CVE Vulnerability Catalog

In the Linux kernel, Bluetooth ISO function iso_sock_getname does not hold the socket lock when accessing the conn field, leading to a race condition and potential use-after-free.

In the Linux kernel, Bluetooth ISO function iso_connect_ind does not hold the socket lock when accessing the conn field, leading to a race condition and potential use-after-free. Additionally, conn may be NULL if the socket has changed state.

In the Linux kernel, Bluetooth ISO function iso_conn_ready does not properly hold a reference to the socket when accessing conn->sk, leading to a use-after-free if the socket is concurrently closed.

In the Linux kernel, in the Bluetooth ISO subsystem, a potential deadlock was found in iso_sock_timeout(), which takes lock_sock and then synchronously disables the timer, potentially causing a deadlock. Additionally, iso_sock_timeout() may run concurrently with iso_conn_del(), leading to use-after-free (UAF) — one thread frees the hcon structure while another tries to access it.

In the Linux kernel, in the Bluetooth ISO subsystem, a reference counting bug was found in the iso_conn structure. A race between iso_conn_del() and iso_chan_del() can lead to a double-put of iso_conn, resulting in use-after-free (UAF). The issue stems from an extra put in iso_conn_del() for the case when iso_chan_add() fails.

In the Linux kernel, in the Bluetooth ISO subsystem, a race condition was found between kfree and kref_get_unless_zero on the hci_conn::iso_data field, which is accessed and modified without synchronization (lock or RCU). This can lead to use-after-free (UAF) and races between iso_conn_add() and iso_conn_free().

In the Linux kernel, in the Bluetooth subsystem (hci_conn), a theoretical use-after-free (UAF) vulnerability was found in abort_conn_sync() if the connection (conn) is freed while the hci_sync task is running. There is no reference held to the connection.

In the Linux kernel, in the Bluetooth subsystem (hci_sync), a theoretical use-after-free (UAF) vulnerability was found in hci_connect_big_sync() if the connection (conn) is freed while the hci_sync task is running. There is no reference held to the connection. Additionally, if hcon is NULL, the function returns 0 and does nothing to match previous behavior.

In the Linux kernel, in the Bluetooth subsystem (hci_sync), a theoretical use-after-free (UAF) vulnerability was found in hci_connect_pa_sync() if the connection (conn) is freed while the hci_sync task is running. There is no reference held to the connection.

In the Linux kernel, in the Bluetooth subsystem (hci_sync), a theoretical use-after-free (UAF) vulnerability was found in hci_past_sync() if the connection (conn) is freed while the hci_sync task is running. This can lead to passing freed pointers to hci_conn_valid(), which kmalloc may have reused.

In the Linux kernel, in the octeontx2-af subsystem, a vulnerability was found that allows virtual functions (VFs) to overwrite special CGX PKIND state. When HiGig2 or EDSA parsing is enabled, a VF NIX LF allocation must not reset the LMAC RX PKIND or default TX parse config over the PF setup. Missing permission-checking functions.

A deadlock was found in the qede driver of the Linux kernel during recovery after a TX timeout on NICs with VXLAN/GENEVE tunnel ports configured. The recovery process tries to re-lock the same mutex (qede_lock), causing the entire rtnetlink control plane to wedge and many system services to hang.

In the Linux kernel's SMB server (ksmbd), a use-after-free vulnerability was found in __close_file_table_ids(). A ksmbd_file can remain alive after logical close while another session holds a temporary reference. When the foreign holder performs the final put, the object is freed without being removed from its owner's idr, leading to a stale pointer dereference during file-table teardown.

In the Linux kernel's iommu/iommufd subsystem, a use-after-free vulnerability was found in IOPF group ownership. IOPF groups are linked into the generic pending list before invoking the domain fault handler, and after acceptance they are also queued in the IOMMUFD deliver list without removal from the generic list. When detach or HWPT replacement drops the device's IOPF reference count to zero, groups can be freed, and later access leads to UAF.

In the Linux kernel's pinctrl subsystem for devicetree, a vulnerability was found causing freeing of uninitialized dev_name on error path. dt_remember_or_free_map() duplicates dev_name for each map entry. If kstrdup_const() fails, dt_free_map() frees dev_name in all entries, including uninitialized ones, leading to a double-free.

A vulnerability in the Linux kernel's hugetlb mechanism causes list corruption in allocate_file_region_entries(). The issue stems from using list_splice() instead of list_splice_init(), which under concurrent access to a shared mapping can lead to memory corruption or a system panic.

A vulnerability in the Linux kernel's KVM/SVM was found where x2APIC MSR intercepts are not updated for L1 when AVIC is inhibited while L2 is active. This allows L1 to read host APIC state, send arbitrary interrupts, and change task priority, potentially leading to a host DoS.

In the Linux kernel, in the KVM subsystem for s390 architecture in PCI handling, a vulnerability was found where a request to enable interrupt forwarding is not rejected if it is already enabled for the zPCI device. The MPCIFC instruction does not allow re-registering interrupts without first unregistering. The fix adds a proper check, preventing overwriting and resource leaks when the ioctl is called multiple times for the same device.

A use-after-free vulnerability was found in the Linux kernel's dibs layer, affecting attach/detach/unregister operations for dmb_node in loopback mode. The issue stems from a race between hash table lookup and refcount operations, potentially leading to use of freed memory. The fix makes refcount transitions and hash table removal atomic under the write lock.

In the Linux kernel, in the audit module, a potential use-after-free vulnerability was found in audit_del_rule(). This function destroys e->rule.exe via audit_remove_mark_rule() before unlinking the rule from RCU-visible filter lists and waiting for a grace period. Concurrent readers in audit_filter() and audit_filter_rules() still dereference e->rule.exe, while the fsnotify mark can be freed on an independent lifetime path. The fix unlinks the rule from RCU-visible lists and invokes synchronize_rcu() before calling audit_remove_mark_rule() and other rule removal helpers.