CVE Vulnerability Catalog

In the Linux kernel's ALSA PCM subsystem, there is an issue with waking linked drain waiters on unlink. This can lead to use-after-free of a stack frame during a later wake-up.

In the Linux kernel's io_uring, there is an issue with preserving per-task restrictions across exec. These restrictions are dropped during task context cleanup, allowing an unrestricted ring to be created after exec.

A vulnerability in the Linux kernel's SPI-NAND driver for Qualcomm chips (spi-qpic-snand) was found. The SET_FEATURE value was written to the register after command execution, causing a one-operation delay. As a result, the chip remained in OTP mode, making the flash memory unusable and the device unbootable.

In the Linux kernel's dasd driver, there is an issue with an undersized format-check buffer. The fmt_buffer_size variable is declared as int, causing truncation of the computed size and potentially leading to out-of-bounds write.

In the Linux kernel's zcrypt driver, there is an issue with incorrect domain value verification for EP11 CPRBs. The wrong upper limit can lead to heap memory access beyond perms->adm when an administrative CPRB is sent.

In the Linux kernel, the CAN J1939 function j1939_session_fresh_new() did not zero the buffer before use, potentially leaving residual data. The fix zeroes the allocated buffer to prevent potential information leakage.

In the Linux kernel, the CAN softing driver's fw_parse() function did not validate that firmware records fit within the firmware image, potentially leading to out-of-bounds reads. Additionally, bounds calculations for DPRAM writes were prone to integer overflow, and the application loader's data copy was not properly bounded.

In the Linux kernel, the VMware driver (drm/vmwgfx) had two sites in vmwgfx_resource.c that assigned boolean literals to the guest_memory_size field, which is an allocation-size field, instead of the adjacent guest_memory_dirty bitfield. This caused guest_memory_size to hold 0 or 1 instead of the actual allocation size, leading to errors in dirty page range calculations and buffer allocation.

In the Linux kernel, the VMware driver (drm/vmwgfx) function vmw_external_bo_copy() did not validate bounds for copy operations on imported dma-buf buffers. Lack of validation could lead to out-of-bounds reads or writes, especially with crafted plane state data.

In the Linux kernel, the hwmon ltc4282 driver had a missing return statement when reading the minimum alarm voltage for the VGPIO channel, causing an out-of-bounds access.

In the Linux kernel, the Bluetooth subsystem (hci_sync) had a theoretical use-after-free (UAF) vulnerability in hci_connect_acl/le_sync() callbacks. If the connection (conn) is freed while the hci_sync task is running, it could lead to use of freed memory.

In the Linux kernel, the SCSI target iblock driver had a bug in iblock_execute_pr_out() where the NULL check for PREEMPT, PREEMPT_AND_ABORT, and RELEASE operations was incorrect. This allows unimplemented hooks (ops->pr_clear) to be called, leading to NULL pointer dereference.

In the Linux kernel's snapshot_page(), __page_2 is read for order-1 folios, but it should only be read when nr_pages > 2. This can cause a page fault during DLPAR memory removal on ppc64le systems.

A use-after-free vulnerability was found in the Linux kernel's Bluetooth SCO subsystem. The issue stems from incorrect reference counting for the sco_conn structure, where the socket did not hold its own reference, leading to a double-free race condition between socket close and disconnection event handling.

In the Linux kernel for RISC-V, a bug was found in the calculation of vmemmap_start_pfn alignment. The issue uses alignment expressed in bytes of struct page storage instead of physical address bytes, causing a warning and potential memory initialization problems on systems like QEMU virt.

In the Linux kernel's i2c amd-mp2 driver, on adapter registration failure, the I2C context is freed by devres, but the PCI driver may still dereference the stale pointer in IRQ and sleep callbacks. The fix unregisters the callback before returning the error.

In the Linux kernel's i2c imx driver, there is a race during slave registration and error handling. Assigning the slave pointer before pm_runtime_resume_and_get() can leave it non-NULL after an error, and a race with the interrupt handler can cause a NULL dereference. The fix defers the assignment until after successful resume and performs it inside the slave_lock critical section.

In the Linux kernel, dev_has_sync_state() reads dev->driver twice without holding device_lock(), which can lead to a race during concurrent unbind. The fix reads dev->driver exactly once with READ_ONCE(), pairing with WRITE_ONCE() in device_set_driver().

In libbpf, the signed loader does not ensure that a map is exclusive before validating map->sha. Without exclusivity, another BPF program with map access can mutate the contents after freezing, allowing validation on stale data. The fix adds an exclusivity check.

In the Linux kernel NTFS driver, a vulnerability was found where the restart-area length is truncated to u16, allowing the bounds check to be bypassed. A crafted NTFS image can cause an out-of-bounds read during filesystem mount.