CVE Vulnerability Catalog

In the Linux kernel KVM for x86 Hyper-V, a vulnerability allows out-of-bounds memory read when checking if a virtual processor ID is in a sparse bank set. The bank index is not bounded to the maximum of 64 banks (64 vCPUs each), leading to a use-after-free condition. A malicious Hyper-V guest can exploit this to read kernel memory.

In the Linux kernel, a use-after-free vulnerability was found in the linkstation-poweroff driver's linkstation_poweroff_init() function. Calling of_node_put(dn) before of_match_node() leads to accessing freed memory.

In the Linux kernel, a use-after-free vulnerability was found in the fbdev subsystem's fb_find_mode() function. The mode_option_buf variable is freed before its alias name is no longer used, leading to accessing freed memory.

In the Linux kernel, a vulnerability was found in the ASoC codec simple-mux driver's simple_mux_control_put() function. The bounds check accepts values equal to e->items, while enum values are zero-based, allowing an invalid mux state to be stored.

In the Linux kernel, a double free vulnerability was found in the USB gadget net2280 driver in the probe error path. After calling net2280_remove() and usb_put_gadget(), an explicit kfree(dev) was called, leading to a double free of the same structure.

In the Linux kernel's DAMON sysfs subsystem, a use-after-free vulnerability was found during refresh of tried region directories. Delayed kobj release callback can corrupt the linked list and cause memory corruption.

In the elan_i2c driver for Elan touchpads in the Linux kernel, firmware size validation was missing before use. This could lead to out-of-bounds memory reads.

A bug was found in the Linux kernel's dynamic ftrace trampolines on x86. When CALL_DEPTH_TRACKING is enabled on retbleed-affected platforms (e.g., Skylake), registering a dynamic trampoline causes a page fault and kernel panic on the first call to the traced function. The issue stems from incorrect relocation of %rip-relative addresses for per-CPU variables after copying code from ftrace_regs_caller.

In the Linux kernel, the sched_ext scheduler has a use-after-free (UAF) vulnerability in scx_root_enable_workfn(). The put_task_struct() call is made before scx_error() dereferences p->comm and p->pid, potentially accessing freed memory.

In the Linux kernel, the octeontx2-af CGX driver lacks a bounds check for the cgx_speed_mbps array index. The RESP_LINKSTAT_SPEED function can return values 0-15, but the array has only 13 elements, causing an out-of-bounds read.

In the Linux kernel, the octeontx2-pf driver has a double-free vulnerability in rvu_rep_rsrc_init(). When hardware resource initialization fails, otx2_init_hw_resources() already unwinds partially initialized resources, and then the error path calls otx2_free_hw_resources() again, causing a double free.

In the Linux kernel's mac80211 subsystem, a vulnerability was found involving an out-of-bounds read when parsing negotiated TTLM maps. The bug occurs when the parser advances the cursor for every TID, even if it has no map, potentially reading past the validated element.

In the Linux kernel's octeontx2-pf driver, a double free of pool->stack was detected on AQ init failure. The function otx2_pool_aq_init() frees the memory but does not null the pointer, leading to a second free in the cleanup path.

In the Linux kernel's ti-qspi SPI driver, a use-after-free vulnerability was found after DMA setup failure. The driver falls back to PIO mode but does not clear the DMA channel pointer, potentially leading to use of freed memory.

In the AMD Display driver (drm/amd/display) of the Linux kernel, a stack buffer overflow vulnerability was found in dc_process_dmub_aux_transfer_async. The function copies data into a 16-byte buffer without length checking, and uses link_index without bounds validation.

In the Linux kernel's batman-adv module, a work leak vulnerability was found during backbone_gw purge. The function batadv_bla_purge_backbone_gw() does not wait for or cancel report_work before freeing memory, potentially leading to use-after-free.

In the Linux kernel's netfs subsystem, an overrun vulnerability was found in netfs_extract_user_iter(). If iov_iter_extract_pages() overfills the pages[] array, excess pages may be included in the constructed iterator, leading to memory corruption.

In the Linux kernel, a vulnerability was found in the mlx5e driver for Mellanox network cards, involving unprotected writes to the ICOSQ during CPU affinity changes while NAPI polling is active. Lack of synchronization can lead to queue data corruption and hardware errors.

In the Qualcomm PHY driver (qmp-usbc) in the Linux kernel, an out-of-bounds array access occurs in the DP swing configuration because the boundary check uses "> 4" instead of ">= 4", allowing index 4 to access memory beyond the allocated 4x4 arrays.

In the Linux kernel, the krb5 crypto library and AF_RXRPC lack length checks before decryption/verification. New facilities for pre-checking message length have been added, and AF_RXRPC now validates DATA packets secured with RxGK.