CVE Vulnerability Catalog

In the Linux kernel, in the ALSA timer subsystem, there is an issue with re-entering an instance callback that is still running. The userspace-driven timer (utimer) TRIGGER ioctl calls snd_timer_interrupt() directly with no serialization, so two threads can run snd_timer_interrupt() on the same timer concurrently. The SNDRV_TIMER_IFLG_CALLBACK bit cannot represent two concurrent callbacks, leading to use-after-free.

In the Linux kernel, in the wifi ath6kl driver, there is an out-of-bounds (OOB) access issue caused by the firmware-supplied ADDBA window size. The aggr_recv_addba_req_evt() function logs a debug message when win_sz is out of range but does not return. The out-of-range win_sz is then used to compute an allocation size, leading to zero-size or overflowed allocations and subsequent out-of-bounds access.

In the Linux kernel, in the wifi ath6kl driver, there is a use-after-free issue in the aggr_reset_state() function. The function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_destroy(). If the timer callback is executing at that time, it may access freed memory.

In the Linux kernel's wilc1000 driver, there is an out-of-bounds read vulnerability when processing association responses. The driver does not validate that the frame length is sufficient to contain the header, which can lead to reading beyond the buffer or length wrap-around.

In the Linux kernel's brcmfmac driver, there is a double-free vulnerability of DMA buffers. The function releasing scratch buffers does not null the pointers after freeing, so when called multiple times (e.g., during reset and removal) it leads to freeing the same allocation again.

A use-after-free vulnerability was found in the Linux kernel's Bluetooth subsystem (hci_sync). The issue stems from missing synchronization of the UUID list between asynchronous work and add_uuid/remove_uuid operations, potentially leading to reading freed memory.

In the Linux kernel, the NSM misc driver's nsm_dev_ioctl() can unlock a mutex that was never locked when copy_from_user fails before acquiring the lock, leading to a bad unlock balance warning. The fix returns immediately on pre-lock failure.

In the Linux kernel, the NSM misc driver does not set the owner field in file operations, so opening /dev/nsm does not take a module reference. If the driver is a module, an open file descriptor can survive rmmod, leading to calls into unloaded code. The fix sets owner to THIS_MODULE.

In the Linux kernel tracing subsystem, there is an issue with delayed module refcount for the 'enable_event' trigger. The module refcount is released immediately while trigger data may still be used after the RCU grace period, leading to use-after-free. The fix moves the module ref release into the delayed callback.

In the Linux kernel, a vulnerability in the ublk subsystem was found where waiting on ub->completion instead of the actual device readiness (ublk_dev_ready()) can lead to a deadlock. If the ublk server sends END_USER_RECOVERY without a successful START_USER_RECOVERY, the device may be marked LIVE and the requeue list not kicked again, causing requests (e.g., flush_rq) to be stranded and blocking fsync and teardown.

In the Linux kernel for ARM64, huge_ptep_get() can be passed an unaligned virtual address, leading to incorrect determination of contiguous PTE count and potential out-of-bounds access, causing kernel panic. The fix aligns the pmdp pointer to the contpmd base before comparison.

A vulnerability was found in the Linux kernel's handling of device-private PMD entries during rmap walks. The bug causes these entries to be incorrectly treated as migration entries, potentially leading to memory corruption. Additionally, a race condition with PMD splitting can occur, worsening the issue.

In the Linux kernel, the SCTP protocol has a use-after-free vulnerability in the auth_enable sysctl during network namespace teardown. The sysctl registration was performed before the control socket was created, allowing access to a non-existent object. The fix moves sysctl registration to sctp_ctrlsock_init() and properly handles unregistration.

In the Linux kernel's libceph module, a NULL pointer dereference can occur during localized read selection when a CRUSH type name is missing. The fix skips such malformed parent buckets unless both bucket name and type name metadata are present.

In the Linux kernel's libceph module, a monmap with zero monitors was treated as valid, potentially leading to a client crash. The fix rejects such monmaps during decoding.

In the Linux kernel's libceph module, debugfs files were removed after the monitor client teardown, potentially leading to a use-after-free. The fix removes debugfs files before stopping the OSD and monitor clients.

In the Linux kernel's AMT module, delayed works could access the freed amt_dev structure after device removal. The fix uses disable_delayed_work_sync() in amt_dev_stop() to prevent re-queueing of works.

In the Linux kernel's forget_cached_acl() function, the ACL_DONT_CACHE state is not preserved, which for filesystems that opted out of ACL caching (e.g., FUSE) can lead to returning stale ACL values. The issue arises because forget_all_cached_acls() calls in FUSE code do not account for this state and remove it.

In the Linux kernel's fscrypt module, in find_or_insert_direct_key(), there is a missing comparison of the super_block pointer, causing entries in the global fscrypt_direct_keys table to be shared between different super_blocks. This can lead to a use-after-free when a key is evicted after the super_block's lifetime ends.

In the Linux kernel's fscrypt module, fscrypt_get_devices() uses dynamic allocation for an array of block device pointers, which can fail, especially during key eviction under direct reclaim. The unhandled failure leads to a use-after-free.