CVE Vulnerability Catalog

In the Linux kernel binder, when a TF_UPDATE_TXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed with kfree() directly, skipping binder_free_txn_fixups(). This leaks all binder_txn_fd_fixup entries and their fget()'d struct file references.

A use-after-free vulnerability exists in the Linux kernel's binder_add_device function in binderfs. After publishing a new device entry and releasing the parent directory lock, a concurrent unlinkat() can remove the entry and free the device object, which binder_add_device() then writes to, causing a write to freed memory.

In the Linux kernel nitro_enclaves, when ne_create_vm_ioctl() fails the SLOT_ALLOC request after anon_inode_getfile() succeeds, the error path calls fput(enclave_file) and then frees ne_enclave. Since fput() defers the final __fput() via task_work, ne_enclave_release() runs after ne_enclave has been freed and dereferences ne_enclave->slot_uid, causing a use-after-free.

In the Linux kernel rust_binder, deferred work items on the thread todo list are not cleaned up in the Thread::release() method. This can happen if the thread dies while it has an active outgoing transaction, leading to a resource leak.

In the Linux kernel USB cdc-acm driver, acm_port_shutdown() unconditionally calls acm_unpoison_urbs() and, when the ALWAYS_POLL_CTRL quirk is set, immediately re-submits the ctrlurb and all read URBs. If a concurrent acm_disconnect() then frees those URBs and their DMA buffers while in-flight, a use-after-free occurs in acm_ctrl_irq() or acm_read_bulk_callback().

In the Linux kernel USB serial drivers, some multiport device drivers access port driver data from completion handlers of shared URBs submitted at attach() or first open() and stopped at disconnect() or last close(). A simple NULL check does not prevent a race with port tear down, leading to a use-after-free.

In the Linux kernel USB storage sierra_ms driver, sierra_get_swoc_info() requests 60 bytes via usb_control_msg(), but callers only treat a negative return value as failure. A device answering with a short IN transfer leaves the tail of the freshly allocated swoc_info buffer uninitialized, and truinst_show() prints it into the world-readable "truinst" sysfs attribute, disclosing up to 5 bytes of stale kernel heap memory.

In the Linux kernel USB gadget midi2 module, the jack in/out descriptor arrays in struct f_midi2_usb_config have the size of MAX_CABLES, which turned out to be incorrect. Entries are added from both inputs and outputs, so each loop cycle adds two, ending up twice the expected size, potentially resulting in OOB when a large number of jacks are set up via configfs.

In the Linux kernel, generic_set_cmd() and generic_get_cmd() in the USB gadget f_uac1_legacy driver use the low nibble of ctrl->bRequest as an index into the con->data[] array, which has only 5 elements. Index values from 5 to 15 cause an out-of-bounds heap access (up to 44 bytes past the array). A malicious USB host can send a crafted SET_CUR/GET_CUR request, triggering the vulnerability from an IRQ handler.

In the Linux kernel, the USB Type-C anx7411 driver has an issue where the IRQ is devm-managed and can still queue plat->work while remove() is tearing down the workqueue. This leads to a race condition and potential use-after-free.

In the Linux kernel, the USB dwc3 gadget driver's dwc3_check_event_buf() returns IRQ_NONE without writing back to GEVNTCOUNT when the read value exceeds the event buffer length. Since the DWC3 interrupt is level-triggered, the uncleared IRQ source causes an IRQ storm, accumulating unhandled interrupts and triggering a kernel panic (BUG at spurious.c:184).

In the Linux kernel, the USB gadget aspeed-vhub driver does not cancel the wake_work work item in ast_vhub_remove(), leading to a use-after-free after vhub and its ports are freed. Additionally, a remote wakeup request can re-arm the work after cancellation if the registered flag is not cleared.

In the Linux kernel, the USB gadget dummy-hcd driver emulates synchronize_irq() by waiting for the callback_usage counter to drop to 0. However, this counter is not incremented during request completion callbacks, potentially allowing a gadget driver's unbind routine to run before all outstanding request completions have finished.

In the Linux kernel, the f_fs (FunctionFS) driver has a NULL pointer dereference flaw. When user space sets up FunctionFS with only full-speed descriptors (FUNCTIONFS_HAS_FS_DESC) and the gadget operates at a higher speed (HIGH or SUPER), the FUNCTIONFS_ENDPOINT_DESC ioctl selects a descriptor index based on gadget speed that may be NULL, causing an immediate kernel panic.

In the Linux kernel, usb_disable_endpoint() only clears either dev->ep_out[epnum] or dev->ep_in[epnum] for non-zero control endpoints, leaving the opposite direction's array slot pointing to the disabled/freed endpoint. This can lead to use-after-free.

In the Linux kernel, the USB dwc2 driver deletes the wakeup timer only after freeing host state in dwc2_hcd_free(), and timer_delete() does not synchronize a callback or prevent it from being queued again. This can lead to use-after-free.

In the Linux kernel, the USB Type-C TCPM driver was fixed so that a failure to start the FAST_ROLE_SWAP AMS now triggers error recovery and a port reset. Previously, when a faulty cable signaled FRS during disconnection, the TCPC autonomously enabled VBUS sourcing and left it on because the port state was set to INVALID_STATE without a reset. The fix ensures the port transitions to ERROR_RECOVERY and resets properly.

In the Linux kernel, tps6598x_connect() passes a stack-allocated typec_partner_desc to typec_register_partner() after initializing only some fields. This can lead to garbage function pointers being stored and later invoked, as well as leaking stack data through sysfs.

In the Linux kernel, cd321x_update_work() passed a stack-allocated typec_partner_desc to typec_register_partner() while initializing only usb_pd, accessory and identity. The remaining fields, including the attach and deattach function pointers plus pd_revision and usb_capability, were left uninitialized, potentially causing garbage function pointers to be invoked or leaking stack data through sysfs.

In the Linux kernel, the pmic_glink client is released by devres cleanup after pmic_glink_ucsi_remove() returns, so its notification callbacks can queue work until then. Work running after ucsi_unregister() touches freed state (the connector array) or registers/unregisters the instance a second time, causing a use-after-free.