CVE Vulnerability Catalog

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's Bluetooth MGMT subsystem in the add_device_complete function. It accesses the hci_conn_params object without proper locking, allowing a concurrent remove_device operation to free the memory before it is read.

In the Linux kernel NTFS3 driver, a slab out-of-bounds write vulnerability was found during $LogFile journal replay. An attacker can craft an NTFS image where the lcns_follow field in a log record exceeds the DPT entry capacity, causing a write beyond allocated memory.

In the Linux kernel NTFS driver, a vulnerability was found where post_write_mst_fixup() is called for an invalid index block. An attacker can craft a malicious NTFS image, leading to out-of-bounds memory read or write.

In the NTB (Non-Transparent Bridge) driver for PCIe EPF devices, a problem was found where pci_irq_vector() is called in hardirq context. This function uses a mutex, leading to a 'scheduling while atomic' error and potential system hang.

A use-after-free bug was found in the Linux kernel's netpoll mechanism during shutdown. The issue occurs when a pending TX worker runs in parallel with the cleanup routine, leading to access to already freed memory.

A vulnerability was found in the Linux kernel's IGMP implementation for IPv4. During network device destruction, multicast groups are not removed from the hash table (mc_hash), leading to a use-after-free condition under concurrent RCU access.

In the Linux kernel, the TCP/IP stack has a vulnerability due to missing validation of the net.ipv4.tcp_reordering sysctl value. Negative values written to this sysctl are copied to the tp->reordering field as u32, causing wrap to large values. This can lead to overflow in MTU size calculations and out-of-bounds read. The fix adds validation via proc_dointvec_minmax() and secures calculations by using u64.

In the Linux kernel, the NXP i.MX8 ISI media driver has a use-after-free bug during module removal. The function mxc_isi_remove() calls mxc_isi_crossbar_cleanup() before mxc_isi_v4l2_cleanup(), freeing media entity pads and then attempting to remove links referencing those freed pads. The fix reverses the call order.

In the Linux kernel, the MFD ChromeOS Embedded Controller driver has a use-after-free bug due to premature drvdata setting. The function ec_device_probe() set drvdata before initialization completed, allowing sub-drivers to access freed memory after a failed probe. The fix delays drvdata setting until initialization succeeds.

A race condition in the Linux kernel's shrinker_info teardown and expansion logic was discovered. The expand_shrinker_info() function iterates over memcgs that may not have completed online, while alloc_shrinker_info() frees memory outside the shrinker_mutex lock, leading to potential double-free or use-after-free. This affects memory management in cgroup environments.

In the Linux kernel netfilter subsystem, there is an issue with unreadable packet fragments (e.g., from devmem TCP). The skb_copy_bits() function returns an error, but the xt_u32 module does not handle it properly. Additionally, gather_frags, nfnetlink_queue, and nfnetlink_log do not cope with such fragments.

In the Linux kernel ebtables subsystem, the chainstack array is not zeroed before use. If cpu_possible_mask is sparse (e.g., CPU 0 and 2 are possible, but CPU 1 is not) and allocation for CPU 2 fails, the cleanup loop may call vfree() on an uninitialized pointer, leading to a potential bug.

In the Linux kernel ebtables subsystem, module names are not properly null-terminated. The request_module() function may receive a non-null-terminated string, leading to potential buffer overflow or incorrect module loading.

In the Linux kernel ebtables subsystem, the update_counters() and compat_update_counters() functions pass a 32-byte table name to find_table_lock() without null-termination. On a lookup miss, try_then_request_module() attempts to load a module, and vsnprintf() reads beyond the name boundary, causing a stack-out-of-bounds read (KASAN).

In the Linux kernel, the Bluetooth bnep driver reads an L2CAP connection without holding the channel lock during netdev registration, leading to a use-after-free if the controller is torn down concurrently. The fix pins the L2CAP connection reference before registration.

In the Linux kernel Bluetooth btnxpuart driver, an out-of-bounds read occurs in nxp_recv_fw_req_v3() because the offset and length are not validated against the firmware image size, allowing a controller to read past the buffer and send memory over UART.

In the Linux kernel, bt_accept_dequeue() has a use-after-free vulnerability because it drops a temporary reference before bt_accept_unlink(), leading to access to freed memory when the reference was the last one.

In the Linux kernel Bluetooth L2CAP stack, l2cap_get_conf_opt() reads the option value before verifying that the full option fits in the buffer, allowing an attacker-controlled length to cause an out-of-bounds read of up to 4 bytes.

In the Linux kernel coresight ultrasoc-smb driver, smb_sync_perf_buffer() can write out of bounds of the dst_pages[] array because the initial page index is not normalized modulo the AUX buffer size, leading to an out-of-bounds write.

In the Linux kernel, a vulnerability was found in the SMB client where cifs_swn_notify() uses a stale tcon pointer after memory is freed, leading to use-after-free. The issue arises from the lack of a stable reference to tcon in SWN registration when multiple mounts share the same registration ID.