CVE Vulnerability Catalog

A vulnerability in the Linux kernel's USB hub driver allows a non-compliant USB device with more than one configuration or interface to cause usb_hub_to_struct_hub() to dereference a NULL or inappropriate pointer. This leads to a general protection fault and potential kernel panic. The issue is resolved by rejecting such non-compliant devices.

In the Linux kernel, a bug was fixed in rpl, seg6 and ioam6 lwtunnels where packets could create circular references in the dst cache, preventing the lwtunnel state from being freed. This led to a memory leak.

In the Linux kernel, clocksource_verify_choose_cpus() called get_random_u32() with preemption disabled, which on PREEMPT_RT kernels triggered a "sleeping function called from invalid context" bug due to sleeping locks. The fix uses migrate_disable() instead of preempt_disable() to safely use smp_processor_id() without entering atomic context.

A flaw was found in the Linux kernel's btrfs subsystem where btrfs_set_item_key_safe() was used to modify keys in the RAID stripe-tree, potentially corrupting the tree and triggering a kernel BUG during RAID extent operations. The issue was fixed by using btrfs_duplicate_item() to copy the item and safely adjust both the key and per-device physical addresses.

In the Linux kernel, a subsystem refcount leakage of the @block_class was discovered in the blkcg_fill_root_iostats() function. The function iterates over devices using class_dev_iter_(init|next)() but does not end the iteration with class_dev_iter_exit(), causing a refcount leak.

In the Linux kernel, a vulnerability was resolved in the brcmfmac Wi-Fi driver regarding a NULL pointer dereference in brcmf_txfinalize(). During device removal or module unloading, a NULL pointer dereference can occur if a flowring still has an skb. All uses of the ifp pointer have been guarded with an early return if ifp is NULL.

In the Linux kernel, a race condition exists in the RDMA/mlx5 driver during ODP MR deregistration. Concurrent invalidation of a range for an already freed lkey can trigger a CQE error and put the UMR QP into an error state.

In the Linux kernel HID multitouch driver (mt_input_configured), the return value of devm_kasprintf() is not checked. This can lead to a NULL pointer dereference when memory allocation fails.

In the Linux kernel, a signed integer overflow occurs when defining LOG_BUF_LEN_MAX. Shifting 1 << 31 on a 32-bit int causes undefined behavior.

In the Linux kernel, the safesetid module lacked size validation for data written to sysfs. An attacker could send an oversized buffer, triggering a warning in kmalloc and potentially destabilizing the system.

In the Linux kernel sound subsystem (ASoC: SOF: Intel: hda-dai), setting DAI parameters may cause a NULL pointer dereference if the topology does not create the correct number of DAI widgets for aggregated amps. The fix adds a validity check for the DAI widget associated with the CPU DAI.

In the Linux kernel, the int3472 driver for x86 platforms lacked a check for a NULL adev (ACPI device) pointer. This could theoretically occur when a user manually binds the driver to an i2c/platform device via sysfs, leading to a possible NULL pointer dereference in skl_int3472_get_acpi_buffer().

In the Linux kernel, the Bluetooth L2CAP subsystem's l2cap_sock_alloc() can receive a NULL sock pointer when called from l2cap_sock_new_connection_cb(). Error handling paths do not check for this, leading to potential NULL dereference.

In the Linux kernel TPM module (eventlog/acpi.c), a bug caused ACPI to point to a 16 MiB buffer for log events, triggering a warning in __alloc_pages_noprof(). The vulnerability was fixed by replacing devm_kmalloc() with devm_add_action() and kvmalloc().

In the Linux kernel, a vulnerability was resolved in firmware: qcom: scm: smc: handling missing SCM device. Since qcom_scm_get_tzmem_pool() can return NULL, its users should handle this case.

In the Linux kernel, the BPF subsystem's bpf_send_signal() kfunc can be called in non-preemptible contexts, causing issues because it can sleep. The fix changes irqs_disabled() to !preemptible().

In the Linux kernel scsi: mpi3mr driver, if bsg_setup_queue() fails, the bsg_queue pointer is assigned a non-NULL value, preventing bsg_remove_queue() from being called and leading to a NULL pointer dereference during driver removal. The fix ensures proper cleanup on failure.

In the Linux kernel, a vulnerability exists in vxlan_vnifilter_dump() where it accesses bytes beyond the netlink message payload if the payload is shorter than sizeof(struct tunnel_msg). This can lead to an uninitialized value access. The fix returns an error in such cases.

In the Linux kernel, the rtl8150 USB network driver uses an incorrect USB endpoint type when submitting URBs, triggering a kernel warning and potential network interface disruption. The fix adds basic endpoint type checking (bulk and interrupt) to mitigate the issue.

A vulnerability was found in the Linux kernel's MPTCP (MultiPath TCP) subsystem related to the in-kernel path manager. The function setting the 'fullmesh' flag on endpoints was too permissive, allowing this flag to be set on implicit endpoints, which triggered a kernel warning and could lead to system instability.