CVE Vulnerability Catalog

In the Linux kernel, the Bluetooth bnep driver reads an L2CAP connection without holding the channel lock during netdev registration, leading to a use-after-free if the controller is torn down concurrently. The fix pins the L2CAP connection reference before registration.

In the Linux kernel Bluetooth btnxpuart driver, an out-of-bounds read occurs in nxp_recv_fw_req_v3() because the offset and length are not validated against the firmware image size, allowing a controller to read past the buffer and send memory over UART.

In the Linux kernel, bt_accept_dequeue() has a use-after-free vulnerability because it drops a temporary reference before bt_accept_unlink(), leading to access to freed memory when the reference was the last one.

In the Linux kernel Bluetooth L2CAP stack, l2cap_get_conf_opt() reads the option value before verifying that the full option fits in the buffer, allowing an attacker-controlled length to cause an out-of-bounds read of up to 4 bytes.

In the Linux kernel coresight ultrasoc-smb driver, smb_sync_perf_buffer() can write out of bounds of the dst_pages[] array because the initial page index is not normalized modulo the AUX buffer size, leading to an out-of-bounds write.

In the Linux kernel, a vulnerability was found in the SMB client where cifs_swn_notify() uses a stale tcon pointer after memory is freed, leading to use-after-free. The issue arises from the lack of a stable reference to tcon in SWN registration when multiple mounts share the same registration ID.

In the Linux kernel ksmbd SMB server, a path traversal bypass exists in __ksmbd_vfs_kern_path() because the -EXDEV error from vfs_path_parent_lookup() is not intercepted, allowing the caseless retry logic to create files or directories outside the shared resource.

In the Linux kernel, the ksmbd filesystem lacks a permission check for the FSCTL_SET_ZERO_DATA operation. An authenticated SMB client can use a handle opened only with FILE_WRITE_ATTRIBUTES to zero file data without FILE_WRITE_DATA rights.

In the Linux kernel, the ksmbd filesystem has a use-after-free vulnerability in the file_lock structure during deferred lock cancellation. When a lock is cancelled and the work is no longer active, freeing the lock before removing it from the async list leads to accessing freed memory.

In the Linux kernel, the ksmbd filesystem lacks a read permission check for the source file during the duplicate extents operation (FSCTL_DUPLICATE_EXTENTS_TO_FILE). A handle opened only with attribute access can be used to copy file contents to an attacker-readable destination.

In the Linux kernel's ksmbd (SMB) filesystem, a missing WRITE_DAC/WRITE_OWNER permission check in the SMB2 SET_INFO SECURITY operation allows a client with a low-privilege handle (e.g., FILE_WRITE_ATTRIBUTES) to rewrite the file's security descriptor and gain unauthorized access.

In the Linux kernel, the ksmbd filesystem has a lock management issue with SMB3 multichannel. A byte-range lock can be removed from the connection list using the wrong spinlock, leading to access to freed objects during concurrent list traversal.

In the Linux kernel, the ksmbd filesystem validates the NTLMv2 response after updating the session key. On authentication failure, the session key can be modified before the error is returned, allowing a client to change the session key of an existing binding session.

In the Linux kernel, SMB3 client with POSIX Extensions ignored chown/chgrp changes unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID were set. The fix checks for posix_extensions in cifs_setattr_nounix() to properly call id_mode_to_cifs_acl() and set ownership/group on the server.

In the Linux kernel, SMB client has a double-free vulnerability in SMB2_open() replay. A response-bearing attempt can free its buffer, and if SMB2_open_init() fails before the next send, cleanup frees the same buffer again. The fix resets response bookkeeping before each attempt.

In the Linux kernel, SMB client function receive_encrypted_standard() allocates next_buffer before checking if the number of compound PDUs reached MAX_COMPOUND. If the limit is exceeded, the function returns immediately and the allocated next_buffer is leaked. The fix moves the MAX_COMPOUND check before allocating next_buffer.

In the Linux kernel, SMB client function posix_info_sid_size() reads sid[1] for subauthority count, but its boundary check still accepts buffers with only one remaining byte. The fix requires two bytes before reading sid[1] so all client paths safely reject truncated POSIX SIDs.

In the Linux kernel, SMB client with modefromsid active, parse_dacl() applies the server-provided sub_auth[2] value from the NFS mode SID to cf_mode without masking to 07777. The fix adds correct masking, same as in the read path.

A race condition between cgroup_writeback_umount() and inode_switch_wbs() in the Linux kernel causes a BUG_ON during filesystem unmount after container exit. This results in busy inodes and potential kernel panic.

In the cpufreq driver for Qualcomm devices, a double free vulnerability was found. The qcom_cpufreq_hw_cpu_exit() function calls kfree() on a pointer to devres-managed memory, which can lead to a double free when the device is detached.