CVE Vulnerability Catalog

In the Linux kernel, the ALSA caiaq driver registers an input device in setup_card(), but if snd_card_register() or snd_usb_caiaq_control_init() fails, snd_card_free() frees the device state without unregistering the input device. A subsequent read of the "uevent" attribute then dereferences freed memory (use-after-free).

In the Linux kernel ALSA line6 driver (sound/usb/line6/playback.c), the number of bytes written into a playback URB buffer slice was never validated against the slice size. When a USB device declares a large IN wMaxPacketSize and a small OUT wMaxPacketSize, submit_audio_out_urb() performs a memcpy()/memset() beyond the allocated region, causing a slab-out-of-bounds write.

In the Linux kernel, the IIO kionix-kx022a driver performs an incorrect array boundary check when converting a register value to an array index. The check incorrectly accepts sizeof(array) as the last index, when the last valid index should be sizeof(array) - 1.

In the Linux kernel, in the MTD subsystem, mtd_otp_nvmem_add() unregisters the user OTP NVMEM device on factory OTP setup failure but leaves mtd->otp_user_nvmem set. This leads to a double-free when the device is unregistered again.

In the Linux kernel, in the MTD subsystem, __get_mtd_device() calls the master's _get_device() callback with mtd, which may be a partition, while __put_mtd_device() passes the master. This breaks gluebi partitions that require the master MTD via container_of().

In the Linux kernel, in blk-cgroup, blkg_tryget_closest() uses spin_lock_irq() and spin_unlock_irq(), which unconditionally enables local interrupts. When callers already have interrupts disabled (e.g., dm-thin), this leads to a deadlock because an I/O completion softirq can re-acquire the lock on the same CPU.

In the Linux kernel, in of/overlay, init_overlay_changeset() stores the number of initialized fragments in ovcs->count only on full success. When find_target() or the __symbols__ lookup fails partway through, fragment references are never dropped, leading to a memory leak.

In the Linux kernel, in the wfx wifi driver, wfx_hif_read_mib() copies reply->length bytes from the firmware response into the caller-provided buffer without checking that reply->length does not exceed val_len. An oversized length field overruns the caller buffer and reads past the end of the reply allocation.

In the Linux kernel, ieee80211_rx_h_defragment() accumulates fragment payload lengths into the u16 field extra_len. When the sum of fragment lengths exceeds 65535 bytes, the value wraps around modulo 65536, causing an undersized buffer allocation and triggering skb_over_panic() in softirq context, which crashes the kernel.

In the Linux kernel, ath9k_wmi_rsp_callback() fails to validate the length of WMI command responses. A device response shorter than expected is read beyond the skb payload, causing an out-of-bounds read.

In the Linux kernel, __hif_usb_tx() in ath9k_htc limits TX aggregation by frame count but not by cumulative byte length. With large frames (MTU 2304), 20 aggregated frames exceed the tx_buf allocation, causing a memcpy() write past the buffer.

A use-after-free vulnerability was found in the Linux kernel's rtc: ac100 driver. When ac100_rtc_probe() fails after registering the RTC-32k clock and the clock provider, these resources are not released, leaving a dangling pointer on the global of_clk_providers list. A later lookup on this device tree node then reads freed memory.

In the Linux kernel, the mpfs RTC driver does not check the return value of devm_clk_get() for an error before passing it to clk_get_rate(). If an error pointer is returned (e.g. -EPROBE_DEFER), clk_get_rate() dereferences it, crashing instead of deferring probe.

In the Linux kernel, minstrel_ht_tx_status() does not validate the rate metadata (MCS, spatial stream count, bandwidth) reported in TX status. Malformed metadata can be used as an out-of-bounds index into the rate tables, causing an out-of-bounds read.

In the Linux kernel, cfg80211_update_assoc_bss_entry() can copy borrowed beacon_ies pointers from a hidden-group entry into an associated entry, giving the same allocation two owners. Releasing the group entry leaves the associated entry pointing to freed IEs, which are freed again (use-after-free / double-free).

In the Linux kernel, ieee80211_lookup_ra_sta() uses sta_info_get_bss() for all AP and AP VLAN frames, not only control port frames. A unicast frame sent on one interface can match a station of a different VLAN of the same BSS and be transmitted to it.

In the Linux kernel, iocb_bio_iopoll() expects a bio, but when IOCB_HAS_METADATA is set, iocb->private holds a uio_meta. Calling bio_poll() on the uio_meta causes an invalid pointer dereference and crash (KASAN: null-ptr-deref).

In the Linux kernel, blk-mq cached requests are allocated for one operation but can be handed out for another. RQF_USE_SCHED is set based on the first operation, causing a request to be inserted into the scheduler without ->prepare_request() and freed without ->finish_request(), leaking the domain token in kyber and stalling the queue.

In the Linux kernel, the Bluetooth btintel module has a DDC record length validation flaw. Records with length 0xFF can wrap during parsing, and records shorter than the mandatory three-byte header or exceeding remaining firmware bytes are not rejected before Intel_Write_DDC is issued.

A deadlock exists in the Linux kernel in the __kfree_rcu_sheaf() function within the mm/slab subsystem. Since kfree_rcu() can be called under pi_lock (a raw spinlock in the scheduler), attempting to wake up kswapd reacquires pi_lock, leading to a deadlock. The issue was confirmed via lockdep detecting a circular locking dependency.