CVE Vulnerability Catalog

In the Linux kernel, in the Bluetooth subsystem (mgmt), a use-after-free vulnerability was found in pair command cancellation. The pairing completion and authentication failure callbacks look up the pending MGMT_OP_PAIR_DEVICE command by walking hdev->mgmt_pending, but without holding mgmt_pending_lock for the later dereference and removal. A concurrent MGMT_OP_CANCEL_PAIR_DEVICE request can remove and free the same pending command before the callback uses it. The fix transfers ownership of the pending command by removing it from hdev->mgmt_pending while holding mgmt_pending_lock, and the callbacks and cancel path then complete and free it directly.

A use-after-free vulnerability was found in the Linux kernel's Bluetooth subsystem (hci_sync). The hci_find_adv_instance() function returns a pointer to advertising data that is only valid while hdev->lock is held, but the HCI command-sync paths use it without that lock, which can lead to use of freed memory during an advertising termination event.

In the Linux kernel, in the Bluetooth HIDP subsystem, a vulnerability was found where data is read before checking if the frame contains a transaction header. The functions hidp_recv_ctrl_frame() and hidp_recv_intr_frame() read skb->data[0] before checking that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty basic-mode SDU, leading to use of an uninitialized byte. The fix pulls the transaction header with skb_pull_data() and discards frames that do not contain it.

In the Linux kernel, in the Bluetooth HIDP subsystem, a vulnerability was found where numbered report payloads are not validated. When hidp_get_raw_report() waits for a numbered report, hidp_process_data() compares the expected report number with skb->data[0]. A connected HIDP peer can reply with only a DATA transaction header, leaving the skb empty after the header is removed. The fix requires a payload byte before comparing a numbered report ID; unnumbered reports continue to accept an empty payload.

A Use-After-Free (UAF) vulnerability has been found in the Linux kernel's afs_make_call() function in the AFS filesystem. The issue arises from a race condition between sending asynchronous calls and their destruction, potentially leading to access to freed memory. The bug was reported by KASAN during tests with random CPU offlining.

A vulnerability was found in the Linux kernel's ALSA timer subsystem. The SNDRV_TIMER_IFLG_DEAD flag is never cleared after a close operation completes, leading to a use-after-free when the same timer instance is reopened. An attacker with access to /dev/snd/timer and /dev/snd/seq can trigger this to escalate privileges or cause a system crash.

In the Linux kernel, ALSA USB-audio lacks clamping of frame size in implicit-feedback mode. Received sync packet sizes are not limited to the maximum frame size, potentially causing packet transfers beyond hardware limits.

In the Linux kernel, the fou_create() function has a use-after-free vulnerability. The fou structure is published via sk_user_data before adding the port to the list, and on error it is freed while still reachable, allowing concurrent reads of freed memory.

In netfilter ipset, there is an issue with updating comments from kernel-side operations. During table resize, comment pointers are copied, and a packet-side update can free a shared comment, leading to use of a dangling pointer.

In TIPC, there is a use-after-free vulnerability in tipc_poll() during queue dumps via tracepoints. The tracepoint call without holding a lock allows access to freed packets.

In the Linux kernel's mac80211 subsystem, a use-after-free vulnerability was found in ieee80211_stop_tx_ba_cb(). After stopping a BA session, the tid_tx structure is freed via kfree_rcu(), and then the tid_tx->ndp field is read without proper RCU protection, potentially accessing freed memory. The issue occurs during local session teardown, e.g., on idle timeout, PTK rekey, suspend, or HW reconfig.

In the Linux kernel, the mwifiex driver has a vulnerability where the A-MSDU parent frame length is used instead of the subframe length when parsing TDLS frames. This leads to a use-after-free or out-of-bounds read, potentially exploitable by a remote attacker.

In the Linux kernel's binfmt_misc module, a vulnerability allows an out-of-bounds read when the user-chosen field delimiter is also a flag character (P, O, C, or F). The flag parser fails to stop at the buffer padding and reads past the allocated memory. This is reachable by unprivileged users in a user namespace.

A vulnerability was found in the Linux kernel's huge page splitting mechanism in mm/huge_memory. After splitting a folio, the code still accessed the mapping structure (i_mmap_rwsem) after the split folios were unlocked and freed, leading to a use-after-free. This occurs especially during memory failure handling for poisoned tails of shmem folios.

A use-after-free (UAF) vulnerability was found in the Linux kernel during system suspend (S3) or hibernation (S4). The page reporting work (page_reporting_process) was scheduled on the global system_wq, which lacks the WQ_FREEZABLE flag, leaving it active during suspend and causing access to deleted virtqueues, leading to a crash. The fix switches to system_freezable_wq, which is frozen before device drivers destroy their virtqueues.

A use-after-free vulnerability has been found in the Linux kernel's pktgen module. The issue involves a race between network device renaming and removal of the /proc entry, which can lead to accessing freed memory by the kpktgend thread.

In the Linux kernel, the tracing module's trace_module_add_events() function ignores the return value of __register_event() and unconditionally calls __add_event_to_tracers(). If event registration fails, it can lead to a use-after-free.

In the Linux kernel, the scsi_debug module's resp_report_zones() function has an underflow vulnerability in alloc_len calculations, which on 32-bit systems can lead to an out-of-bounds write and kernel panic.

In the Linux kernel, the SCTP module's sctp_assoc_add_peer() function increments the 16-bit transport_count, which can wrap to zero after adding 65,536 unique peers. This can lead to an out-of-bounds write in SCTP diagnostics (sock_diag).

In the Linux kernel, the s390/qeth module lacks a CAP_NET_ADMIN check for private ioctls (SIOCDEVPRIVATE), allowing unprivileged users to invoke these commands.