CVE Vulnerability Catalog

In the ALSA compress driver, snd_compr_task_new() leaks driver resources on error after successful task_create() and may incorrectly report success due to uninitialized retval.

In the Linux kernel's ALSA hda/cs35l41 driver, there is a teardown issue with firmware load work. ALSA controls are not removed on component unbind, and fw_load_work may be cancelled only conditionally. If the component or device is removed before the queued work runs, a use-after-free can occur.

In the Linux kernel's vfio/pci driver, after a reorder in vfio_pci_core_register_device(), the VGA arbiter client registration is not unwound on failure. This can leave a callback with a freed vdev cookie, which becomes unsafe when the callback follows drvdata to the vfio device.

A use-after-free (UAF) vulnerability was found in the Linux kernel's binder_thread_release() function. A race condition between thread exit and concurrent transaction freeing can lead to accessing freed memory.

A use-after-free vulnerability was found in the Linux kernel's binder_free_transaction() function in the Binder driver. The issue occurs because the target process pointer (t->to_proc) is read under a lock, but after the lock is released, the process can be freed, leading to access to freed memory.

In the Linux kernel rust_binder driver, an incorrect stride (usize instead of u64) is used when cleaning up the offsets array. On 32-bit kernels, this causes over-decrement of reference counts and corrupted reference accounting.

In the Linux kernel's TCPCI rt1711h driver, the TCPCI port is not unregistered if later steps in probe() fail. The port remains registered, potentially causing issues on re-initialization or driver detach.

In the Linux kernel, the sriov_restore_vf_rebar_state() function has an out-of-bounds access to the barsz[] array when a VF Resizable BAR Control register read returns PCI_ERROR_RESPONSE. This can lead to memory corruption and system instability.

In the Linux kernel's virtio hwrng driver, a buffer over-read vulnerability exists. A malicious or buggy virtio-rng backend can report an inflated used.len, causing memcpy() to read past the vi->data array into adjacent heap memory.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's USB misc/usbio driver. During device disconnect, the usbio_disconnect() function iterated over clients and freed them, but the loop continued to access freed memory, causing a KASAN error. The fix replaces the loop with list_for_each_entry_safe_reverse() to prevent use after free.

In the Linux kernel's 6LoWPAN stack, a race condition in lowpan_nhc_do_uncompression() can lead to use-after-free of an NHC descriptor after releasing the lock. KASAN reported the issue as a slab-use-after-free.

In the Linux kernel's vme_user driver (staging), the buffer_to_user() and buffer_from_user() helpers did not validate that offset + count stays within the fixed-size kern_buf (128 KiB). This allowed out-of-bounds reads/writes beyond the allocated buffer.

In the Linux kernel's SMB client (cifs), a vulnerability exists due to incorrect application of the +1 byte exemption for responses with a data area. The smb2_check_message() function accepts responses one byte longer than received, which leads to an out-of-bounds read when a data area is present. The issue is reachable during SMB negotiation and session setup, before full authentication.

In the Linux kernel's ipu7_isys_init() and ipu7_psys_init() functions, a double-free and use-after-free occur when kfree(pdata) is called again after the device teardown already freed it. Additionally, the error code is not saved before put_device(), causing ERR_CAST() to dereference a freed pointer.

In the rtl8723bs driver in the Linux kernel, a heap buffer overflow occurs in rtw_cfg80211_set_wpa_ie() when a local user sends a crafted WPA IE of length 255, causing memcpy to copy 257 bytes into a 256-byte buffer, overflowing into the adjacent last_mic_err_time field.

In the rtl8723bs driver in the Linux kernel, an underflow and OOB read occur in OnAuth() when a short authentication frame causes negative length calculation in rtw_wep_decrypt(), leading to out-of-bounds read. Also, memcmp always reads 128 bytes regardless of actual IE length.

In the rtl8723bs driver in the Linux kernel, an OOB read occurs in the IE loop in OnAssocRsp() when a malicious AP sends an AssocResponse with a truncated last IE, causing pIE->length to be read out of bounds. Also, declared IE length may extend beyond the buffer.

In the rtl8723bs driver in the Linux kernel, an OOB read occurs in the IE loop in update_beacon_info() when a malicious AP sends a Beacon with a truncated last IE, causing pIE->length to be read out of bounds. Also, declared IE length may extend beyond the buffer.

In the rtl8723bs driver in the Linux kernel, OOB reads occur in IE loops in issue_assocreq() and join_cmd_hdl() when IE data ends with only an element_id byte, causing pIE->length to be read out of bounds. A malicious AP can trigger this via crafted Beacon or Probe Response frames.

In the rtl8723bs driver in the Linux kernel, OOB reads occur in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() due to missing bounds checks before reading IE/attribute headers and comparing multi-byte OUI identifiers.