CVE Vulnerability Catalog

In the Linux kernel Bluetooth hci_sock, the raw HCI socket security filter masks the 10-bit OCF with 127 before looking up the command. An unprivileged socket can submit a reserved OCF that aliases an allowlisted command modulo 128, bypassing the security filter.

In the Linux kernel Bluetooth ISO, hci_bind_bis() obtains the parent from hci_conn_hash_lookup_big(), which returns a bare pointer without a hold. Unlinking the child then drops the parent's existing hold and can schedule it for disconnection while its socket is still using it.

In the Linux kernel Bluetooth ISO, hci_bind_cis() and hci_connect_cis() return one hci_conn hold for the ISO layer, but iso_chan_add() does not create an association when the socket is already attached to the same iso_conn or when another socket is attached (returns -EBUSY). The hold returned for the current call is unused and leaked.

In the Linux kernel Bluetooth L2CAP, l2cap_data_rcv() unpacks a two- or four-byte control field without ensuring it is present, causing an out-of-bounds read for short ERTM or streaming-mode frames. Additionally, with CRC16 enabled, l2cap_check_fcs() subtracts two from skb->len without checking, causing a wrap and an FCS read past the logical end of the frame.

In the Linux kernel Bluetooth mgmt, read_unconf_index_list() counts unconfigured controllers before allocating its response, then rechecks device flags while filling it. During asynchronous controller setup, the worker can set HCI_UNCONFIGURED and clear HCI_SETUP between the two passes, so a controller omitted from the count becomes eligible for the fill pass, causing an out-of-bounds write to rp->index[].

A NULL pointer dereference vulnerability exists in the Linux kernel's RFCOMM_CONNINFO getsockopt handler. When a socket is created with deferred setup enabled and a remote peer sends a DISC frame, the dlc->session pointer becomes NULL while dlc->defer_setup remains set. A subsequent getsockopt call on that socket dereferences the NULL session, causing a kernel oops.

In the Linux kernel SMB client, smb2_parse_contexts() validates the complete create-context area but does not limit each record to its Next field before dispatching it to a handler. A malformed chain can expose bytes beyond the current context, and the lease parsers read fields at canonical offsets rather than at DataOffset.

In the Linux kernel SMB client, SMB2_open() accounts a successful CREATE response as a remote open before parsing its create contexts. If smb2_parse_contexts() rejects malformed context data, SMB2_open() returns without closing the handle, leaving the server-side handle open and num_remote_opens elevated.

In the Linux kernel SMB client, open_cached_dir() sends CREATE and QUERY_INFO as a compound request. If the CREATE succeeds but a later command returns an error, the function must retain the CREATE FID so common cleanup can issue SMB2_close(), and it must not treat a response error as a valid CREATE.

In the Linux kernel SMB client, an O_CREAT open can find an existing symlink or another non-regular inode. cifs_atomic_open() calls finish_open() on it and attaches a cifsFileInfo, but symlink inodes have no CIFS release operation, so the dentry reference held by cifsFileInfo is leaked, and FMODE_OPENED prevents the VFS from following the symlink.

In the Linux kernel SMB client, compound_send_recv() waits for responses in order. If a later wait is interrupted or a later MID fails during response synchronization, an earlier CREATE may already have opened a remote handle, and the earlier mid is released without invoking handle_cancelled_mid(), leaving the remote handle open because no FID was copied to the caller.

In the Linux kernel SMB client, when sending a compound request fails, smb_send_rqst() kicks off a reconnect, but compound_send_recv() still has those mids on pending_mid_q and unlocks the server without removing them first. During reconnect, cifs_abort_connection() runs each mid callback, which returns credits and drops in_flight, and then the send-error path returns the same credits again, causing in_flight to be decremented twice and smb2_add_credits() to WARN.

In the XFS file system in the Linux kernel, the igrab'd reference to the orphanage directory inode is leaked if chowning it fails.

In the XFS file system in the Linux kernel, the inode btree root formatting methods copy too many bytes — there is only one set of keys in node blocks, not two. This causes memory corruption of whatever is beyond the buffers.

In the XFS file system in the Linux kernel, if the amount of fdblocks that can be reserved for a metadata btree file goes below the space already used by that file, the hidden_space subtraction can underflow, causing xfs_dec_fdblocks to subtract a huge amount of space.

In the Linux kernel, a memory allocation failure in xrep_newbt_add_blocks (XFS subsystem) leaks blocks previously allocated for a new btree and can kill online repair. The fix uses a NOFAIL allocation for the small (~48-byte) space reservation object.

In the Linux kernel, xfs_qm_flush_one (XFS subsystem) fails to drop the dquot flush lock when it cannot grab the buffer associated with the dquot. Since no one else will release the dqflock, it remains held.

In the Linux kernel, xlog_recover_iunlink_bucket (XFS subsystem) has multiple bugs: it does not null out prev_ip after releasing it (use-after-free risk), leaks @ip on inodegc flush failure, and mis-sets prev_agino and i_prev_unlinked, introducing loops into the unlinked list.

In the Linux kernel, net/sched act_ct stores a raw pointer to the extensions area in the expectations list before the connection is confirmed. Later *_ext_add() calls reallocate that area, leaving an invalid pointer that is accessed when removing the expectation, causing a use-after-free.

A use-after-free vulnerability was found in the Linux kernel's net/sched act_ct module. When an skb with an unconfirmed conntrack entry is cloned, both clones may process the same shared entry, modifying expectation list pointers and causing a UAF on the destruction path. The issue primarily affects NAT without commit.