CVE Vulnerability Catalog

In the Linux kernel's cfg80211 subsystem, there is an issue with autodisconnect work that can be queued after cancellation, leading to potential use-after-free or race during device unregistration.

In the Linux kernel's cfg80211 subsystem, there is an out-of-bounds read (slab-out-of-bounds) when checking element inheritance if an extension element has zero length. This can be triggered by a crafted frame from an AP.

In the Linux kernel's arm_ffa driver, there are out-of-bounds writes in ffa_setup_and_transmit(), especially for FFA versions < 1.2 where the reserved field has offset 24 but the size returned is 16 bytes. There is also a lack of size check for constituents.

In the Linux kernel's arm_ffa driver, there is an error in calculating the Endpoint Memory Access descriptor offset, which uses sizeof(struct ffa_mem_region) instead of ep_mem_offset, potentially leading to incorrect memory access. There is also a lack of sanity checks for offsets.

A use-after-free (UAF) vulnerability was found in the Linux kernel's sk_clone() function for BPF sockets. On early bailout, the pointer to the parent socket's BPF storage remains in the cloned socket, leading to its deallocation when the clone is freed and subsequent use of freed memory by the parent socket.

A use-after-free vulnerability exists in the Linux kernel's PPP subsystem, specifically in the pppol2tp receive path. The issue arises from missing RCU grace period before freeing the internal PPP channel, potentially leading to memory corruption. The bug is reachable by an unprivileged user.

A vulnerability was found in the Linux kernel's net/iucv subsystem where a socket found in afiucv_hs_rcv() is not properly referenced. After releasing the lock, the socket can be closed and freed before the event handler uses it, leading to use-after-free.

In the Linux kernel Bluetooth MGMT subsystem, a use-after-free vulnerability exists. The MGMT_OP_LOAD_CONN_PARAM operation stores a pointer to an hci_conn_params entry that can be freed by a subsequent request before the queued work executes. The fix stores a reference to hci_conn and revalidates parameters when the work runs.

In the Linux kernel's Bluetooth subsystem (hci_sync), a vulnerability was found where RCU-protected pointers are used outside critical sections without proper refcounting, potentially leading to use-after-free. The fix extends critical sections and adds rcu_read_lock() where needed.

In the Linux kernel's Bluetooth subsystem (mgmt), a locking issue was found in unpair_device and disconnect_sync. Dereferencing RCU-protected pointers outside critical sections can lead to use-after-free. The fix adds hdev->lock for hci_conn lookup and hci_abort_conn().

In the Linux kernel's Bluetooth subsystem (mgmt), a vulnerability was found where hci_conn is not properly referenced in mgmt_pending_cmds. Dereferencing RCU-protected pointers outside critical sections can lead to use-after-free. The fix adds appropriate locks and refcounting.

In the Linux kernel's Bluetooth subsystem (hci_sync), an issue was found where hdev->lock is not held during hci_conn_params lookups. Without this lock, list iteration or parameter access is not safe. The fix adds hdev->lock for parameter lookups.

In the Linux kernel, the Bluetooth hci_qca driver has a use-after-free vulnerability when handling an invalid dump size from the controller. When the controller reports a zero dump size, the error path frees the local object but does not clear the pointer in the qca structure, leading to later access to freed memory.

In the Linux kernel, the CAN raw subsystem has a race condition when modifying bitfield flags in the raw_sock structure. Read-modify-write operations in raw_setsockopt() can be executed concurrently, leading to unpredictable behavior.

In the Linux kernel, a vulnerability was found in the DRM/XE driver related to VF (Virtual Function) CCS attach/detach operations during BO (Buffer Object) moves. The issue is a race condition where CCS batch buffers are attached or detached without proper synchronization with the copy fence, leading to potential data corruption or incorrect behavior during VF migration.

In the Linux kernel, the DRM xe driver (drm/xe/guc) has a use-after-free vulnerability in the scheduler. The pointer to the queue name (q->name) is freed with the queue, while the scheduler may still reference it.

A vulnerability was found in the Linux kernel DRM/XE driver for Intel GPUs, related to the GuC execution queue. Queue destruction can run asynchronously, risking a deadlock during resource cleanup. The fix holds a device reference for the queue lifetime and moves destroy work to a dedicated workqueue.

In the Linux kernel, the accel/amdxdna driver has a use-after-free vulnerability of the mm_struct in the job scheduler. The pointer to mm_struct is stored without holding a reference, which can lead to access to freed memory during job execution.

In the Linux kernel, a TIME_WAIT socket reference leak was found on PSP policy failure in IPv4 and IPv6 receive paths. The missing release leads to memory leak of tcp_tw_bucket structures.

A use-after-free vulnerability was found in the Linux kernel's net/sched/act_tunnel_key module. The tunnel_key_release_params() function releases the metadata_dst of old parameters synchronously via dst_release(), while the params structure is freed asynchronously via kfree_rcu(). A concurrent reader in tunnel_key_act() may still hold a pointer to the old parameters and call dst_clone() after dst_release() has marked the dst as RCUREF_DEAD, leading to access to freed memory.