernel, in the audit module, a potential use-after-free vulnerability was found in audit_del_rule(). This function destroys e->rule.exe via audit_remove_mark_rule() before unlinking the rule from RCU-visible filter lists and waiting for a grace period. Concurrent readers in audit_filter() and audit_filter_rules() still dereference e->rule.exe, while the fsnotify mark can be freed on an independent lifetime path. The fix unlinks the rule from RCU-visible lists and invokes synchronize_rcu() before calling audit_remove_mark_rule() and other rule removal helpers.

In the Linux kernel, in the Bluetooth subsystem (mgmt), a use-after-free vulnerability was found in pair command cancellation. The pairing completion and authentication failure callbacks look up the pending MGMT_OP_PAIR_DEVICE command by walking hdev->mgmt_pending, but without holding mgmt_pending_lock for the later dereference and removal. A concurrent MGMT_OP_CANCEL_PAIR_DEVICE request can remove and free the same pending command before the callback uses it. The fix transfers ownership of the pending command by removing it from hdev->mgmt_pending while holding mgmt_pending_lock, and the callbacks and cancel path then complete and free it directly.

A use-after-free vulnerability was found in the Linux kernel's Bluetooth subsystem (hci_sync). The hci_find_adv_instance() function returns a pointer to advertising data that is only valid while hdev->lock is held, but the HCI command-sync paths use it without that lock, which can lead to use of freed memory during an advertising termination event.

In the Linux kernel, in the Bluetooth HIDP subsystem, a vulnerability was found where data is read before checking if the frame contains a transaction header. The functions hidp_recv_ctrl_frame() and hidp_recv_intr_frame() read skb->data[0] before checking that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty basic-mode SDU, leading to use of an uninitialized byte. The fix pulls the transaction header with skb_pull_data() and discards frames that do not contain it.

In the Linux kernel, in the Bluetooth HIDP subsystem, a vulnerability was found where numbered report payloads are not validated. When hidp_get_raw_report() waits for a numbered report, hidp_process_data() compares the expected report number with skb->data[0]. A connected HIDP peer can reply with only a DATA transaction header, leaving the skb empty after the header is removed. The fix requires a payload byte before comparing a numbered report ID; unnumbered reports continue to accept an empty payload.

A Use-After-Free (UAF) vulnerability has been found in the Linux kernel's afs_make_call() function in the AFS filesystem. The issue arises from a race condition between sending asynchronous calls and their destruction, potentially leading to access to freed memory. The bug was reported by KASAN during tests with random CPU offlining.

A vulnerability was found in the Linux kernel's ALSA timer subsystem. The SNDRV_TIMER_IFLG_DEAD flag is never cleared after a close operation completes, leading to a use-after-free when the same timer instance is reopened. An attacker with access to /dev/snd/timer and /dev/snd/seq can trigger this to escalate privileges or cause a system crash.