CVE Vulnerability Catalog

A race condition in the Linux kernel's dquot_scan_active() function during quota deactivation was discovered. Under memory pressure, it can lead to use-after-free, causing system instability.

In the Linux kernel, a vulnerability in the soc/tegra: cbb driver uses incorrect ARRAY_SIZE in fabric lookup tables, potentially causing out-of-bounds access during target timeout lookup.

In the Linux kernel, a bug was found in the OCFS2 filesystem's listxattr() function. When an inode has both inline and block-based extended attributes and the inline names exactly fill the caller's buffer, the function may return a size larger than the buffer, causing a kernel panic (BUG).

In the Linux kernel, a vulnerability in the OCFS2 filesystem lacks validation of the bg_bits field during freefrag scan in the non-coherent path (OCFS2_INFO_FL_NON_COHERENT). A crafted filesystem can cause an out-of-bounds memory read (use-after-free) when processing the OCFS2_IOC_INFO ioctl.

In the Linux kernel, an off-by-one error was found in the check_imm function used by the ARM64 BPF JIT to validate immediate values for conditional and unconditional branches. The flaw allows values one bit wider than the signed N-bit field can hold, potentially causing incorrect instruction encoding and reversing branch direction.

A race condition in the Linux kernel's BPF sockmap for af_unix sockets causes a use-after-free when a BPF iterator updates a sockmap. The fix adds a state lock to ensure socket stability during the update.

A vulnerability was found in the Linux kernel in the arena_alloc_pages() function within the BPF subsystem. The function accepts a node_id as a plain int and forwards it through the allocation chain without any bounds checking.

In the Linux kernel NFSD subsystem, a bug in nfsd4_add_rdaccess_to_wrdeleg causes an extra increment of the nfs4_file access count when fp->fi_fds[O_RDONLY] is already set by another thread. This prevents the nfsd_file object from being freed, leading to a BUG in kmem_cache_destroy() when stopping the nfs-server service.

A use-after-free vulnerability was found in the Linux kernel's greybus raw driver. It occurs when a raw bundle is disconnected while an application still has its character device (cdev) open. When the application closes the file, it accesses freed memory, causing a kernel panic.

A use-after-free vulnerability was found in the Linux kernel's Greybus RAW driver. If a user writes to the character device after disconnect has been called, a NULL pointer dereference occurs causing a kernel panic. The issue is due to missing synchronization between write operations and connection destruction.

A potential race condition was found in the Linux kernel during TLB synchronization. The issue arises from missing page table lock while traversing and modifying page tables. The fix disables split page table lock for simplicity.

In the Linux kernel, the CCP (crypto: ccp) subsystem has a vulnerability where the IV buffer is overwritten during AES encryption in RFC3686 mode. The ccp_aes_complete() function restored 16 bytes (AES_BLOCK_SIZE) to the IV buffer, while the RFC3686 algorithm uses only an 8-byte IV, causing a buffer overrun.

In the Linux kernel, a use-after-free vulnerability was found in the taprio network scheduler's advance_sched() function during schedule switching. After switch_schedules() is called, the old oper schedule is freed via call_rcu(), but the 'next' pointer still points to an entry in the old schedule, causing a use-after-free.

A double-free vulnerability was found in the Intel ice network driver's ice_xmit_frame_ring() function. When ice_tso() or ice_tx_csum() fails, the skb is freed but the tx_buf pointer remains set, leading to a second free during transmit queue cleanup.

A vulnerability was found in the Linux kernel's SOCKMAP mechanism for AF_UNIX sockets. SOCKMAP can hide an inflight file descriptor from the garbage collector (GC), leading to memory leaks and potential use-after-free. An attacker could exploit this to escalate privileges or destabilize the system.

A vulnerability in the Linux kernel's sctp_getsockopt_peer_auth_chunks function fails to properly validate the user buffer size before writing data. Missing the 8-byte header of the sctp_authchunks structure leads to an out-of-bounds write that can overwrite adjacent user data.

A vulnerability in the Linux kernel's PPPoE driver allows dropping frames with Protocol Field Compression (PFC). An attacker can send a crafted frame with a 1-byte protocol field, shifting the payload by one byte and potentially causing unaligned access exceptions on some architectures.

In the Linux kernel's netfilter/nat subsystem, a vulnerability was found where NAT hook registration structures (ops) were not freed using kfree_rcu. This can cause use-after-free when userspace dumps active hooks via nfnetlink_hook (introduced in v5.14).

In the Linux kernel, a vulnerability was found in the netfilter nfnetlink_osf module, where the nf_osf_ttl() function accessed skb->dev without verifying the device pointer, potentially causing a NULL pointer dereference. The TTL check logic also incorrectly assumed packets from the same subnet would not have a decremented TTL, which is false in container and virtual switching environments.

In the Linux kernel, a vulnerability in the ADFS filesystem lacks validation of the zone count (nzones) in adfs_validate_bblk(), leading to an out-of-bounds write. A crafted disk image with zero zones triggers kmalloc_array(0, ...) returning ZERO_SIZE_PTR, followed by a write before the allocated buffer.