CVE Vulnerability Catalog

A use-after-free vulnerability was found in the Linux kernel's virt: acrn module during eventfd shutdown. A race between acrn_irqfd_deassign() and the EPOLLHUP wakeup can free the same hsm_irqfd structure twice, allowing an attacker to exploit a dangling pointer. The issue was fixed by adopting the KVM irqfd lifetime model.

In the Linux kernel, the iwlwifi driver (MLD mode) has a vulnerability causing a kernel panic during failed reconfiguration after a NIC error. The issue stems from processing asynchronous notifications from dead firmware that reference freed memory (dangling pointer). The fix purges notifications immediately upon NIC error notification.

In the Linux kernel, the ACPICA component fixes a use-after-free in acpi_ds_terminate_control_method() by clearing references to method locals and arguments. The flaw could lead to use of freed memory.

In the Linux kernel, the ACPICA component adds boundary checks in acpi_ps_get_next_field() to prevent out-of-bounds access. The flaw could lead to reading or writing outside the allowed memory region.

In the Linux kernel, the ACPICA component prevents adding invalid references for local, argument, and debug objects in acpi_ut_copy_simple_object(). The flaw could lead to an invalid internal state of the ACPI interpreter.

An integer overflow exists in the Linux kernel's ACPICA function acpi_ex_opcode_3A_1T_1R() (mid_op). Missing overflow check for Index + Length can result in a negative size being passed to memcpy().

In the Linux kernel, ACPICA lacks validation of handler object type in acpi_ev_has_default_handler() and acpi_ev_find_region_handler(). This may allow improper operations on handler objects.

In the Linux kernel, ACPICA lacks validation for node in acpi_ns_build_normalized_path(). This may lead to use-after-free vulnerabilities.

In the Linux kernel, a vulnerability in ACPICA was fixed by enhancing buffer validation in acpi_ut_walk_aml_resources(). Insufficient checks could lead to buffer overflows.

In the Linux kernel, a vulnerability in ACPICA was fixed by adding boundary checks in acpi_ps_get_next_namestring() and acpi_ps_peek_opcode(). Missing checks could lead to out-of-bounds access.

In the Linux kernel, a vulnerability in the ath11k wifi driver was fixed where in certain cases hardware could provide packets with a length greater than the maximum native Wi-Fi header length. This could lead to invalid data access and memory corruption in ath11k_dp_rx_h_undecap_nwifi().

A vulnerability was found in the Linux kernel's fs/ntfs3 module due to missing validation of index entry key bounds. A malformed NTFS directory index entry can advertise a key_size larger than the bytes actually present in its payload, causing an out-of-bounds read in cmp_fnames().

In the Linux kernel, a vulnerability in ntfs3 was fixed involving out-of-bounds read in ntfs_dir_emit() and hdr_find_e(). The bounds check in ntfs_dir_emit() did not account for UTF-16LE encoding (2 bytes per character) or the ATTR_FILE_NAME header size, allowing reads past the entry boundary.

In the Linux kernel, the NVMe driver lacks validation of descriptor sizes while walking the FDP configurations log. A descriptor with dsze == 0 or one past the log end can cause unbounded iteration or reads past the buffer.

In the Linux kernel, the drm/amdkfd driver's wait_on_destroy_queue() drops locks to wait for queue resume, allowing a concurrent destroy to free the queue and cause a use-after-free (UAF).

In the Linux kernel, the drm/amdgpu driver's FRU PIA parsing uses an open-coded TLV walk without read bounds. Replacing it with fru_pia_advance() and fru_pia_copy_field() helpers bounds every read by the actual EEPROM data length.

In the Linux kernel, the ib_umem_find_best_pgsz() function has boundary condition issues, especially on 32-bit architectures. The iova value may be truncated, and lengths greater than 4GB can overflow. The fix uses proper u64 arguments and adds necessary checks.

In the Linux kernel, the netfilter nf_conntrack module has an alignment issue in the tcp_sack() function. The timestamp-only fast path dereferences the option stream as a __be32 value, assuming 4-byte alignment that TCP options do not guarantee. Using get_unaligned_be32() is safer.

In the Linux kernel, the btrfs tree-checker did not validate names in ROOT_REF and ROOT_BACKREF items. A corrupted item could cause readers to use the on-disk name length directly, leading to out-of-bounds reads and copying too many bytes into the UAPI buffer in BTRFS_IOC_GET_SUBVOL_INFO. Validation was added in tree-checker and the copy length was limited to the validated name length.

In the Linux kernel, a bug was fixed in the nvme-fc driver where an NVMe-FC controller in CONNECTING state could abort I/O requests before the I/O tagset was initialized. This led to a lockdep warning about improper lock usage and potential stability issues during error recovery after connectivity loss.