CVE Vulnerability Catalog

In the Linux kernel HID letsketch driver, a use-after-free (UAF) vulnerability was found in the inrange_timer during device unbind. The missing .remove callback allows the timer to fire on freed memory, leading to a security breach.

In the Linux kernel, a vulnerability in the HID multitouch driver causes out-of-bounds bit access on mt_io_flags, which is used as a per-slot bitmap but sized as unsigned long. This corrupts adjacent struct mt_device fields and leads to a kernel panic.

In the Linux kernel HID appleir driver, a Use-After-Free (UAF) vulnerability was found in appleir_remove(). The key_up_timer callback can fire after input_dev is freed, causing a use of freed memory. The fix introduces a 'removing' flag and timer synchronization.

A use-after-free vulnerability was found in the HID driver for Logitech G keyboards (lg-g15). The driver did not cancel pending work before freeing memory, allowing access to freed memory when the device is unplugged.

An unsigned integer overflow (u32) was found in the check_and_correct_requested_length function in HFS and HFSPlus filesystems in the Linux kernel. A large len value can wrap the off+len sum, bypassing bounds checking and leading to out-of-bounds buffer read.

In the Linux kernel BTF parser, the btf_repeat_fields() function performs field count calculations in u32 arithmetic, which can wrap with malicious BTF. This bypasses capacity checks and leads to out-of-bounds write to the scratch array. The fix uses checked addition and multiplication.

A vulnerability was found in the Linux kernel's LPM trie map implementation in BPF, causing false lockdep warnings when sleepable BPF programs were executed. The issue involved incorrect RCU usage in trie_lookup_elem, trie_update_elem, and trie_delete_elem functions, which did not account for the rcu_read_lock_trace() context.

In the Linux kernel's EHCI and FOTG210 USB drivers, there is a memory leak on failed isochronous submits. When a submit fails before linking the URB to the queue, the staged schedule (ehci_iso_sched) remains in urb->hcpriv and is not freed.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's USB gadget subsystem. The issue occurs when gadget_match_driver() accesses freed udc structure memory, potentially leading to a NULL pointer dereference and system crash.

In the Linux kernel's idmouse USB driver, there is a use-after-free vulnerability on disconnect race. The mutex_unlock() function may access the mutex structure after releasing the lock, leading to use-after-free when release() races with disconnect().

In the Linux kernel's ldusb USB driver, there is a use-after-free vulnerability on disconnect race. The mutex_unlock() function may access the mutex structure after releasing the lock, leading to use-after-free when release() races with disconnect().

In the Linux kernel, the USB iowarrior driver has a use-after-free vulnerability on disconnect. Submitted write URBs are not stopped on close(), so they must be stopped unconditionally on disconnect() to prevent use-after-free in the completion handler.

In the Linux kernel, the USB iowarrior driver has a use-after-free vulnerability on disconnect race. mutex_unlock() may access the mutex structure after releasing the lock, so a kref is used to release driver data to avoid use-after-free in mutex_unlock() when release() races with disconnect().

In the Linux kernel, the USB legousbtower driver has a use-after-free vulnerability on disconnect race. mutex_unlock() may access the mutex structure after releasing the lock, so a kref is used to release driver data to avoid use-after-free in mutex_unlock() when release() races with disconnect().

In the Linux kernel, the usbio driver (usb: misc) has a slab-out-of-bounds read vulnerability. The usbio_bulk_msg() function copies data with a device-controlled length but checks it only against the transmit buffer (txbuf), not the receive buffer (rxbuf). A malicious USB device can exploit this mismatch to disclose adjacent kernel memory.

In the Linux kernel, the USB serial digi_acceleport driver has a write buffer corruption vulnerability. The digi_write_inb_command() function should wait for the write urb to become available or return an error, but on timeout it updates the transfer buffer and tries to resubmit the urb. Additionally, for commands without timeout, corruption occurs immediately due to a broken jiffies comparison. The fix adds the missing return on timeout and waits indefinitely when no timeout is specified.

Missing SVID index validation in the Linux kernel's USB Type-C TCPM driver in svdm_consume_modes(). An invalid index can cause an out-of-bounds read and registration of a fake SVID.

A use-after-free bug in the Linux kernel's USB Type-C UCSI CCG driver on device removal. The interrupt handler may access the already freed ucsi structure.

Missing block extent validation in the Linux kernel's UDF filesystem in udf_free_blocks(). Out-of-bounds access to the space bitmap array can cause a kernel panic.

Missing VAT header length validation against the VAT inode size in the Linux kernel's UDF filesystem. This can lead to out-of-bounds read and potential kernel panic.