CVE Vulnerability Catalog

A flaw was fixed in the Linux kernel Bluetooth ISO handling where concurrent listen() calls on the same broadcast socket could overwrite the connection pointer and leak a reference. This could lead to a use-after-free when later events access the stale socket, as confirmed by a KASAN report.

In the Linux kernel, Bluetooth ISO iso_sock_connect() checks socket state before taking the socket lock and drops the lock before setting up a connection, allowing two concurrent callers to pass the admission check. This can overwrite the socket destination, leak references, and cause a use-after-free, as reported by KASAN in iso_sock_hold().

In the Linux kernel Bluetooth SCO handling, a race existed between the receive path (sco_recv_scodata) and sco_conn teardown, leading to a use-after-free. The hcon->sco_data pointer was cleared without holding hdev->lock, so the RX path could call kref_get_unless_zero() on an already freed sco_conn. The fix gives the pointer a real reference and serialises its clearing under hdev->lock.

In the Linux kernel, drm/i915/gem's eb_relocate_parse_slow() can call kvfree() on entries outside the original exec array. This happens because eb_parse() increments eb->buffer_count after appending VMAs, and cleanup uses the incremented count to release relocation pointers.

In the Linux kernel, drm/vmwgfx lacks validation of the pitch coming from userspace before copying data from the underlying surface. This can lead to out-of-bounds reads during cursor snooping.

In the Linux kernel's drm/xe subsystem, a stale pinned_link entry is left when framebuffer pinning performs the final unpin. This leaves a list entry pointing into freed memory, risking list corruption and a use-after-free on subsequent list walks or splices.

In the Linux kernel, mnt_change_mountpoint() did not reset the old parent's ->overmount, unlike __umount_mnt(). In the reparent()/propagate_umount() path this led to a dangling pointer and use-after-free when a file descriptor kept an unmounted mount alive, and do_lock_mount() followed ->overmount into the freed mount.

A Linux kernel bug was fixed in clone_mnt(), where the MNT_UMOUNT flag was inherited by cloned mount points. This allowed copies of a lazily unmounted mount (kept alive by an nsfs/pidfs file descriptor) to be created, causing multiple issues: structure leaks, incorrect unmounting of peers, and propagation/reparenting problems. The fix adds MNT_UMOUNT to MNT_INTERNAL_FLAGS so it is never copied.

A use-after-free vulnerability exists in the Linux kernel mount notification mechanism. mnt_notify_add() does not check whether a mount is already on notify_list, so multiple umount_tree() calls under a single namespace_sem hold can queue the same mount twice and corrupt the list. Subsequent mount operations on the host then walk freed memory.

A vulnerability was fixed in the Linux kernel's open_tree(OPEN_TREE_NAMESPACE) mechanism, which creates a new mount namespace from a copy of the tree at a given path. An unprivileged user could first create a user namespace and then access content hidden by covering mounts (e.g., masking parts of /proc and /sys in container runtimes).

In the Linux kernel, d_alloc_pseudo() returns dentries with DCACHE_NORCU that are freed immediately unless they become a mount root. Bind mounting /proc/self/fd/<fd> of such a file (e.g., a BPF token on bpffs) makes such a dentry a mount root, leading to a use-after-free during __follow_mount_rcu(). This can result in access to freed memory.

A race condition exists in the Linux kernel's __detach_mounts() when detaching mounts from a dentry. Between detach_mounts() and d_delete() the dentry remains hashed and positive even though nothing covers it anymore, allowing concurrent lookups to uncover what the mounts hid. This affects unlinking files or directories that are mountpoints in other mount namespaces.

A vulnerability was fixed in the Linux kernel namei refwalk mechanism that could reveal overmounted entries. In a narrow race window between mount detachment and name removal (unlink/rmdir/rename), refwalk could return the underlying entry instead of the mounted content. The fix adds a DCACHE_CANT_MOUNT check after step_into() to detect this case.

The Linux kernel has a flaw in handling locked mounts, which are meant to protect underlying files and directories from being revealed. When a user namespace owner places a mount beneath a locked mount using MOVE_MOUNT_BENEATH, the locked property moves to the bottom mount, allowing the top mount to be unmounted and the covered directory to be revealed. The fix makes plain umount() return EBUSY and lets a locked mount die together with its parent.

A vulnerability in the Linux kernel mount namespace handling was fixed. attach_recursive_mnt() transferred the MNT_LOCKED flag from the top mount to a mount moved beneath it, allowing a user namespace owner to unlock and unmount a protected /proc or root mount, exposing hidden data.

In the Linux kernel, XFS exchange-range operations incorrectly moved the reflink flag between files even though a file can still own shared blocks beyond i_disk_size. This caused in-place writes instead of CoW, corrupting the other file sharing those blocks. The fix stops moving the flags and sets them on both inodes, including for XFS_IOC_SWAPEXT.

A bug was fixed in the Linux kernel's XFS involving the XFS_IOC_EXCHANGE_RANGE operation with the TO_EOF flag. Incorrect swapping of file sizes at nonzero offsets caused a file to have shared blocks beyond EOF, and subsequently the reflink flag was incorrectly cleared, allowing a shared block to be overwritten.

A use-after-free vulnerability was fixed in the Linux kernel AMT driver. IGMP/MLD queries were queued through a qdisc, and a raw tunnel pointer stored in skb->cb could reference a freed tunnel, causing a use-after-free in amt_dev_xmit(). The fix sends the query directly from the receive path, bypassing the qdisc.

In the Linux kernel, a bug was fixed in the ice driver where using writel_relaxed() for Tx doorbell updates did not provide proper write ordering on arm64. This introduced a race where the NIC could start transmitting before the dql->num_queued update was visible, triggering BUG_ON in dql_completed() and a kernel crash.

In the Linux kernel nvmet, nvmet_req_alloc_p2pmem_sgls() assigns req->p2p_dev only after both data and metadata SGL allocations succeed. If data allocation succeeds but metadata allocation fails, out_free_sg passes an unassigned req->p2p_dev to pci_p2pmem_free_sgl().