CVE Vulnerability Catalog

In the Linux kernel, the forcedeth driver has a use-after-free vulnerability in nv_remove(), where per-CPU txrx_stats are freed before unregistering the network device, potentially leading to access to freed memory. The fix moves the free after unregister_netdev().

In the Linux kernel, the cls_u32 classifier lacks validation of the offshift value, allowing shift-out-of-bounds during packet classification. An unprivileged user can trigger undefined behavior via user/network namespaces.

In the Linux kernel, Bluetooth ISO has a use-after-free vulnerability when detaching a connection from hcon. Failure to clear iso_data leads to later use after memory free.

In the Linux kernel, Bluetooth L2CAP has a use-after-free vulnerability in l2cap_le_connect_rsp. The channel is obtained without holding a reference, allowing a concurrent disconnect to free it, leading to use-after-free.

In the Linux kernel, Bluetooth ISO function iso_sock_getname does not hold the socket lock when accessing the conn field, leading to a race condition and potential use-after-free.

In the Linux kernel, Bluetooth ISO function iso_connect_ind does not hold the socket lock when accessing the conn field, leading to a race condition and potential use-after-free. Additionally, conn may be NULL if the socket has changed state.

In the Linux kernel, Bluetooth ISO function iso_conn_ready does not properly hold a reference to the socket when accessing conn->sk, leading to a use-after-free if the socket is concurrently closed.

In the Linux kernel, in the Bluetooth ISO subsystem, a potential deadlock was found in iso_sock_timeout(), which takes lock_sock and then synchronously disables the timer, potentially causing a deadlock. Additionally, iso_sock_timeout() may run concurrently with iso_conn_del(), leading to use-after-free (UAF) — one thread frees the hcon structure while another tries to access it.

In the Linux kernel, in the Bluetooth ISO subsystem, a reference counting bug was found in the iso_conn structure. A race between iso_conn_del() and iso_chan_del() can lead to a double-put of iso_conn, resulting in use-after-free (UAF). The issue stems from an extra put in iso_conn_del() for the case when iso_chan_add() fails.

In the Linux kernel, in the Bluetooth ISO subsystem, a race condition was found between kfree and kref_get_unless_zero on the hci_conn::iso_data field, which is accessed and modified without synchronization (lock or RCU). This can lead to use-after-free (UAF) and races between iso_conn_add() and iso_conn_free().

In the Linux kernel, in the Bluetooth subsystem (hci_conn), a theoretical use-after-free (UAF) vulnerability was found in abort_conn_sync() if the connection (conn) is freed while the hci_sync task is running. There is no reference held to the connection.

In the Linux kernel, in the Bluetooth subsystem (hci_sync), a theoretical use-after-free (UAF) vulnerability was found in hci_connect_big_sync() if the connection (conn) is freed while the hci_sync task is running. There is no reference held to the connection. Additionally, if hcon is NULL, the function returns 0 and does nothing to match previous behavior.

In the Linux kernel, in the Bluetooth subsystem (hci_sync), a theoretical use-after-free (UAF) vulnerability was found in hci_connect_pa_sync() if the connection (conn) is freed while the hci_sync task is running. There is no reference held to the connection.

In the Linux kernel, in the Bluetooth subsystem (hci_sync), a theoretical use-after-free (UAF) vulnerability was found in hci_past_sync() if the connection (conn) is freed while the hci_sync task is running. This can lead to passing freed pointers to hci_conn_valid(), which kmalloc may have reused.

In the Linux kernel, in the octeontx2-af subsystem, a vulnerability was found that allows virtual functions (VFs) to overwrite special CGX PKIND state. When HiGig2 or EDSA parsing is enabled, a VF NIX LF allocation must not reset the LMAC RX PKIND or default TX parse config over the PF setup. Missing permission-checking functions.

A deadlock was found in the qede driver of the Linux kernel during recovery after a TX timeout on NICs with VXLAN/GENEVE tunnel ports configured. The recovery process tries to re-lock the same mutex (qede_lock), causing the entire rtnetlink control plane to wedge and many system services to hang.

In the Linux kernel's SMB server (ksmbd), a use-after-free vulnerability was found in __close_file_table_ids(). A ksmbd_file can remain alive after logical close while another session holds a temporary reference. When the foreign holder performs the final put, the object is freed without being removed from its owner's idr, leading to a stale pointer dereference during file-table teardown.

In the Linux kernel's iommu/iommufd subsystem, a use-after-free vulnerability was found in IOPF group ownership. IOPF groups are linked into the generic pending list before invoking the domain fault handler, and after acceptance they are also queued in the IOMMUFD deliver list without removal from the generic list. When detach or HWPT replacement drops the device's IOPF reference count to zero, groups can be freed, and later access leads to UAF.

In the Linux kernel's pinctrl subsystem for devicetree, a vulnerability was found causing freeing of uninitialized dev_name on error path. dt_remember_or_free_map() duplicates dev_name for each map entry. If kstrdup_const() fails, dt_free_map() frees dev_name in all entries, including uninitialized ones, leading to a double-free.

A vulnerability in the Linux kernel's hugetlb mechanism causes list corruption in allocate_file_region_entries(). The issue stems from using list_splice() instead of list_splice_init(), which under concurrent access to a shared mapping can lead to memory corruption or a system panic.