CVE Vulnerability Catalog

In the Linux kernel's TCPCI rt1711h driver, the TCPCI port is not unregistered if later steps in probe() fail. The port remains registered, potentially causing issues on re-initialization or driver detach.

In the Linux kernel, the sriov_restore_vf_rebar_state() function has an out-of-bounds access to the barsz[] array when a VF Resizable BAR Control register read returns PCI_ERROR_RESPONSE. This can lead to memory corruption and system instability.

In the Linux kernel's virtio hwrng driver, a buffer over-read vulnerability exists. A malicious or buggy virtio-rng backend can report an inflated used.len, causing memcpy() to read past the vi->data array into adjacent heap memory.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's USB misc/usbio driver. During device disconnect, the usbio_disconnect() function iterated over clients and freed them, but the loop continued to access freed memory, causing a KASAN error. The fix replaces the loop with list_for_each_entry_safe_reverse() to prevent use after free.

In the Linux kernel's 6LoWPAN stack, a race condition in lowpan_nhc_do_uncompression() can lead to use-after-free of an NHC descriptor after releasing the lock. KASAN reported the issue as a slab-use-after-free.

In the Linux kernel's vme_user driver (staging), the buffer_to_user() and buffer_from_user() helpers did not validate that offset + count stays within the fixed-size kern_buf (128 KiB). This allowed out-of-bounds reads/writes beyond the allocated buffer.

In the Linux kernel's SMB client (cifs), a vulnerability exists due to incorrect application of the +1 byte exemption for responses with a data area. The smb2_check_message() function accepts responses one byte longer than received, which leads to an out-of-bounds read when a data area is present. The issue is reachable during SMB negotiation and session setup, before full authentication.

In the Linux kernel's ipu7_isys_init() and ipu7_psys_init() functions, a double-free and use-after-free occur when kfree(pdata) is called again after the device teardown already freed it. Additionally, the error code is not saved before put_device(), causing ERR_CAST() to dereference a freed pointer.

In the rtl8723bs driver in the Linux kernel, a heap buffer overflow occurs in rtw_cfg80211_set_wpa_ie() when a local user sends a crafted WPA IE of length 255, causing memcpy to copy 257 bytes into a 256-byte buffer, overflowing into the adjacent last_mic_err_time field.

In the rtl8723bs driver in the Linux kernel, an underflow and OOB read occur in OnAuth() when a short authentication frame causes negative length calculation in rtw_wep_decrypt(), leading to out-of-bounds read. Also, memcmp always reads 128 bytes regardless of actual IE length.

In the rtl8723bs driver in the Linux kernel, an OOB read occurs in the IE loop in OnAssocRsp() when a malicious AP sends an AssocResponse with a truncated last IE, causing pIE->length to be read out of bounds. Also, declared IE length may extend beyond the buffer.

In the rtl8723bs driver in the Linux kernel, an OOB read occurs in the IE loop in update_beacon_info() when a malicious AP sends a Beacon with a truncated last IE, causing pIE->length to be read out of bounds. Also, declared IE length may extend beyond the buffer.

In the rtl8723bs driver in the Linux kernel, OOB reads occur in IE loops in issue_assocreq() and join_cmd_hdl() when IE data ends with only an element_id byte, causing pIE->length to be read out of bounds. A malicious AP can trigger this via crafted Beacon or Probe Response frames.

In the rtl8723bs driver in the Linux kernel, OOB reads occur in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() due to missing bounds checks before reading IE/attribute headers and comparing multi-byte OUI identifiers.

In the rtl8723bs driver in the Linux kernel, an OOB write occurs in HT_caps_handler() which iterates over pIE->length bytes and writes into a fixed 26-byte array. A malicious AP can set pIE->length up to 255, causing up to 229 bytes of out-of-bounds writes.

In the Linux kernel, a use-after-free vulnerability was found in the Intel QAT driver during SR-IOV disable. The adf_disable_sriov() function destroys per-VF structures without stopping or synchronizing VF2PF workers, leading to freed memory dereference. The fix adds a vf2pf_disabled flag and synchronizes interrupts and workqueue.

A use-after-free vulnerability was discovered in the Linux kernel's ksmbd module. It occurs when a SMB2_CLOSE on a locking handle is followed by a SMB2_CANCEL request for the same AsyncId, causing a freed file_lock structure to be reused, leading to memory corruption.

In the Linux kernel, the pfkey_msg2xfrm_state() function fails to initialize the alg_key_len field for IPComp states (SADB_X_SATYPE_IPCOMP). This leaves uninitialized slab data, which is later used by xfrm_algo_clone() during state migration (XFRM_MSG_MIGRATE), causing a slab-out-of-bounds read and potential KASAN error.

Data races were discovered in the Linux kernel when reading the audit_queue length via skb_queue_len(). Multiple threads read this field without locking, while writes are protected by a spinlock, leading to inconsistent reads.

A use-after-free (UAF) vulnerability was found in the Linux kernel's Bluetooth L2CAP stack in the l2cap_chan_timeout() function. When a channel timeout is set and the connection is torn down before the timer expires, the timeout handler accesses freed connection memory, causing memory corruption. The fix ensures the connection reference is held for the channel's lifetime.