CVE Vulnerability Catalog

In the Linux kernel, the auth_hmacs array size in struct sctp_cookie is miscalculated, causing out-of-bounds copy during SCTP association initialization. This can corrupt the adjacent auth_chunks field, accept an invalid HMAC identifier, and lead to out-of-bounds read in sctp_auth_get_hmac().

In the Linux kernel, the USB subsystem lacks synchronization in bos_descriptors_read(), which accesses udev->bos. This field can be concurrently freed in usb_reset_and_verify_device(), leading to a race condition.

In the Linux kernel, the at76c50x-usb driver has a length underflow vulnerability in at76_guess_freq(). If a frame is shorter than the expected offset, the calculated IE length wraps, leading to an out-of-bounds read during scanning.

In the Linux kernel, the usb: musb: omap2430 driver's omap2430_probe() calls of_node_put() on a borrowed of_node pointer, leading to an unbalanced reference count for the platform device node.

In the Linux kernel, the USB gadget dummy_hcd driver has a vulnerability involving reuse of a shared USB request (fifo_req) during request giveback. An attacker can exploit a race condition between threads, leading to overwriting a callback function pointer and causing a page fault or general protection fault (GPF) in the kernel.

In the Linux kernel, the firewire net driver has a vulnerability in fragmented datagram reassembly. The fwnet_frag_new() function keeps a sorted list of received fragments. When checking adjacency, the code assumes the current fragment always has a real next or previous fragment, but at list edges it may be the list head, leading to incorrect merging of ranges. As a result, fwnet_pd_is_complete() may miss a complete datagram.

In the Linux kernel, the ath6kl driver has an out-of-bounds read vulnerability in the TX complete event handler. The firmware-controlled num_msg field (u8, 0-255) drives the loop without validation against buffer length, allowing reads up to 1020 bytes past the WMI event buffer.

In the Linux kernel, the ath6kl driver has an out-of-bounds read vulnerability in the connect event handler. The firmware-controlled fields beacon_ie_len, assoc_req_len, and assoc_resp_len are not validated against buffer length, potentially causing OOB reads during IE parsing and corruption of wmi->is_wmm_enabled state.

In the Linux kernel, the ASoC tas2781 driver has an out-of-bounds read vulnerability when parsing firmware description strings. The parser uses strlen() without checking if the NUL terminator is present in the firmware buffer, which can cause reads past the end of the buffer with a malformed firmware image.

In the Linux kernel's ovpn, unlock_ovpn() uses llist_for_each_entry() to iterate over the release_list, but after freeing a peer inside the loop, it reads peer->release_entry.next after the peer may have been freed, leading to use-after-free.

In the Linux kernel's hwmon occ, the poll response parser uses the static backing-array capacity as the parse boundary instead of data_length, allowing reads beyond the current response when data is truncated.

In the Linux kernel's net/packet, packet_set_ring() may re-register the fanout hook after device unregistration if po->ifindex == -1 is not treated as an invalidated binding. This leads to re-adding the hook after the device has been unregistered.

A vulnerability was found in the Linux kernel's RDS (Reliable Datagram Sockets) subsystem. The destination socket lookup does not consider network namespaces, allowing a message to be delivered to a socket in a different namespace. This can lead to a use-after-free condition when the namespace is torn down, potentially causing a system crash or arbitrary code execution.

In the Linux kernel, the airoha network driver has a DMA direction bug for the NPU mailbox buffer. airoha_npu_send_msg() always maps the buffer with DMA_TO_DEVICE, but some callers expect the NPU to write response data back into the same buffer. On non-cache-coherent architectures, this can lead to reading stale data.

In the Linux kernel, a vulnerability in the iommu/amd driver was found in the iommu_completion_wait() function due to incorrect handling of the need_sync flag. In a multi-CPU scenario, the function could return early without waiting for all previously queued commands to complete, violating the synchronization contract.

In the Linux kernel, the mwifiex driver lacks validation of event length supplied by firmware, leading to potential out-of-bounds read or integer underflow when handling station association events in AP mode.

A vulnerability in the Linux kernel's TIPC subsystem affects the UDP replicast list. List updates were not serialized, which could lead to list corruption and a kernel panic. The issue is a race between adding entries from a softirq and deleting them during bearer cleanup.

In the Linux kernel, a vulnerability in the SCTP protocol involves an incorrect capacity check of the auth_chunk_list in sctp_auth_ep_add_chunkid. The limit set to 20 entries is larger than the actual capacity of the destination structure (16 entries), which can lead to a buffer overflow during copying in sctp_association_init().

In the Linux kernel, errors were detected in the element size calculation during command stream validation in the ethosu accelerator. For NHWC format, the element size is missing, and for OFM different precision bits are used than for IFM/IFM2, leading to an undersized calculation. This can result in improper validation and potential buffer overflow.

A vulnerability in the Linux kernel's SCTP implementation was found. The sctp_process_strreset_inreq() function does not validate the stream count in a RESET_IN_REQUEST from a peer, which can cause an overflow when generating the RESET_OUT_REQUEST. On interfaces with MTU larger than 65535 bytes (e.g., loopback with IPv6 jumbograms), this can lead to a __u16 overflow, undersized skb allocation, and a kernel BUG.