CVE Vulnerability Catalog

In the Linux kernel Bluetooth hci_sock: rebinding an HCI socket after its controller is unregistered can race with monitor control replay. hci_sock_bind() clears the hdev pointer and drops the reference under only the socket lock, while send_monitor_control_replay() reads under hci_sk_list.lock, leading to a NULL dereference or use-after-free. The fix takes hci_sk_list.lock for writing when clearing the pointer and resetting socket state.

In the Linux kernel, hci_le_set_ext_scan_param_sync() during PA sync scan setup suffers from a use-after-free. The address pointer is obtained from hci_sent_cmd_data() without holding a reference to the skb, and the concurrent hci_cmd_work() can free and replace that skb before the address is dereferenced. The fix serializes access to sent_cmd and req_skb using hdev->lock and copies the address before releasing the lock.

A flaw was fixed in the Linux kernel Bluetooth ISO handling where concurrent listen() calls on the same broadcast socket could overwrite the connection pointer and leak a reference. This could lead to a use-after-free when later events access the stale socket, as confirmed by a KASAN report.

In the Linux kernel, Bluetooth ISO iso_sock_connect() checks socket state before taking the socket lock and drops the lock before setting up a connection, allowing two concurrent callers to pass the admission check. This can overwrite the socket destination, leak references, and cause a use-after-free, as reported by KASAN in iso_sock_hold().

In the Linux kernel Bluetooth SCO handling, a race existed between the receive path (sco_recv_scodata) and sco_conn teardown, leading to a use-after-free. The hcon->sco_data pointer was cleared without holding hdev->lock, so the RX path could call kref_get_unless_zero() on an already freed sco_conn. The fix gives the pointer a real reference and serialises its clearing under hdev->lock.

In the Linux kernel, the Bluetooth RFCOMM implementation leaks an skb in rfcomm_recv_data() when the DLC has no owner. The socket implementation returns without freeing the skb, whereas the tty implementation frees it correctly. The leak grows continuously because the remote keeps receiving credits and sending data frames.

In the Linux kernel Bluetooth RFCOMM subsystem, an AB/BA deadlock exists between rfcomm_mutex and hdev->lock. An RFCOMM connect() issued while a BR/EDR link is being authenticated can trigger a circular locking dependency, potentially causing a deadlock. The fix connects the session socket without holding rfcomm_mutex and adds the session to the list afterwards.

In the Linux kernel, the Bluetooth RFCOMM driver has a NULL dereference in rfcomm_dev_shutdown() when an RFCOMM tty is closed. If tty device registration in rfcomm_dev_add() fails, dev->tty_dev is never set, and the shutdown function uses it without checking.

In the Linux kernel, drm/fb-helper has an issue when drm_fb_helper_single_fb_probe() fails with an error other than -EAGAIN. In that case fb_helper->deferred_setup is not set, and a later .restore() call commits a stale mode_set with fb == NULL, triggering WARN_ON(!set->fb).

In the Linux kernel, drm/i915/gem's eb_relocate_parse_slow() can call kvfree() on entries outside the original exec array. This happens because eb_parse() increments eb->buffer_count after appending VMAs, and cleanup uses the incremented count to release relocation pointers.

In the Linux kernel's drm/i915/gt component, a race exists between intel_rps_boost() reading a stale ACTIVE state and queuing rps->work. This can cause rps_work() to run after the GT has been parked and unmask RPS PM interrupts without holding the PM wakelock, triggering an "RPM wakelock ref not held during HW access" message and tainting the kernel.

In the Linux kernel, drm/imagination page table preallocation is incorrectly sized from device_addr + sgt_offset with an exclusive end. This allocates one table too many and can underflow index differences when crossing a page table boundary, leading to huge preallocation and memory exhaustion.

In the Linux kernel, drm/panthor's panthor_ioctl_group_create() validates the queue count against the hardcoded MAX_CS_PER_CSG rather than the firmware-reported slot count. If firmware reports fewer slots, unprivileged userspace can request more queues, leading to use of an uninitialized stream interface and a potential crash.

In the Linux kernel, drm/vmwgfx lacks validation of the pitch coming from userspace before copying data from the underlying surface. This can lead to out-of-bounds reads during cursor snooping.

In the Linux kernel's drm/xe/i2c component, xe_i2c_remove() did not cancel or drain the scheduled i2c->work before unregistering the adapter and client devices. A work item still queued or running could dereference the released adapter or freed xe_i2c memory, causing a use-after-free. The fix moves bus notifier unregistration before client teardown and cancels the work right after it.

In the Linux kernel, the drm/xe driver has a shrinker accounting bug with nested external buffer pins (dma-buf). The functions xe_bo_pin_external() and xe_bo_unpin_external() support nested pins, but the calls to xe_ttm_tt_account_subtract() and xe_ttm_tt_account_add() are invoked unconditionally on every call, instead of only on the transition into and out of the pinned state. This causes repeated subtraction of the buffer's pages from the shrinker's accounting, leading to an underflow and an inflated count of reclaimable pages, resulting in excessive shrinker invocation under memory pressure.

In the Linux kernel's drm/xe subsystem, a stale pinned_link entry is left when framebuffer pinning performs the final unpin. This leaves a list entry pointing into freed memory, risking list corruption and a use-after-free on subsequent list walks or splices.

In the Linux kernel, the th1520-dw-hdmi drm/bridge driver's th1520_dw_hdmi_remove() read the platform drvdata back as struct dw_hdmi * instead of struct th1520_hdmi *, passing the wrong pointer to dw_hdmi_remove(). As a result, teardown ran on an incorrect object.

In the Linux kernel, the drm/amdgpu/userq amdgpu_userq_get_doorbell_index() pinned any BO passed as doorbell_handle into the doorbell domain. For a regular BO, TTM moved it with ttm_bo_move_null() and its contents were lost, allowing a client to corrupt a buffer shared with another client on the same device.

A flaw was fixed in the Linux kernel's propagate_mount_busy() function, which failed to properly check mount copies with multiple children or a single child that is not an overmount. As a result, a synchronous unmount could succeed while the mount was still in use, detaching an active mount. The issue affected mount namespaces and could be triggered by a container.