CVE Vulnerability Catalog

An unsigned integer overflow (u32) was found in the check_and_correct_requested_length function in HFS and HFSPlus filesystems in the Linux kernel. A large len value can wrap the off+len sum, bypassing bounds checking and leading to out-of-bounds buffer read.

In the Linux kernel BTF parser, the btf_repeat_fields() function performs field count calculations in u32 arithmetic, which can wrap with malicious BTF. This bypasses capacity checks and leads to out-of-bounds write to the scratch array. The fix uses checked addition and multiplication.

A vulnerability was found in the Linux kernel's LPM trie map implementation in BPF, causing false lockdep warnings when sleepable BPF programs were executed. The issue involved incorrect RCU usage in trie_lookup_elem, trie_update_elem, and trie_delete_elem functions, which did not account for the rcu_read_lock_trace() context.

In the Linux kernel's EHCI and FOTG210 USB drivers, there is a memory leak on failed isochronous submits. When a submit fails before linking the URB to the queue, the staged schedule (ehci_iso_sched) remains in urb->hcpriv and is not freed.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's USB gadget subsystem. The issue occurs when gadget_match_driver() accesses freed udc structure memory, potentially leading to a NULL pointer dereference and system crash.

In the Linux kernel's idmouse USB driver, there is a use-after-free vulnerability on disconnect race. The mutex_unlock() function may access the mutex structure after releasing the lock, leading to use-after-free when release() races with disconnect().

In the Linux kernel's ldusb USB driver, there is a use-after-free vulnerability on disconnect race. The mutex_unlock() function may access the mutex structure after releasing the lock, leading to use-after-free when release() races with disconnect().

In the Linux kernel, the USB iowarrior driver has a use-after-free vulnerability on disconnect. Submitted write URBs are not stopped on close(), so they must be stopped unconditionally on disconnect() to prevent use-after-free in the completion handler.

In the Linux kernel, the USB iowarrior driver has a use-after-free vulnerability on disconnect race. mutex_unlock() may access the mutex structure after releasing the lock, so a kref is used to release driver data to avoid use-after-free in mutex_unlock() when release() races with disconnect().

In the Linux kernel, the USB legousbtower driver has a use-after-free vulnerability on disconnect race. mutex_unlock() may access the mutex structure after releasing the lock, so a kref is used to release driver data to avoid use-after-free in mutex_unlock() when release() races with disconnect().

In the Linux kernel, the usbio driver (usb: misc) has a slab-out-of-bounds read vulnerability. The usbio_bulk_msg() function copies data with a device-controlled length but checks it only against the transmit buffer (txbuf), not the receive buffer (rxbuf). A malicious USB device can exploit this mismatch to disclose adjacent kernel memory.

In the Linux kernel, the USB serial digi_acceleport driver has a write buffer corruption vulnerability. The digi_write_inb_command() function should wait for the write urb to become available or return an error, but on timeout it updates the transfer buffer and tries to resubmit the urb. Additionally, for commands without timeout, corruption occurs immediately due to a broken jiffies comparison. The fix adds the missing return on timeout and waits indefinitely when no timeout is specified.

Missing SVID index validation in the Linux kernel's USB Type-C TCPM driver in svdm_consume_modes(). An invalid index can cause an out-of-bounds read and registration of a fake SVID.

A use-after-free bug in the Linux kernel's USB Type-C UCSI CCG driver on device removal. The interrupt handler may access the already freed ucsi structure.

Missing block extent validation in the Linux kernel's UDF filesystem in udf_free_blocks(). Out-of-bounds access to the space bitmap array can cause a kernel panic.

Missing VAT header length validation against the VAT inode size in the Linux kernel's UDF filesystem. This can lead to out-of-bounds read and potential kernel panic.

In the Linux kernel, the UDF filesystem has a vulnerability due to incorrect validation of the sparing table length. The function treats reallocationTableLen as a byte count, while it is actually a count of 8-byte entries, leading to out-of-bounds memory access.

In the Linux kernel, the AIX partition parser has a vulnerability due to missing bounds on the ppe array scan. The pp_count field from disk can be larger than 1016, leading to out-of-bounds read beyond the allocated buffer.

In the Linux kernel's isofs filesystem, a vulnerability was found in the handling of Rock Ridge symbolic links. An attacker can craft an ISO image that triggers an out-of-bounds read of up to 255 bytes of kernel memory, which is then copied to user space via readlink().

In the Linux kernel, the CAAM cryptographic driver has a vulnerability where sensitive key material is leaked via hex dumps in *_setkey() functions. Using print_hex_dump() without guard can expose keys in logs when CONFIG_DYNAMIC_DEBUG is enabled.