CVE Vulnerability Catalog

In the Linux kernel, the elliptic curve cryptography (ECC) implementation has a vulnerability due to a carry overflow bug in vli multiplication. The condition checking for overflow does not handle the case where r01.m_high is saturated (0xFFFFFFFFFFFFFFFF) and an additional carry exists from lower bits.

In the Linux kernel's pcrypt crypto subsystem, a bug was found where the original callback was not restored when falling back to direct AEAD invocation. As a result, an asynchronous completion could run the padata callback even though the request was never submitted to padata.

In the Linux kernel, the loongson-rng driver was removed due to multiple vulnerabilities, including lack of forward security and a use-after-free bug. The driver was unused and had no real purpose in the kernel.

In the Linux kernel's QAT (Intel) crypto driver, a synchronization bug was fixed where iterations over the service_table list were not protected by the service_lock. This could lead to list corruption or a use-after-free bug during concurrent service registration/removal operations.

In the Linux kernel's QAT (Intel) crypto driver, a bug was fixed where the lengths of CRT components (p, q, dp, dq, qinv) were not validated in qat_rsa_setkey_crt(). Overly long components could cause a DMA buffer overflow and memory corruption.

In the Linux kernel's perf/aux subsystem, a use-after-free vulnerability exists in map_range(). Two events sharing the same ring buffer can race between allocation and page mapping, leading to use of a freed physical page.

In the Linux kernel's tracing subsystem, an out-of-bounds read exists in glob matching. The regex_match_glob() function ignores field length and scans until a NUL byte, causing reads beyond buffer boundaries for non-NUL-terminated fields (e.g., dynamic char arrays in xfs tracepoints).

In the Linux kernel's NFSv4 client, an access authorization flaw exists for O_TRUNC operations. The nfs_open_permission_mask() function does not include O_TRUNC in the permission mask, allowing local file open with read-only mode and simultaneous truncation, violating POSIX.

In the Linux kernel's exfat filesystem, an out-of-bounds read/write exists in exfat_find_dir_entry(). When processing directory entries with short name fragments, the uniname pointer advances by a fixed amount while name_len grows slower, allowing writes beyond the p_uniname->name buffer.

In the Linux kernel's iommufd subsystem, a bug exists in iommufd_veventq_fops_read(). The bound check for the normal vEVENT path uses sizeof(hdr) instead of sizeof(*hdr), causing an undercount on 32-bit architectures and writing past the user-supplied buffer.

In the Linux kernel KVM for ARM64, a vulnerability was found due to missing clamping of used_lrs when copying vGIC state to the pKVM hypervisor. The host can provide a value exceeding the number of implemented list registers, leading to out-of-bounds access at EL2.

In the Linux kernel KVM for ARM64, a vulnerability was found due to not clearing __hyp_running_vcpu when copying vCPU context to the pKVM hypervisor. The host can provide a value that is then dereferenced at EL2.

In the Linux kernel KVM for x86, a vulnerability was found where fastpath userspace exits are handled before vendor-specific code runs. This can lead to missing operations such as flushing the PML buffer before returning control to userspace.

In the Linux kernel KVM guest_memfd component, a vulnerability was found where the memslot binding offset and size are treated as signed values instead of unsigned. This causes a false negative in overflow checking of offset+size against the file size, potentially allowing an absurdly large offset.

In the Linux kernel, a vulnerability in the svcrdma component causes threads waiting in svc_rdma_sq_wait() to hang indefinitely in TASK_UNINTERRUPTIBLE state during transport close. The lack of explicit wake-up prevents threads from checking the XPT_CLOSE flag, blocking svc_rdma_free() and resource release.

In the FPGA DFL-AFU driver, DMA mapping length from userspace via the DFL_FPGA_PORT_DMA_MAP ioctl is not validated. A large value can cause implicit truncation to int, leading to a buffer overflow.

In the Linux kernel I2C subsystem, there is a race during adapter deregistration. An adapter can be looked up via i2c_get_adapter() after its resources have been freed, leading to a use-after-free.

In the Synaptics RMI4 (F3A) driver, the keymap is allocated for at most 6 entries, but the GPIO count (0-127) is not bounded. A device with gpio_count > 6 causes out-of-bounds read in the interrupt and via EVIOCGKEYCODE/EVIOCSKEYCODE ioctls, potentially leaking adjacent slab memory to userspace.

In the Synaptics RMI4 (F30) driver, the keymap is allocated for at most 6 entries, but the GPIO/LED count (0-31) is not bounded. A device with gpioled_count > 6 causes out-of-bounds read in the interrupt and via EVIOCGKEYCODE/EVIOCSKEYCODE ioctls, potentially leaking adjacent slab memory to userspace.

In the Goodix touchscreen driver, the contact count reported by the device is not clamped. The max_touch_num value (0-15) is taken from configuration without clamping, which can lead to a stack out-of-bounds write in goodix_ts_read_input_report() when touch_num > 10.