CVE Vulnerability Catalog

In the Linux kernel, the batman-adv (tp_meter) module had a vulnerability where batadv_tp_sender_cleanup() used an unsafe combination of timer_delete_sync() and timer_delete() to stop a timer. This could lead to the timer being re-armed after cleanup, causing a use-after-free condition.

In the Linux kernel's batman-adv module, a vulnerability was found due to incorrect typing of the `tt_buff_len` field as `s16` instead of `u16`. Values greater than 32767 wrap to negative numbers, causing full buffer allocation but only partial population, leaving the rest uninitialized.

In the Linux kernel's pmbus/adm1266 driver, a buffer overflow vulnerability exists during block read operations. The read_buf declaration was one byte too small, causing out-of-bounds write when handling maximum-length responses (255 bytes + PEC byte).

A buffer overflow vulnerability was found in the pmbus/adm1266 driver of the Linux kernel. The adm1266_nvmem_read_blackbox() function passes a 64-byte buffer to the adm1266_pmbus_block_xfer() helper, which can write up to 255 bytes, causing memory corruption.

In the Linux kernel hwmon (pmbus/adm1266) driver, a vulnerability was found where the wrong constant (ADM1266_PDIO_STATUS instead of ADM1266_PDIO_NR) is used in the PDIO mask scanning loop. This causes out-of-bounds read from the caller's stack and potential out-of-bounds write to the bits array, leading to memory corruption.

In the Linux kernel for RISC-V, an uninitialized stack variable 'cregs' causes register corruption. Functions compat_riscv_gpr_set() and compat_restore_sigcontext() call cregs_to_regs() even after a failed user-space copy, writing uninitialized stack data into the target task's pt_regs.

In the Linux kernel, a vulnerability was found in the ARM FF-A driver due to missing validation of the framework notification message layout. Incorrect offset and size values can lead to out-of-bounds reads or oversized memory allocations.

In the Linux kernel netfilter/x_tables subsystem, a new function xtables_unregister_table_exit was added to replace xt_unregister_table(). This fixes an issue where during module removal (rmmod), users performing set/getsockopt could not re-instantiate the table because the larval table was already removed and the existing instance was no longer on the active table list.

In the Linux kernel, the netfilter ebtables module introduces a two-stage removal scheme to prevent a race condition during table operation assignment. The table->ops assignment is now performed while holding the ebt mutex, avoiding exposure of a partially filled table structure.

A race condition vulnerability was found in the Linux kernel's netfilter bridge eb_tables module during initialization. The sockopt registration occurs too early, before the module initialization is complete, exposing partially initialized structures globally.

In the Linux kernel, unregister_fprobe() lacked RCU grace period synchronization, potentially causing use-after-free after fprobe unregistration. This affects fprobe events and sample module code.

A vulnerability in the Linux kernel's statmount_mnt_idmap function can cause an out-of-bounds write on the seq buffer. The issue occurs because manual increment of seq->count after seq_printf() bypasses overflow detection, leading to a NULL byte write beyond the allocated buffer.

In the Linux kernel on PREEMPT_RT, a use-after-free vulnerability was found in irq_work_single(). After clearing the BUSY flag via atomic_cmpxchg(), the code still dereferences the work structure, which can be freed prematurely by another thread calling irq_work_sync().

In the Linux kernel, the nvme-pci driver has a use-after-free vulnerability in nvme_free_host_mem(). After freeing memory via dma_free_noncontiguous(), the dev->hmb_sgt pointer is not cleared, leading to a double-free and NULL pointer dereference when the function is called twice in an error path.

In the Linux kernel netfs subsystem, a vulnerability was found where streaming writes could be overwritten incorrectly. When a partially written streaming write page was fully overwritten, the netfs_folio structure was not freed, leading to data corruption. The fix properly manages the netfs_folio structure and handles partial copy failures.

In the Linux kernel, the netfs_read_folio() function fails to wait for ongoing writeback to complete. This can lead to data corruption because the function trusts the dirty flag and folio->private data, which may be cleaned up before the writeback flag is cleared.

In the Linux kernel, the AFS filesystem has a vulnerability due to incorrect locking when handling symbolic links. This allows races between multiple get_link() calls, potentially leading to memory leaks or incorrect symlink content reads.

In the Linux kernel, a vulnerability was found in the net shaper mechanism. The net_shaper_nl_group_doit() function does not deduplicate NET_SHAPER_A_LEAVES entries, causing a double free of the same parent pointer in the cleanup loop. This occurs when userspace supplies the same leaf handle twice.

In the Linux kernel, a vulnerability was found in bio_integrity_copy_user() where overwriting bip_vcnt with nr_vecs breaks the bip_vcnt <= bip_max_vcnt invariant. On WRITE this causes out-of-bounds read of the bip_vec[] flex array, and on READ it reads incorrect data.

In the Linux kernel, the accel/qaic driver lacks an overflow check in remap_pfn_range during mmap, allowing a buffer object (BO) that is too large to map beyond the VMA region. This can cause use-after-free issues when munmap() unmaps only the VMA region.