CVE Vulnerability Catalog

In the Linux kernel, ALSA USB-audio lacks clamping of frame size in implicit-feedback mode. Received sync packet sizes are not limited to the maximum frame size, potentially causing packet transfers beyond hardware limits.

In the Linux kernel, the fou_create() function has a use-after-free vulnerability. The fou structure is published via sk_user_data before adding the port to the list, and on error it is freed while still reachable, allowing concurrent reads of freed memory.

In netfilter ipset, there is an issue with updating comments from kernel-side operations. During table resize, comment pointers are copied, and a packet-side update can free a shared comment, leading to use of a dangling pointer.

In TIPC, there is a use-after-free vulnerability in tipc_poll() during queue dumps via tracepoints. The tracepoint call without holding a lock allows access to freed packets.

In the Linux kernel's mac80211 subsystem, a use-after-free vulnerability was found in ieee80211_stop_tx_ba_cb(). After stopping a BA session, the tid_tx structure is freed via kfree_rcu(), and then the tid_tx->ndp field is read without proper RCU protection, potentially accessing freed memory. The issue occurs during local session teardown, e.g., on idle timeout, PTK rekey, suspend, or HW reconfig.

In the Linux kernel, the mwifiex driver has a vulnerability where the A-MSDU parent frame length is used instead of the subframe length when parsing TDLS frames. This leads to a use-after-free or out-of-bounds read, potentially exploitable by a remote attacker.

In the Linux kernel's binfmt_misc module, a vulnerability allows an out-of-bounds read when the user-chosen field delimiter is also a flag character (P, O, C, or F). The flag parser fails to stop at the buffer padding and reads past the allocated memory. This is reachable by unprivileged users in a user namespace.

A vulnerability was found in the Linux kernel's huge page splitting mechanism in mm/huge_memory. After splitting a folio, the code still accessed the mapping structure (i_mmap_rwsem) after the split folios were unlocked and freed, leading to a use-after-free. This occurs especially during memory failure handling for poisoned tails of shmem folios.

A use-after-free (UAF) vulnerability was found in the Linux kernel during system suspend (S3) or hibernation (S4). The page reporting work (page_reporting_process) was scheduled on the global system_wq, which lacks the WQ_FREEZABLE flag, leaving it active during suspend and causing access to deleted virtqueues, leading to a crash. The fix switches to system_freezable_wq, which is frozen before device drivers destroy their virtqueues.

A use-after-free vulnerability has been found in the Linux kernel's pktgen module. The issue involves a race between network device renaming and removal of the /proc entry, which can lead to accessing freed memory by the kpktgend thread.

In the Linux kernel, the tracing module's trace_module_add_events() function ignores the return value of __register_event() and unconditionally calls __add_event_to_tracers(). If event registration fails, it can lead to a use-after-free.

In the Linux kernel, the scsi_debug module's resp_report_zones() function has an underflow vulnerability in alloc_len calculations, which on 32-bit systems can lead to an out-of-bounds write and kernel panic.

In the Linux kernel, the SCTP module's sctp_assoc_add_peer() function increments the 16-bit transport_count, which can wrap to zero after adding 65,536 unique peers. This can lead to an out-of-bounds write in SCTP diagnostics (sock_diag).

In the Linux kernel, the s390/qeth module lacks a CAP_NET_ADMIN check for private ioctls (SIOCDEVPRIVATE), allowing unprivileged users to invoke these commands.

A use-after-free vulnerability was found in the Linux kernel's Open vSwitch module. The issue occurs when attaching a newly created meter: attach_meter() can make the meter visible to other CPUs but still fail afterwards. On failure, ovs_meter_cmd_set() frees the meter without waiting for RCU readers, leading to use-after-free.

In the Linux kernel, in the i2c: imx driver, a problem was found where the hrtimer was not canceled before clearing the slave pointer. In i2c_imx_unreg_slave(), the slave pointer is set to NULL after disabling interrupts, but a pending interrupt might have already started the hrtimer. If the hrtimer fires after slave is set to NULL, it can lead to use-after-free or NULL pointer dereference. The fix cancels the hrtimer and waits for it to complete before clearing the slave pointer.

In the Linux kernel, the peak_usb driver for CAN bus fixed a double free of the transfer buffer in peak_usb_start() on URB submit error. The buffer is freed explicitly by kfree(buf) and then again by usb_free_urb() due to the URB_FREE_BUFFER flag, leading to a double free.

In the Linux kernel, the drm/vc4 graphics driver fixed a bug where BPOS was set to the whole binner BO size instead of the overflow slot size. This allows the PTB to write tile lists outside the intended area, leading to memory corruption by GPU DMA, GPU hangs, and system crashes.

In the Linux kernel, the drm/vc4 graphics driver added zeroing of the Tile State Data Array (TSDA) before each BIN job. Previously, binner slots were reused without clearing, which could cause the PTB to act on stale data and lead to GPU hangs.

In the Linux kernel, the drm/panthor graphics driver added rejection of firmware sections with oversized data. Previously, the data size to copy was not validated against the allocated section size, which could lead to heap buffer overflow and massive out-of-bounds zeroing of kernel memory.