CVE Vulnerability Catalog

A vulnerability in the Linux kernel's KVM/SVM was found where x2APIC MSR intercepts are not updated for L1 when AVIC is inhibited while L2 is active. This allows L1 to read host APIC state, send arbitrary interrupts, and change task priority, potentially leading to a host DoS.

In the Linux kernel, in the KVM subsystem for s390 architecture in PCI handling, a vulnerability was found where a request to enable interrupt forwarding is not rejected if it is already enabled for the zPCI device. The MPCIFC instruction does not allow re-registering interrupts without first unregistering. The fix adds a proper check, preventing overwriting and resource leaks when the ioctl is called multiple times for the same device.

A use-after-free vulnerability was found in the Linux kernel's dibs layer, affecting attach/detach/unregister operations for dmb_node in loopback mode. The issue stems from a race between hash table lookup and refcount operations, potentially leading to use of freed memory. The fix makes refcount transitions and hash table removal atomic under the write lock.

In the Linux kernel, in the audit module, a potential use-after-free vulnerability was found in audit_del_rule(). This function destroys e->rule.exe via audit_remove_mark_rule() before unlinking the rule from RCU-visible filter lists and waiting for a grace period. Concurrent readers in audit_filter() and audit_filter_rules() still dereference e->rule.exe, while the fsnotify mark can be freed on an independent lifetime path. The fix unlinks the rule from RCU-visible lists and invokes synchronize_rcu() before calling audit_remove_mark_rule() and other rule removal helpers.

In the Linux kernel, in the Bluetooth subsystem (mgmt), a use-after-free vulnerability was found in pair command cancellation. The pairing completion and authentication failure callbacks look up the pending MGMT_OP_PAIR_DEVICE command by walking hdev->mgmt_pending, but without holding mgmt_pending_lock for the later dereference and removal. A concurrent MGMT_OP_CANCEL_PAIR_DEVICE request can remove and free the same pending command before the callback uses it. The fix transfers ownership of the pending command by removing it from hdev->mgmt_pending while holding mgmt_pending_lock, and the callbacks and cancel path then complete and free it directly.

A use-after-free vulnerability was found in the Linux kernel's Bluetooth subsystem (hci_sync). The hci_find_adv_instance() function returns a pointer to advertising data that is only valid while hdev->lock is held, but the HCI command-sync paths use it without that lock, which can lead to use of freed memory during an advertising termination event.

In the Linux kernel, in the Bluetooth HIDP subsystem, a vulnerability was found where data is read before checking if the frame contains a transaction header. The functions hidp_recv_ctrl_frame() and hidp_recv_intr_frame() read skb->data[0] before checking that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty basic-mode SDU, leading to use of an uninitialized byte. The fix pulls the transaction header with skb_pull_data() and discards frames that do not contain it.

In the Linux kernel, in the Bluetooth HIDP subsystem, a vulnerability was found where numbered report payloads are not validated. When hidp_get_raw_report() waits for a numbered report, hidp_process_data() compares the expected report number with skb->data[0]. A connected HIDP peer can reply with only a DATA transaction header, leaving the skb empty after the header is removed. The fix requires a payload byte before comparing a numbered report ID; unnumbered reports continue to accept an empty payload.

A Use-After-Free (UAF) vulnerability has been found in the Linux kernel's afs_make_call() function in the AFS filesystem. The issue arises from a race condition between sending asynchronous calls and their destruction, potentially leading to access to freed memory. The bug was reported by KASAN during tests with random CPU offlining.

A vulnerability was found in the Linux kernel's ALSA timer subsystem. The SNDRV_TIMER_IFLG_DEAD flag is never cleared after a close operation completes, leading to a use-after-free when the same timer instance is reopened. An attacker with access to /dev/snd/timer and /dev/snd/seq can trigger this to escalate privileges or cause a system crash.

In the Linux kernel, ALSA USB-audio lacks clamping of frame size in implicit-feedback mode. Received sync packet sizes are not limited to the maximum frame size, potentially causing packet transfers beyond hardware limits.

In the Linux kernel, the fou_create() function has a use-after-free vulnerability. The fou structure is published via sk_user_data before adding the port to the list, and on error it is freed while still reachable, allowing concurrent reads of freed memory.

In netfilter ipset, there is an issue with updating comments from kernel-side operations. During table resize, comment pointers are copied, and a packet-side update can free a shared comment, leading to use of a dangling pointer.

In TIPC, there is a use-after-free vulnerability in tipc_poll() during queue dumps via tracepoints. The tracepoint call without holding a lock allows access to freed packets.

In the Linux kernel's mac80211 subsystem, a use-after-free vulnerability was found in ieee80211_stop_tx_ba_cb(). After stopping a BA session, the tid_tx structure is freed via kfree_rcu(), and then the tid_tx->ndp field is read without proper RCU protection, potentially accessing freed memory. The issue occurs during local session teardown, e.g., on idle timeout, PTK rekey, suspend, or HW reconfig.

In the Linux kernel, the mwifiex driver has a vulnerability where the A-MSDU parent frame length is used instead of the subframe length when parsing TDLS frames. This leads to a use-after-free or out-of-bounds read, potentially exploitable by a remote attacker.

In the Linux kernel's binfmt_misc module, a vulnerability allows an out-of-bounds read when the user-chosen field delimiter is also a flag character (P, O, C, or F). The flag parser fails to stop at the buffer padding and reads past the allocated memory. This is reachable by unprivileged users in a user namespace.

A vulnerability was found in the Linux kernel's huge page splitting mechanism in mm/huge_memory. After splitting a folio, the code still accessed the mapping structure (i_mmap_rwsem) after the split folios were unlocked and freed, leading to a use-after-free. This occurs especially during memory failure handling for poisoned tails of shmem folios.

A use-after-free (UAF) vulnerability was found in the Linux kernel during system suspend (S3) or hibernation (S4). The page reporting work (page_reporting_process) was scheduled on the global system_wq, which lacks the WQ_FREEZABLE flag, leaving it active during suspend and causing access to deleted virtqueues, leading to a crash. The fix switches to system_freezable_wq, which is frozen before device drivers destroy their virtqueues.

A use-after-free vulnerability has been found in the Linux kernel's pktgen module. The issue involves a race between network device renaming and removal of the /proc entry, which can lead to accessing freed memory by the kpktgend thread.