CVE Vulnerability Catalog

In the rtl8723bs driver in the Linux kernel, an OOB write occurs in HT_caps_handler() which iterates over pIE->length bytes and writes into a fixed 26-byte array. A malicious AP can set pIE->length up to 255, causing up to 229 bytes of out-of-bounds writes.

In the Linux kernel, a use-after-free vulnerability was found in the Intel QAT driver during SR-IOV disable. The adf_disable_sriov() function destroys per-VF structures without stopping or synchronizing VF2PF workers, leading to freed memory dereference. The fix adds a vf2pf_disabled flag and synchronizes interrupts and workqueue.

A use-after-free vulnerability was discovered in the Linux kernel's ksmbd module. It occurs when a SMB2_CLOSE on a locking handle is followed by a SMB2_CANCEL request for the same AsyncId, causing a freed file_lock structure to be reused, leading to memory corruption.

In the Linux kernel, the pfkey_msg2xfrm_state() function fails to initialize the alg_key_len field for IPComp states (SADB_X_SATYPE_IPCOMP). This leaves uninitialized slab data, which is later used by xfrm_algo_clone() during state migration (XFRM_MSG_MIGRATE), causing a slab-out-of-bounds read and potential KASAN error.

Data races were discovered in the Linux kernel when reading the audit_queue length via skb_queue_len(). Multiple threads read this field without locking, while writes are protected by a spinlock, leading to inconsistent reads.

A use-after-free (UAF) vulnerability was found in the Linux kernel's Bluetooth L2CAP stack in the l2cap_chan_timeout() function. When a channel timeout is set and the connection is torn down before the timer expires, the timeout handler accesses freed connection memory, causing memory corruption. The fix ensures the connection reference is held for the channel's lifetime.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's Bluetooth MGMT subsystem in the add_device_complete function. It accesses the hci_conn_params object without proper locking, allowing a concurrent remove_device operation to free the memory before it is read.

In the Linux kernel NTFS3 driver, a slab out-of-bounds write vulnerability was found during $LogFile journal replay. An attacker can craft an NTFS image where the lcns_follow field in a log record exceeds the DPT entry capacity, causing a write beyond allocated memory.

In the Linux kernel NTFS driver, a vulnerability was found where post_write_mst_fixup() is called for an invalid index block. An attacker can craft a malicious NTFS image, leading to out-of-bounds memory read or write.

In the NTB (Non-Transparent Bridge) driver for PCIe EPF devices, a problem was found where pci_irq_vector() is called in hardirq context. This function uses a mutex, leading to a 'scheduling while atomic' error and potential system hang.

A use-after-free bug was found in the Linux kernel's netpoll mechanism during shutdown. The issue occurs when a pending TX worker runs in parallel with the cleanup routine, leading to access to already freed memory.

A vulnerability was found in the Linux kernel's IGMP implementation for IPv4. During network device destruction, multicast groups are not removed from the hash table (mc_hash), leading to a use-after-free condition under concurrent RCU access.

In the Linux kernel, the TCP/IP stack has a vulnerability due to missing validation of the net.ipv4.tcp_reordering sysctl value. Negative values written to this sysctl are copied to the tp->reordering field as u32, causing wrap to large values. This can lead to overflow in MTU size calculations and out-of-bounds read. The fix adds validation via proc_dointvec_minmax() and secures calculations by using u64.

In the Linux kernel, the NXP i.MX8 ISI media driver has a use-after-free bug during module removal. The function mxc_isi_remove() calls mxc_isi_crossbar_cleanup() before mxc_isi_v4l2_cleanup(), freeing media entity pads and then attempting to remove links referencing those freed pads. The fix reverses the call order.

In the Linux kernel, the MFD ChromeOS Embedded Controller driver has a use-after-free bug due to premature drvdata setting. The function ec_device_probe() set drvdata before initialization completed, allowing sub-drivers to access freed memory after a failed probe. The fix delays drvdata setting until initialization succeeds.

A race condition in the Linux kernel's shrinker_info teardown and expansion logic was discovered. The expand_shrinker_info() function iterates over memcgs that may not have completed online, while alloc_shrinker_info() frees memory outside the shrinker_mutex lock, leading to potential double-free or use-after-free. This affects memory management in cgroup environments.

In the Linux kernel netfilter subsystem, there is an issue with unreadable packet fragments (e.g., from devmem TCP). The skb_copy_bits() function returns an error, but the xt_u32 module does not handle it properly. Additionally, gather_frags, nfnetlink_queue, and nfnetlink_log do not cope with such fragments.

In the Linux kernel ebtables subsystem, the chainstack array is not zeroed before use. If cpu_possible_mask is sparse (e.g., CPU 0 and 2 are possible, but CPU 1 is not) and allocation for CPU 2 fails, the cleanup loop may call vfree() on an uninitialized pointer, leading to a potential bug.

In the Linux kernel ebtables subsystem, module names are not properly null-terminated. The request_module() function may receive a non-null-terminated string, leading to potential buffer overflow or incorrect module loading.

In the Linux kernel ebtables subsystem, the update_counters() and compat_update_counters() functions pass a 32-byte table name to find_table_lock() without null-termination. On a lookup miss, try_then_request_module() attempts to load a module, and vsnprintf() reads beyond the name boundary, causing a stack-out-of-bounds read (KASAN).