CVE Vulnerability Catalog

In the Linux kernel, a vulnerability in the netfilter nft_meta_bridge module causes the IIFHWADDR register to declare 8 bytes but copy only 6 bytes of MAC address, leaving 2 bytes uninitialized on the stack. This can leak stack data to userspace.

A shared memory (shm) leak was found in the register_shm_helper() function of the TEE driver in the Linux kernel. When iov_iter_npages() returns 0, the function jumps to err_ctx_put, skipping the deallocation of previously allocated shm. The issue can be triggered by TEE_IOC_SHM_REGISTER with zero data length.

A vulnerability was found in the Linux kernel's Bluetooth stack where hci_adv_bcast_annoucement() can cause a temporary buffer overflow when preparing Broadcast Announcement data. The issue occurs when existing advertising instances already hold the maximum extended advertising payload, and prepending service data exceeds the buffer capacity.

In the Linux kernel's Bluetooth L2CAP subsystem, a vulnerability allows an unauthenticated BR/EDR peer within radio range to send a signaling packet larger than the allowed MTU (MTUsig). Such a packet can contain multiple ECHO_REQ commands, forcing the target device to send many ECHO_RSP responses, potentially leading to overload.

A deadlock vulnerability (AA deadlock) was found in the Linux kernel's memory failure handling. Two concurrent madvise(MADV_HWPOISON) calls on the same hugetlb page can cause a recursive spinlock self-deadlock on hugetlb_lock when racing with a concurrent unmap.

In the Linux kernel, the accel/ivpu driver now validates firmware runtime memory bounds. Missing bounds check could cause memory allocation and image transfer errors.

In the Linux kernel, the accel/ivpu driver now validates firmware log buffer read/write indices against buffer size. Missing bounds checks could allow out-of-bounds memory access when firmware supplies invalid indices.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the stratix10-rsu driver. The issue occurs when rsu_send_msg() returns -ETIMEDOUT and the code continues processing on a channel whose scl structure has already been cleared, leading to a NULL dereference in the svc kthread.

In the Linux kernel, a buffer overflow check was added in the accel/ivpu driver's get_info_ioctl function. Missing validation of the size returned by firmware could lead to copying data beyond the allocated buffer.

In the Linux kernel, the accel/ivpu driver has a vulnerability in IPC receive due to signed integer truncation. Large unsigned values (>= 0x80000000) from firmware are cast to signed int, causing negative values and stack buffer overflow during memcpy.

In the Linux kernel, an optimization that skipped exec queue schedule toggle during suspend was reverted because it bypassed GuC suspend, preventing context switch TLB flush for invalidated userptr VMAs. This caused page faults in userptr invalidation tests in LR/preempt-fence VM mode.

A vulnerability was found in the Linux kernel's KVM for ARM64, affecting the handling of the XN[0] bit when FEAT_XNX is not supported. The bug incorrectly uses FIELD_PREP() on the mask that clears XN[0], unconditionally granting execute permissions.

In the Linux kernel, the hv_netvsc driver used phys_to_virt() for mapping memory pages, which on 32-bit x86 with CONFIG_HIGHMEM=y causes memory access faults and system crashes. The fix replaces phys_to_virt() with kmap_local_page() to correctly handle pages outside the kernel direct map.

In the Linux kernel, a use-after-free vulnerability was found in ksmbd related to a deferred file_lock during double SMB2_CANCEL. A second cancel for the same AsyncId triggers the cancel callback on already freed memory, leading to a security breach.

An ABBA deadlock was found in the Linux kernel's iptfs_destroy_state() function in the IPTFS (IPsec) implementation. The issue occurs when the function calls hrtimer_cancel() while holding a spinlock also required by the timer callback, leading to a deadlock on SMP systems.

A heap overflow vulnerability was found in the io_ti USB serial driver in the Linux kernel. The get_manuf_info() function reads a Size field from the USB device that can be set up to 16377 bytes, while the destination buffer is only 10 bytes, causing a heap overflow of up to 16367 bytes. The fix adds validation of the descriptor length before reading.

In the Linux kernel, a vulnerability in the USB serial io_ti driver was found where build_i2c_fw_hdr() allocates a fixed-size buffer but copies user-controlled length data (up to 65535 bytes) without validation, causing a heap overflow.

A buffer overflow vulnerability was found in the kl5kusb105 USB serial driver in the Linux kernel. The klsi_105_prepare_write_buffer() function copies data from the fifo into a 64-byte buffer without accounting for the two-byte header, causing an out-of-bounds write. The issue was observed by KASAN during device emulation.

In the Linux kernel, a use-after-free vulnerability was found in the ALSA timer subsystem. When a timer object is freed via snd_timer_free, slave timer instances still point to the freed object, leading to potential memory corruption. The bug is easily triggered with the new userspace-driven timers (CONFIG_SND_UTIMER).

A use-after-free (UAF) vulnerability was found in the snd_timer_user_params() function of the ALSA driver in the Linux kernel. The issue occurs when a user timer (CONFIG_SND_UTIMER) is being closed while another thread concurrently executes the SNDRV_TIMER_IOCTL_PARAMS ioctl, which was not protected by the register_mutex. The patch adds the missing synchronization to prevent the race condition.