CVE Vulnerability Catalog

In the Linux kernel, the scsi bsg completion copies scmd->sense_len to the user response buffer without honoring max_response_len. After a valid sense, the midlayer sets sense_len to the real length (up to SCSI_SENSE_BUFFERSIZE), overrunning a smaller user buffer.

In the Linux kernel, the scsi bsg function scsi_bsg_uring_cmd() reads bsg_uring_cmd from the shared mmap'd SQE, allowing userspace to change a field between check and use (TOCTOU). request_len can grow past sizeof(scmd->cmnd) after the bound check and overflow scmd->cmnd in copy_from_user().

In the Linux kernel, the megaraid_sas driver's megasas_make_prp_nvme() builds a command's PRP list in cmd->sg_frame without checking the buffer bound. After the default BLK_DEF_MAX_SECTORS_CAP was increased to 4 MiB, NVMe transfers require more entries than fit in the frame, causing an out-of-bounds write, a page fault, or silent corruption of a neighbouring DMA pool entry.

In the Linux kernel, the scsi pm8001 driver function pm8001_request_msix() uses index i instead of j in the rollback loop when request_irq() fails, passing the wrong IRQ/dev_id pair to free_irq(). Earlier registered handlers remain installed.

A use-after-free vulnerability exists in the Linux kernel's futex implementation during requeue PI operations on PREEMPT_RT kernels. A race between an early wakeup of a waiting task and a PI requeue can cause the requeue task to call rcuwait_wake_up() on a futex_q structure that has already been freed from the waiter's stack. The issue is resolved by skipping rcuwait_wake_up() in the Q_REQUEUE_PI_LOCKED case.

A use-after-free bug exists in the Linux kernel ftrace subsystem. The set_ftrace_filter and set_ftrace_notrace files for trace instances use the ftrace_ops pointer from inode->private, which can be freed concurrently by an rmdir on the instance, leading to a use-after-free and kernel crash.

In the Linux kernel, a race condition exists in the HID BPF subsystem between the device destruction path (__hid_bpf_ops_destroy_device) and the unregistration path (hid_bpf_unreg), which can double-put the same device reference. This frees the hid_device structure while hid_destroy_device() is still using it, resulting in a use-after-free. The fix serializes the reference release decision under the prog_list_lock.

In the Linux kernel, the HID RMI driver is vulnerable to out-of-bounds (OOB) access due to undersized report buffers. The driver allocates buffers based on device-declared report sizes without a minimum bound, then reads/writes at fixed offsets, leading to memory corruption. Additionally, the read loop can hang indefinitely if the device returns zero-length replies, blocking the probe worker.

OpenMeter before v1.0.0-beta.228 contains an SQL injection vulnerability in ClickHouse-backed meter definitions. A remote unauthenticated attacker can access or modify metering event data and potentially cause denial of service.

In the Linux kernel, the wacom_intuos_pro2_bt_irq() function in the HID wacom driver did not validate the received report length before parsing. A malicious or malfunctioning Bluetooth device impersonating a Wacom tablet can send an undersized report, causing an out-of-bounds read and leaking data to userspace via evdev.

A race condition exists in the Linux kernel device-mapper subsystem when loading and unloading a table concurrently. dm_setup_md_queue walks &md->table_devices without any lock, so racing with dm_table_destroy can lead to access to invalid memory.

A race condition exists in the Linux kernel device-mapper subsystem between resume and remove ioctls. If a user issues resume and remove at the same time, the device may be resumed after being suspended in __dm_destroy, so the table is destroyed without calling the postsuspend method, breaking dm target expectations and potentially causing use-after-free (e.g. in dm-integrity).

In the Linux kernel, dma_direct_alloc_from_pool() returns a CPU address instead of a struct page *, which does not match the expectations of dma_direct_alloc_pages(). The bug was introduced by commit 5b138c534fda and can lead to incorrect behavior or a crash.

In the Linux kernel, the fsl-edma dmaengine driver tracing events store a pointer to struct fsl_edma_engine and dereference it when printing a log entry, at which point the pointer may no longer be valid. Event injection (e.g. via the inject file) can trigger a kernel crash.

In the Linux kernel, dt_idle_pd_alloc() allocates memory for the full node path and then sets pd->name to point to the basename of that string. dt_idle_pd_free() frees pd->name, which no longer points to the start of the allocation, leading to an invalid free.

In the Linux kernel, __within_kprobe_blacklist() traverses the kprobe_blacklist without holding kprobe_mutex. When a module is unloaded, entries are immediately freed, leading to a use-after-free in a concurrent call to within_kprobe_blacklist().

In the Linux kernel, alloc_pages_bulk_weighted_interleave() hardcodes GFP_KERNEL when allocating the temporary weights array, even when called in atomic/RCU context. This can trigger a might_alloc() splat due to a sleeping allocation in an invalid context.

In the Linux kernel, memcg_reparent_objcgs() assumes that a folio's objcg matches its node. Folio migration across nodes breaks this assumption, leading to inconsistency and potential use of the wrong LRU lock, which can cause data corruption or crashes.

In the Linux kernel, the ALSA harmony driver has an issue with lock initialization before IRQ registration. The IRQ is registered before h->lock and h->mixer_lock are initialized, which can lead to the interrupt handler using uninitialized locks.

A race condition exists in the Linux kernel between non-atomic ALSA PCM operations (hw_params, hw_free, prepare) and the atomic trigger-start operation. While one thread performs a non-atomic operation, another thread can trigger the PCM start, leading to state inconsistencies and ODEBUG warnings reported by syzkaller. The fix prevents trigger-start during non-atomic operations by checking the runtime->buffer_accessing value.