CVE Vulnerability Catalog

In the Linux kernel, oxp_hid_remove() in the HID hid-oxp driver uses cancel_delayed_work(), which does not wait for a currently executing callback to finish. If a callback (e.g. oxp_rgb_queue_fn) is running during removal, it continues accessing the HID device after it has been closed and stopped.

In the Linux kernel, wacom_wac_pen_serial_enforce() in the HID wacom driver may compute an invalid offset passed to hid_field_extract(), causing a read past the end of the report. The value is stored in wacom_wac->serial[0] and can reach userspace as an MSC_SERIAL event.

In the Linux kernel, in mlx5_tc_ct_shared_counter_get() of the net/mlx5 driver, when the reverse entry is found but its counter is already being released, refcount_inc_not_zero() fails and the reference taken by mlx5_tc_ct_entry_get() is never dropped before falling through to create_counter.

In the Linux kernel, mlx5e_ipsec_policy_mask() in the net/mlx5e driver builds masks for IPv6 XFRM policies, but setup_fte_addr6() installs each mask in the opposite address field. When source and destination prefix lengths differ, the hardware rule can miss traffic covered by the policy and match traffic outside it.

In the Linux kernel, airoha_npu_remove() in the net: airoha: npu driver calls cancel_work_sync() on wdt_work, but the watchdog IRQ that queues it is freed only after .remove() returns. The handler can re-queue work that dereferences freed memory of the airoha_npu struct.

In the Linux kernel, the ARP ioctl copies a user-provided struct arpreq into a stack object, and its arp_dev field may contain IFNAMSIZ bytes without a NUL terminator. Such input is passed to dev_get_by_name_rcu() or __dev_get_by_name(), where strcmp() can read past the end of the stack object.

In the Linux kernel, the net: atl1 driver may read an out-of-range cmb_tpd_next_to_clean value (e.g. 0xffff) while the PCIe link/MAC is resetting. Such a value can never be reached, so the cleanup loop may spin forever, causing a soft lockup.

In the Linux kernel, ic_dhcp_init_options() in the net: ipconfig driver appends hostname, vendor-class and client-ID options into the fixed 312-byte bootp_pkt.exten[] buffer. Only the client-ID branch checked remaining space, so long hostname and vendor-class values can write past the end of the buffer.

In the Linux kernel, macb_alloc() in the net: macb driver has DMA memory leaks on error paths: a Tx buffer crossing a 4G boundary, an Rx buffer allocation failure, and an Rx buffer crossing a 4G boundary leak Tx and/or Rx buffers. The error handling calls macb_free(bp), but nothing has been stored in bp->queues[0].

In the Linux kernel, the openvswitch conntrack module can modify a shared unconfirmed ct entry. When a cloned skb with an unconfirmed ct entry is committed, differing extension sets cause a use-after-free on the destruction path.

In the Linux kernel, the openvswitch conntrack module has a use-after-free due to extension reallocation. A raw pointer to the extensions area is wired into the expectations list, and later extension additions can invalidate it, causing a UAF when the expectation is removed.

A bug was fixed in the Linux kernel's atl1c network driver that caused a soft lockup. When the hardware reports an out-of-range tpd_cons value (e.g. 0xffff) during a PCIe link/MAC reset, the cleanup loop in atl1c_clean_tx would spin forever. The issue was observed on Qualcomm Atheros AR8151 v2.0 NICs.

In the Linux kernel, the atl1e driver has a soft lockup issue caused by an out-of-range hw_next_to_clean read. When the hardware reports 0xffff during PCIe/MAC link reset, the cleanup loop can spin forever.

In the Linux kernel, the bridge mdb module has a use-after-free due to a stale cursor after port group deletion. br_mdb_flush_pgs() can point to freed memory, exposed by a subsequent RTM_GETMDB.

In the Linux kernel, the ena driver leaks an MMIO read buffer on probe failure. If ena_probe() fails after successful device init, the coherent DMA buffer is not freed.

In the Linux kernel, the netfilter ip6t_rt module has an out-of-bounds read in non-strict zero-address matching. When a rule has rtinfo->addrnr == 0, a crafted IPv6 packet can cause the index to go past struct ip6t_rt.

In the Linux kernel, the netfilter nf_tables module skips expired catchall elements on insert and delete. Predicate drift makes expired elements invisible to userspace but still blocks re-insertion or causes the wrong element to be deleted.

In the Linux kernel, the NFC module has a use-after-free in nfc_get_local_general_bytes. After the local object is freed, callers may still use the returned pointer, leading to a UAF.

In the Linux kernel, the NFC LLCP module reads uninitialized memory on truncated I/RR/RNR PDUs. nfc_llcp_recv_hdlc() reads the sequence byte before any length check, allowing a one-byte read past the packet data.

In the Linux kernel, the NFC port100 driver does not verify that the frame length declared by the device (datalen field) does not exceed the number of bytes actually received. A device can report an oversized datalen, causing an out-of-bounds read past the transfer buffer during checksum computation.