CVE Vulnerability Catalog

In the Linux kernel EDAC/altera driver, the a10 ECC setup callbacks and their helpers were marked __init even though they run from the probe path, which may execute after __init memory is freed. This caused dereferences of freed memory on deferred probe (-EPROBE_DEFER) or manual unbind/rebind.

A race condition exists in the Linux kernel's Bluetooth RFCOMM implementation regarding the initial TTY port reference. Both the install and release paths can drop the same reference, leading to a use-after-free. The issue affects RFCOMM_RELEASE_ONHUP devices and was confirmed by KASAN.

A use-after-free vulnerability exists in the Linux kernel's Bluetooth SMP build_pairing_cmd() function. It reads remote OOB data without holding hdev->lock, allowing a concurrent Remove Remote OOB Data command to free the entry before SMP reads it. The fix introduces a dedicated per-device remote_oob_lock.

A use-after-free vulnerability exists in the Linux kernel Bluetooth hci_sync subsystem. The sync command worker reads inquiry cache entries without holding the proper lock, allowing a concurrent HCIINQUIRY ioctl to flush the cache and free the entry, leading to access of freed memory.

A use-after-free vulnerability exists in the Linux kernel's hci_enhanced_setup_sync() function during enhanced SCO setup for Bluetooth connections. The function dereferences conn->parent without holding hci_dev_lock, allowing a concurrent receive workqueue to free the ACL parent object before it is read. The fix holds hci_dev_lock across the codec switch.

A use-after-free vulnerability exists in the Linux kernel Bluetooth subsystem. hci_chan_sent() selects a channel under RCU but drops the read lock before accessing chan->conn, so a concurrent channel deletion (e.g., triggered by a disconnect command timeout) can free the channel memory before the TX scheduler finishes using it.

A use-after-free vulnerability exists in the Linux kernel Bluetooth subsystem. hci_low_sent() selects a connection under RCU but drops the read lock before using the pointer, so hci_sched_iso() and hci_sched_sco() can access a connection already freed by hci_abort_conn_sync(). The fix holds hci_dev_lock() across connection selection and transmission.

In the Linux kernel, the fragmented path in hci_queue_iso() calls __skb_queue_tail() without holding conn->data_q.lock. The transmit worker can concurrently dequeue packets via skb_dequeue(), leading to a use-after-free or queue corruption.

In the Linux kernel's btintel driver, the "Exception info %s" print in btintel_hw_error() uses skb->data + 1, but the 12-byte payload is not guaranteed to be NUL-terminated, allowing a read past its end.

In the Linux kernel's btintel_pcie_recv_frame(), plen is u16 and computed as HDR_SIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value >= 0xFFFC wraps the sum, bypassing the "skb->len < plen" check and letting skb_trim() truncate the packet.

In the Linux kernel's btintel_pcie_send_frame(), skb->data is copied into a fixed BTINTEL_PCIE_BUFFER_SIZE (4096) DMA buffer via memcpy() in btintel_pcie_prepare_tx(), with a 4-byte PCIe type header prepended. A user-space process with HCI_CHANNEL_USER access can inject an oversized packet and overflow the buffer.

In the Linux kernel, get_align_mask() returns huge_page_mask_align() for hugetlbfs, but get_align_bits() adds va_align.bits regardless, so vm_unmapped_area() returns an address off the huge page boundary and __unmap_hugepage_range() hits BUG_ON(start & ~huge_page_mask(h)) at teardown.

In the Linux kernel's tpm2_get_random(), when the response carries the TPM2_ST_SESSIONS tag, the function skips the 4-byte parameter size field before locating the random data, but the bounds check still validates the response length against TPM_HEADER_SIZE. A truncated response can pass the check and make memcpy() read up to 4 bytes past the response end.

In the Linux kernel's nvme-multipath subsystem, the namespace head is marked zoned at allocation time based only on the command set identifier. If the zone info query reports a zero zone size, the path namespace is registered without zoned limits while the head still advertises the zoned capability with a zone size of zero, leading to a shift by ilog2(0).

In the Linux kernel's nvme-multipath subsystem, the number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log header and group descriptors independently supply the number of groups and namespace IDs to parse. Both bounds checks subtract an untrusted object size from ana_log_size before comparing the current offset, so an oversized object causes a size_t underflow and reads beyond ana_log_buf.

In the Linux kernel's nvmet_auth_challenge(), the output buffer is received as a void pointer, so sizeof(*d) evaluates to one with GCC and undercounts the fixed challenge header by 15 bytes. A short AUTH_RECEIVE buffer can pass the check before the challenge is copied past the end of its allocation.

In the Linux kernel's nvmet pci-epf subsystem, the host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nr_descs zero, so nvmet_pci_epf_get_sgl_segment() reads the type byte of sgls[-1] outside the allocated buffer. If that byte contains a segment descriptor type, the function also copies the preceding 16 bytes and returns a negative descriptor count.

In the Linux kernel's nvmet module, nvmet_ctrl_init_pr() snapshots the controller's hostid before the connect data (including hostid) is copied, so every reservation pc_ref entry stores the nil UUID. As a result, Preempt and Abort operations cannot match the victim's hostid and silently degrade to a plain Preempt, leaving the victim's in-flight I/O running.

In the Linux kernel's block2mtd module, the erase_size parameter can be set to zero, causing a divide-by-zero in add_device() during the modulo operation. This triggers a kernel divide error and crash.

In the Linux kernel's Cadence NAND driver (mtd: rawnand), the interrupt handler is registered before the IRQ lock and completion object are initialized. This leaves a window where a pending interrupt can access uninitialized synchronization state.