CVE Vulnerability Catalog

In the Linux kernel, a vulnerability in the Bluetooth MGMT module allows an attacker with CAP_NET_ADMIN to trigger an out-of-bounds read by sending a short MGMT_OP_ADD_EXT_ADV_DATA command. The missing length validation can lead to data leakage or system crash.

In the Linux kernel, a vulnerability in the net:devmem mechanism lacks validation of page alignment for dma-buf size and SG segment length. This mismatch can cause out-of-bounds read of the tx_vec array during sendmsg() and desynchronization of num_niovs from the gen_pool region, affecting both RX and TX paths.

A use-after-free vulnerability was found in the Linux kernel's HSR (High-availability Seamless Redundancy) module. Generic-netlink operations running under rcu_read_lock() can access freed memory during HSR interface teardown (RTM_DELLINK) because the node list is removed with plain list_del() and freed immediately, while RCU readers may still hold pointers to those nodes.

In the Linux kernel's IFB driver, a slab-out-of-bounds read vulnerability was found when reporting ethtool stats. The issue occurs when the number of RX queues exceeds TX queues, causing indexing beyond allocated memory and potential data leak.

In the Linux kernel, a double-free vulnerability was found in the qed driver's qed_cxt_tables_alloc() function. When a CID bitmap allocation for PF or VF fails, qed_cid_map_alloc() frees previously allocated bitmaps, and then qed_cxt_tables_alloc() calls qed_cxt_mngr_free(), which frees them again. The fix sets bitmap pointers to NULL after freeing to prevent double free.

In the Linux kernel's mac80211 subsystem, a use-after-free vulnerability was found during mesh frame processing. The issue occurs when ieee80211_invoke_fast_rx() reads RX status via skb->cb, which is later overwritten by ieee80211_rx_mesh_data() with TX data, leading to access to freed or zeroed memory.

In the Linux kernel, the ipv6_hop_ioam() function lacked a NULL check for the pointer returned by __in6_dev_get(). During network interface teardown, this pointer can be NULL, leading to a NULL pointer dereference when processing an IOAM Hop-by-Hop option.

In the Linux kernel, a use-after-free (UAF) vulnerability was found in the vsock/vmci driver during connection handshake. When a peer sends a RST packet during handshake, the driver fails to properly remove the pending socket from the list, leading to double free and access to freed memory.

A vulnerability was found in the Linux kernel's IPv4 raw socket implementation. The raw_send_hdrinc() function fails to reject packets with ihl (Internet Header Length) less than 5, allowing malformed IP headers to be sent. This leads to an out-of-bounds memory access in ah_output() and a kernel panic.

A race condition was found in the Linux kernel's RBD (Ceph RADOS Block Device) driver during image unmap. The lock_dwork work item can be re-queued by maybe_kick_acquire() after cancellation, causing rbd_acquire_lock() to execute after resources are freed, violating an assertion about valid image format.

In the Linux kernel, a vulnerability was found in the LSM (Linux Security Module) mechanism. The lsm_set_self_attr() function does not hold the cred_guard_mutex, which may allow unauthorized changes to process security attributes, especially in the context of SELinux and AppArmor.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's unix_stream_data_wait() function for AF_UNIX sockets. The issue stems from a missing lock when reading the pointer to the last SKB in the receive queue, potentially leading to dereferencing freed memory. The flaw affects kernels from version 6.5 onward.

In the Linux kernel CIFS filesystem, a bug causes a busy dentry to be used after unmounting. The issue occurs when deferred file close work executes after unmount, triggering a warning in generic_shutdown_super.

In the Linux kernel's sev-guest module, a vulnerability was found where pages remain in an unknown state when set_memory_{encrypted,decrypted}() fails. To prevent potential data leaks, these pages are not returned to the buddy allocator but are explicitly leaked via snp_leak_pages().

A use-after-free vulnerability was found in the Linux kernel's ISCI driver during device removal. The completion tasklet is not killed before the controller is torn down, allowing a race between interrupts and memory cleanup. After the ihost structure is freed, a delayed tasklet may still dereference freed memory, leading to a crash or potential exploitation.

In the Linux kernel's DRM V3D driver, a use-after-free vulnerability exists on the error path during CPU job handling. After v3d_job_cleanup() frees the job memory, subsequent reads of timestamp and performance query arrays cause memory corruption. Additionally, a NULL pointer dereference occurs on the early error path.

In the Linux kernel DRM driver for VirtIO, a vulnerability was found where the return value of the DMA reservation lock function (dma_resv_lock_interruptible) is ignored. If interrupted by a signal (-EINTR) or due to memory shortage (-ENOMEM), the lock is not held, leading to a race condition when adding fences and potentially corrupting the fence list.

In the Linux kernel's AMD/Display driver, an out-of-bounds read vulnerability was found. GPIO pin table parsers did not validate whether the declared structure size from VBIOS fits within the available BIOS image, allowing reads beyond its boundaries.

In the Linux kernel, a use-after-free vulnerability was found in the batman-adv module's batadv_mcast_purge_orig() function. It removes entries from RCU-protected hlists without waiting for an RCU grace period, allowing concurrent RCU readers to access freed memory.

In the Linux kernel's batman-adv (BLA) module, a vulnerability was found involving a double decrement of the bla.num_requests counter. The issue stems from non-atomic operations on the counter and the request_sent flag, leading to a race condition and incorrect state.