CVE Vulnerability Catalog

In the Linux kernel, a vulnerability in the ACPI Button driver causes a GPE handler leak during driver removal. This can lead to kernel crashes and failure to re-probe the device.

A vulnerability in the Linux kernel's SFB network scheduler can cause a kernel panic when SFB has child qdiscs (e.g., QFQ) with qdisc_peek_dequeued() peek callback. The parent scheduler (e.g., TBF) calls dequeue() directly instead of using qdisc_dequeue_peeked(), leading to a null-pointer dereference.

In the Linux kernel's netfilter nf_tables subsystem, a vulnerability was found where destination (dst) data gets corrupted during bit shift operations (lshift/rshift) on the same register. When source (src) and destination (dst) point to the same memory location, the carry value is incorrectly calculated using already modified data, leading to incorrect operation results.

A memory leak vulnerability was found in the Linux kernel's ethtool RSS functionality. The rss_prepare_get() function allocates buffers for the indirection table and hash key but fails to free them if the ops->get_rxfh() call fails.

In the Linux kernel, a vulnerability was found where ethnl_ops_complete() is skipped on module flash errors via ethtool. When validate() fails, the completion function is not called even though ethnl_ops_begin() was already invoked.

In the Linux kernel, a vulnerability was found in the module_flash_fw_schedule() function of ethtool, which fails to undo the 'in_progress' flag and release the netdev reference on module flash errors. Delaying these acquisitions prevents the device from disappearing while holding rtnl_lock.

In the Linux kernel Bluetooth 6lowpan stack, send_mcast_pkt() does not check the return value of skb_clone(). If memory allocation fails, skb_clone() returns NULL, leading to a NULL pointer dereference in send_pkt() when accessing skb->data.

A vulnerability in the Linux kernel allows enslaving a CAN interface (e.g., vxcan) to a bonding master. This process corrupts CAN data structures, causing a null-pointer dereference and system crash. The issue stems from missing device type validation before enslaving.

A bug in the Linux kernel bridge caused a sleeping function (dev_set_promiscuity()) to be called in an atomic context. The issue occurred during Netlink-based bridge port configuration when the bridge lock was held longer than necessary, covering operations that do not require it.

A bug was found in the Linux kernel's brport_store() function in the bridge sysfs path, causing a call to a sleeping function (dev_set_promiscuity()) in an atomic context. The issue stemmed from unnecessarily holding the bridge lock while processing many port attributes that do not require it. The fix reduces the lock scope to only STP-related attributes that actually need it.

In the Linux kernel, a vulnerability in the ethtool tsinfo function passes an ERR_PTR to genlmsg_cancel on dump preparation failure, potentially causing a system crash.

In the Linux kernel's MANA network driver, NULL pointer guards are missing in the teardown path after a partial queue allocation failure. Freed pointers are later dereferenced in functions like mana_chn_setxdp(), mana_destroy_vport(), mana_fence_rqs(), and mana_dealloc_queues(), causing a kernel panic.

In the ADIS16550 driver for the Linux kernel, a stack data leak was discovered in the trigger handler. The scan data array declared on the stack is not initialized, and memcpy fills only the first 28 bytes, leaving bytes 28-31 uninitialized, causing data leak to userspace on every trigger.

In the Linux kernel BMP280 driver, a stack leak was found in the BMP580 trigger handler. The scan buffer declared on the stack without initialization causes two uninitialized bytes to be pushed to userspace per scan.

In the Linux kernel's USB Type-C UCSI CCG driver, a vulnerability exists due to missing validation of firmware image headers. If the firmware image lacks a ':' character, strnchr() returns NULL, leading to a NULL pointer dereference and system crash (oops).

In the Linux kernel, a vulnerability in the USB Type-C TCPM driver lacks validation of the VDO count in Discover Identity ACK handlers, potentially causing out-of-bounds array access. An attacker via USB-C could supply a malformed VDO count, leading to kernel memory disclosure.

In the Linux kernel USB Type-C TCPM driver, a vulnerability was found due to missing bounds checking of the altmode_desc[] array inside the loop of svdm_consume_modes(). An untrusted device can send unsolicited ACK responses, causing out-of-bounds memory write.

A vulnerability was found in the Linux kernel's DisplayPort alternate mode driver for USB Type-C. A broken or malicious device can send an incorrect count in a status update VDO, causing the kernel to read uninitialized stack data and forward it elsewhere.

In the Linux kernel USB Type-C driver, a vulnerability was found where wcove_read_rx_buffer() writes past the pd_message structure. A malicious device can send a 31-byte PD frame, causing out-of-bounds write on the IRQ thread stack.

In the Linux kernel, the USB Type-C TCPM/TCPCI Maxim driver lacked validation of the number of data objects advertised in the frame header against the actual received byte count. A broken or malicious port could send a CRC-valid frame with a header claiming up to seven data objects but with fewer bytes, leading to reading from uninitialized stack memory.