CVE Vulnerability Catalog

In the Linux kernel, cdns3_gadget_start() arms two works (pending_status_wq and aligned_buf_wq) on system_freezable_wq whose handlers use the embedded cdns3_device. cdns3_gadget_exit() does not wait for these works and frees endpoints, buffers and private device data, so a queued work can run after the free, causing a use-after-free.

In the Linux kernel, the Cadence USBSS controller is a two-function PCI device. When the second function is probed while the first has been enabled but has not yet set its driver data, pci_get_drvdata() returns NULL and the subsequent wrap->devfn assignment dereferences a NULL pointer, crashing the kernel.

In the Linux kernel, the stack-allocated struct vio_vcc pkt in vcc_send_ctl() was only partially initialized, leaving the tag.stype_env field uninitialized before being sent via ldc_write(). This can leak kernel stack data to the LDC peer.

In the Linux kernel, vcc_cleanup() sets port->tty to NULL without holding port->lock, racing with vcc_event() LDC callbacks that read port->tty under port->lock and then use tty->port. This can cause a use-after-free when the callback dereferences tty->port after cleanup has already destroyed and freed it.

In the Linux kernel, the tty_port layer fails to restore the TTY_IO_ERROR flag when port activation fails. This can lead to I/O attempts on a port that is gone or powered down, causing kernel panics from unclocked accesses or NULL-pointer dereferences when a TTY ioctl races with hangup and open.

In the Linux kernel, tty_port_tty_vhangup() may return before the port has actually been shut down if it races with another hangup. The missing serialization between tty_port_tty_vhangup() and tty_port_hangup() leads to use-after-free and NULL-pointer dereferences in racing ioctls and in processing of asynchronous hangups (carrier loss).

In the Linux kernel, break ioctls (TCSBRK and TCSBRKP) can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. After a user-controlled timeout, the driver may be called even after the tty has been reopened.

In the Linux kernel, resetting saved termios state on device registration can cause a use-after-free when closing a TTY (and saving its termios) races with re-registration. The issue affects drivers that do not guarantee the minor number is no longer in use.

In the Linux kernel, the max3100 serial driver's max3100_shutdown() stops the polling timer but returns early during system suspend. If the SPI device is unbound before resume, max3100_remove() frees the port while the timer remains armed, leading to a use-after-free in max3100_timeout(). The fix adds final timer teardown in max3100_remove() using timer_shutdown_sync(), and frees the IRQ and destroys the workqueue before freeing the port.

In the Linux kernel, the serial: 8250_bcm7271 driver has a use-after-free in brcmuart_remove(). brcmuart_remove() cancels the hrtimer before unregistering the port, so a receive-timeout interrupt arriving in between re-arms the timer. After devm frees priv, the callback runs on freed memory.

In the Linux kernel, serial_core_unregister_port() passes port->port_dev to serial_core_get_ctrl_dev(), which dereferences it. When port->port_dev is NULL (no port device installed or registration failed before serial_core_port_device_add()), a NULL pointer dereference occurs.

In the Linux kernel, the serial: ma35d1 driver has a clock reference leak in ma35d1serial_probe(). of_clk_get() returns a clock with a reference that must be released with clk_put(), but ma35d1serial_probe() never does that, so the reference is leaked on probe error paths and when the port is removed.

In the Linux kernel on arm64, restore_sve_fpsimd_context() fails to reject an SVE signal context where SVE_SIG_FLAG_SM is clear and an SVE payload is present on SME-only systems (without SVE support). This allows a task to be placed in a non-streaming SVE state even though the hardware does not support it, potentially leading to EL1 UNDEF errors and a kernel panic.

In the Linux kernel, in the ASoC codec max98363, stream_config is not initialized before being passed to sdw_stream_add_slave(). The type field may contain garbage and is later copied to stream->type by sdw_config_stream().

In the Linux kernel, the ASoC rt1017-sdca-sdw codec driver did not initialize stream_config before passing it to sdw_stream_add_slave(). The type field could contain garbage and was later copied to stream->type by sdw_config_stream().

In the Linux kernel ALSA seq subsystem, the translated port-info compat ioctl path invoked handlers through snd_seq_kernel_client_ctl() without taking client->ioctl_mutex, unlike the native ioctl path. This allowed concurrent compat CREATE_PORT requests to bypass the port-count check, potentially wrapping the port index and accessing a freed subscriber.

A vulnerability was found in the Linux kernel ALSA ua101 driver due to missing validation of packet size consistency between capture and playback interfaces. A malicious or faulty USB device can declare mismatched parameters (large capture wMaxPacketSize with few channels and small playback wMaxPacketSize with many channels), causing an out-of-bounds write when the PCM node is opened.

In the Linux kernel EDAC/altera driver, the a10 ECC setup callbacks and their helpers were marked __init even though they run from the probe path, which may execute after __init memory is freed. This caused dereferences of freed memory on deferred probe (-EPROBE_DEFER) or manual unbind/rebind.

A race condition exists in the Linux kernel's Bluetooth RFCOMM implementation regarding the initial TTY port reference. Both the install and release paths can drop the same reference, leading to a use-after-free. The issue affects RFCOMM_RELEASE_ONHUP devices and was confirmed by KASAN.

A use-after-free vulnerability exists in the Linux kernel's Bluetooth SMP build_pairing_cmd() function. It reads remote OOB data without holding hdev->lock, allowing a concurrent Remove Remote OOB Data command to free the entry before SMP reads it. The fix introduces a dedicated per-device remote_oob_lock.