CVE Catalog

A vulnerability in the Linux kernel's netlink handshake handling can lead to use-after-free issues. This occurs when a request is processed and the associated file reference is released before it can be safely used, allowing for the possibility of reading null or accessing freed memory. The issue arises because the file and socket structures are managed independently, creating a window where the file reference can be prematurely released. The vulnerability affects the Linux kernel stable tree.

A vulnerability exists in the Linux kernel's handling of netlink-based handshake requests. When a network namespace is destroyed, pending handshake requests that have not been accepted are not properly cleared, leaving references to socket files and allocated memory. This issue arises because the function responsible for draining these requests is not executed, leading to potential memory leaks or corruption. The vulnerability is caused by a reversal in the arguments of a list management function, which disrupts the intended flow of request handling. The problem is further complicated by a race condition that can corrupt the list of requests if a cancellation operation is performed concurrently.

A race condition vulnerability has been identified in the Linux kernel's DPLL (Digital Phase-Locked Loop) subsystem, specifically within the zl3073x driver. This vulnerability arises from the improper handling of device change notifications, which could lead to dereferencing a freed or null pointer during device teardown. The issue has been resolved by eliminating the change_work infrastructure and directly using the __dpll_device_change_ntf() function, which is now available for callers that hold the appropriate lock.

A vulnerability exists in the Linux kernel's Bluetooth implementation, specifically within the L2CAP (Logical Link Control and Adaptation Protocol) layer. The issue arises because the L2CAP Enhanced Credit-Based Mode reconfiguration response handler does not properly clear the channel identifier after a successful operation. This oversight allows a remote attacker, who has completed a reconfiguration as the peer, to replay a failure response using the outdated identifier. As a result, the kernel mistakenly matches the response to an existing channel and terminates it, causing a disruption in the established connection. This vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's Bluetooth implementation can lead to a crash when handling Enhanced Credit Based Connection Response packets. This issue arises in the L2CAP (Logical Link Control and Adaptation Protocol) layer, specifically when a destination CID (Channel Identifier) is received for an already-assigned channel. The Bluetooth specification requires both channels to be discarded, but the current implementation can invalidate the iteration cursor used to manage the channels, leading to a potential crash. The problem occurs in several versions of the Linux kernel.

A vulnerability in the Linux kernel's Bluetooth subsystem has been addressed. The issue involved the HCI (Host Controller Interface) synchronization process, specifically during the closing of Bluetooth devices. The vulnerability could lead to queuing timeouts while the device's workqueue was being drained. This issue was resolved by ensuring that the HCI_CMD_DRAIN_WORKQUEUE command was set during the device closure process, particularly since the closure can now occur during the reset phase.

A NULL pointer dereference vulnerability has been identified in the Linux kernel's Microsoft Azure Network Adapter (MANA) driver. This issue arises when queue allocation fails, leading to the error cleanup process freeing and nullifying certain pointers. Subsequent teardown operations can then inadvertently dereference these nullified pointers, causing a panic. The vulnerability is present in the Linux kernel stable tree, specifically in versions prior to the latest commit that addresses this issue.

A vulnerability in the Linux kernel's Microsoft Mana Ethernet driver can lead to null pointer dereferences during queue teardown. This issue occurs when the port is left in a detached state after a successful detach operation, but the subsequent attach attempt fails. In this scenario, the driver's transmit and receive queue pointers are freed, and an unconditional call to detach the port again causes a null pointer dereference. The vulnerability affects the Linux kernel stable tree.

A race condition vulnerability has been identified in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation. This issue arises in the 'sctp_wait_for_connect' function, which drops and re-acquires the socket lock while waiting for an association to reach the ESTABLISHED state. During this period, another thread can peel off the association to a new socket using the 'getsockopt(SCTP_SOCKOPT_PEELOFF)' option, inadvertently changing the association's socket reference. When the original socket lock is re-acquired, 'sctp_wait_for_connect' erroneously reports success without recognizing the migration. This oversight can lead to the association being accessed under the wrong lock in the 'sctp_datamsg_from_user' function, potentially causing data corruption or other unintended behavior.

A vulnerability in the Linux kernel's vsock/virtio implementation relates to improper handling of zero-copy user arguments in buffer management. The issue arises because the function that sends packet information allocates or reuses the zero-copy user argument before entering the sending loop. However, the function responsible for allocating the socket buffer still populates the buffer before it receives the user argument. This misalignment can lead to errors when the zero-copy feature, used with fixed-buffer vectored data, hits the maximum allowed fragments. In such cases, the system may partially attach managed fragments and return an error indicating that the message size is too large. The error handling process then attempts to free the buffer in a way that can inadvertently cause issues with fragment management. The vulnerability has been addressed by modifying the buffer allocation function to immediately bind the user argument before filling the buffer with data, ensuring that the management of buffer fragments is handled correctly and consistently.

A vulnerability in the Linux kernel's IPv6 routing can lead to a potential infinite loop, causing a CPU stall. This issue occurs in the 'rt6_fill_node' function, where improper handling of the 'fib6_siblings' list can create a soft lockup. The problem arises when writers holding the 'tb6_lock' remove entries from the 'fib6_siblings' list without waiting for RCU readers to finish, leaving the list in a state that the softirq-side walker cannot process, effectively stalling the CPU. The vulnerability affects the Linux kernel stable tree.

A vulnerability in the Linux kernel's IPv6 routing can lead to a potential infinite loop in the 'fib6_select_path' function. This issue arises from improper handling of the 'fib6_siblings' list, which can cause the routing logic to get stuck, especially under certain conditions of high next-hop churn. The problem was identified during an audit and is similar to a previously reported issue in the 'rt6_fill_node' function. The vulnerability affects the stable version of the Linux kernel.

A stack leak vulnerability has been identified in the Linux kernel's ST LSM6DSX IMU driver, specifically in the tagged FIFO buffer handling. The issue arises because the FIFO path declares a buffer on the stack with an alignment requirement but without an initializer. This oversight creates a gap in the data structure, leading to an unintentional leak of uninitialized data to userspace. When the driver copies a specified number of bytes (6 bytes) from the buffer, the uninitialized space between the data and the timestamp is exposed, potentially allowing for information leakage.

A vulnerability exists in the Linux kernel's IIO IMU ADIS16550 driver, where the trigger handler function does not properly initialize a stack-based data array. This oversight leads to a leak of uninitialized stack data to userspace. The issue arises because the memcpy function only populates the first 28 bytes of the array, leaving bytes 28-31 uninitialized. When the driver pushes data to buffers with a timestamp, the uninitialized bytes are included, creating a potential information leak.

A stack leak vulnerability has been identified in the Linux kernel's BMP280 pressure sensor driver, specifically in the BMP580 trigger handler. The issue arises because the handler declares a scan buffer on the stack without initializing it, and then copies 24-bit sensor data into 4-byte little-endian fields. This process leaves the high byte of the compensated temperature and pressure values uninitialized. As a result, two bytes of stack data are inadvertently exposed to userspace with each scan. This vulnerability is a regression from a previous version where the buffer was managed in private data, allowing for automatic zeroing. Although the BME280 handler was updated to address a similar issue, the BMP580 driver was overlooked because it lacked a padding hole, presenting instead a short-fill problem.

A denial-of-service vulnerability has been identified in the Linux kernel's USB Type-C UCSI CCG driver. The issue arises in the firmware update process, specifically within the 'do_flash()' function, which handles firmware images for USB Type-C controllers. When a firmware image lacks a ':' record header, the function improperly processes the image, leading to a kernel crash. This flaw can be exploited by a root user who places a crafted firmware file in the '/lib/firmware' directory and writes to the 'do_flash' sysfs attribute, triggering the crash.

A vulnerability in the Linux kernel's USB Type-C TCPM (Type-C Port Management) driver has been addressed. The issue involved improper validation of the VDO (Vendor Defined Object) count received from a device during the Discover Identity ACK process. This lack of validation could allow a device-controlled value to index into static arrays, potentially leading to data leakage.

A vulnerability in the Linux kernel's USB Type-C TCPM (Type-C Port Management) driver can lead to a buffer overflow in the altmode description array. This issue arises in the 'svdm_consume_modes' function, where the number of altmodes is checked against the array size only once before processing. While this oversight is typically harmless during normal SVID (Standard Vendor ID) discovery, it can be exploited by a malicious port partner. Such a partner can manipulate the altmode count and send additional VDOs (Vendor Defined Objects), causing the function to write past the allocated buffer. This vulnerability affects the Linux kernel stable tree.

A vulnerability in the Linux kernel's USB Type-C DisplayPort altmode handling has been addressed. A broken or malicious device can send an incorrect count for a status update VDO, leading the kernel to read uninitialized stack data and potentially expose it elsewhere. The vulnerability arises from insufficient validation of the count before processing the VDO update. This issue affects the stable versions of the Linux kernel.

A vulnerability in the Linux kernel's USB Type-C WCOVE driver allows for a buffer overflow in the Power Delivery (PD) message handling. The issue arises in the 'wcove_read_rx_buffer' function, where the PD RX FIFO is copied into a user-provided 'pd_message' structure. This operation can exceed the intended buffer size, leading to potential memory corruption. The vulnerability affects several versions of the Linux kernel.

A vulnerability exists in the Linux kernel's USB Type-C TCPCI Maxim driver, specifically in the handling of data objects transmitted from a port. A malicious or broken port can send a CRC-valid frame that claims to include up to seven data objects, but the actual content is less. This discrepancy can lead to the kernel reading from uninitialized stack memory. The vulnerability has been addressed by adding a validation check to ensure that the number of data objects matches what is advertised in the header, thereby preventing the erroneous reading from memory.

A vulnerability exists in the Linux kernel's USB Type-C UCSI driver, specifically in the 'ucsi_connector_change' function. This issue arises because the function does not properly validate the connector number received from the Port Partner Manager (PPM) before using it to access an internal array. As a result, a faulty or malicious PPM can manipulate the system to execute scheduled work on memory beyond the array's bounds, potentially leading to memory corruption. This vulnerability affects several versions of the Linux kernel.

A memory corruption vulnerability has been identified in the Linux kernel's USB serial 'safe_serial' driver. This issue arises when a malicious device reports a bulk-out buffer size smaller than eight bytes, leading to user-controlled slab corruption in 'safe' mode. The vulnerability is present in several versions of the Linux kernel.

A memory corruption vulnerability has been identified in the Linux kernel's USB serial Cypress M8 driver. This issue arises because the driver does not properly validate the maximum packet size of interrupt-out endpoints. If a malicious device reports a size smaller than eight bytes, it can lead to user-controlled memory corruption or a NULL-pointer dereference.

A vulnerability in the Linux kernel's virtual memory management can cause the system to improperly trigger a BUG() error when it should not. This issue arises in the __get_vm_area_node() function, which mistakenly interprets the context as being in_interrupt() when bottom halves are disabled. The problem can occur in bridge code that manipulates the hash lock, disabling bottom halves and then calling rhashtable_lookup_insert_fast(). This sequence leads to the allocation of memory via vmalloc(), which in turn calls __get_vm_area_node() and triggers the BUG() error. The vulnerability affects the Linux kernel stable tree.

A vulnerability in the Linux kernel's HPFS (High Performance File System) implementation can cause a system crash. This issue arises when the function 'hpfs_map_dnode_bitmap' fails, leaving the code to call 'hpfs_brelse4' on an uninitialized buffer. The problem has been addressed in the Linux kernel stable tree.

A memory leak vulnerability has been identified in the Linux kernel's handling of zone device pages during migration. When the function 'migrate_vma_insert_huge_pmd_page()' encounters a PMD check failure, it fails to free the allocated page table, leading to a memory leak. This issue affects the Linux kernel stable tree.

A vulnerability in the Linux kernel's handling of memory file descriptors (memfd) allows writable mappings to persist even when SEAL_WRITE is supposedly applied. This issue arises because the SEAL_EXEC seal, which implies SEAL_WRITE, is added after a check that prevents writable mappings. As a result, an attacker could exploit this behavior to modify a memfd that appears to be write-sealed. The vulnerability affects the Linux kernel's stable releases.

A use-after-free vulnerability has been identified in the Zram component of the Linux kernel. This issue arises from a race condition between the bio completion handler and the writeback task, leading to a NULL pointer dereference. The vulnerability is present in the stable versions of the Linux kernel.

A vulnerability in the Linux kernel's memory management system has been addressed. The issue arose because the 'nr_pages' variable was not properly initialized at the beginning of each loop iteration in the 'try_to_unmap_one' function. This oversight allowed the 'nr_pages' value, calculated by a previous 'folio_unmap_pte_batch' call, to be incorrectly reused in later iterations that did not invoke 'folio_unmap_pte_batch' again. The vulnerability was particularly problematic with device-exclusive mappings of anonymous, droppable large folios, leading to corruption of the folio's reference and map counts. The flaw was introduced during the implementation of batched unmapping for lazy-free large folios, as device-exclusive handling only applies to anonymous folios.

A vulnerability in the Linux kernel's auxdisplay line-display driver can lead to an out-of-bounds read. This issue arises because the 'linedisp_display' function reads the message buffer without checking if the length is zero. Writing a zero-length message to the sysfs attribute triggers this flaw, as the kernel's write buffer allocation allows for an invalid read. On kernels with KASAN enabled, this out-of-bounds access is reported and causes a panic. However, on standard kernels, it quietly reads adjacent memory, potentially leading to further issues. This vulnerability affects all auxdisplay drivers registered through 'linedisp_register' or 'linedisp_attach', including ht16k33, max6959, img-ascii-lcd, and seg-led-gpio.

A vulnerability in the Linux kernel's Bluetooth L2CAP implementation has been addressed. The issue involved a channel reference leak in the function 'l2cap_chan_timeout()'. When the channel connection was NULL, the function returned early without releasing a held reference, causing a memory leak. The vulnerability affected the stable Linux kernel versions prior to the fix, which is available in the Linux stable tree.

A vulnerability in the Linux kernel's Bluetooth Human Interface Device Protocol (HIDP) handling has been addressed. The issue arose because the input report function did not properly check the length of the received data before processing it. This oversight could lead to out-of-bounds reads from the data buffer, especially if a paired device sent a truncated packet. Such out-of-bounds reads could be misinterpreted as phantom key presses or unintended mouse movements.

A use-after-free vulnerability has been identified in the Linux kernel's Bluetooth ISO socket implementation. The issue arises in the 'iso_recv_frame' function, where the connection's socket is accessed under a lock, but the lock is released before the socket is used, leaving a window for it to be freed by a concurrent operation. This leads to a use-after-free condition on the socket's state and received data queue. The vulnerability affects the Linux kernel stable tree.

A vulnerability in the Linux kernel's handling of Bluetooth ISO sockets can lead to a null pointer dereference or a use-after-free condition. This issue arises because the function 'iso_sock_close()' calls 'iso_sock_clear_timer()' before acquiring the necessary socket lock. 'iso_sock_clear_timer()' accesses the connection information twice without the socket lock, creating a race condition. Meanwhile, 'iso_conn_del()' operates under the socket lock and can nullify the connection reference, potentially dropping the last connection reference. The vulnerability has been addressed by synchronizing 'iso_sock_clear_timer()' with the socket lock, aligning it with the practices used in other related functions.

A use-after-free vulnerability has been identified in the Bluetooth subsystem of the Linux kernel, specifically within the connection synchronization process. The issue arises in the 'hci_le_create_cis_sync' function, where the 'conn->conn_timeout' is accessed after releasing both the 'rcu_read_lock' and 'hci_dev_lock'. This creates a window where a concurrent disconnect can free the 'hci_conn' structure, leading to a use-after-free read. The problem is exacerbated by the way pending commands are managed, as the cancellation mechanism cannot effectively prevent the issue. This vulnerability was discovered using an automated security auditing tool.

A vulnerability has been identified in the Linux kernel Xpad driver, specifically in the handling of input packets for Xbox One controllers. The issue arises in the 'xpadone_process_packet' function, where the length of the received data is used to access specific bytes related to the Share button. This creates a risk of out-of-bounds memory access, as a malfunctioning controller can send a packet with an actual length less than 18 bytes, leading to access beyond the intended array boundaries. The vulnerability has been addressed by implementing proper length checks and calculating offsets before accessing the data.

A race condition vulnerability has been identified in the Linux kernel's parport subsystem. This issue arises because port devices are registered before they are fully initialized, allowing client drivers, such as 'lp', to attach to ports that are not completely ready or are in the process of being torn down. This vulnerability can lead to system crashes, particularly when the port and client drivers are loaded as modules around the same time during boot. The problem was consistently reproduced in a virtual machine with a PC-style parallel port by patching the 'parport_pc' driver to simulate a probing failure. The vulnerability affects several versions of the Linux kernel.

A vulnerability exists in the Linux kernel's handling of the SVE Control Register (ZCR_EL2) for arm64 virtual machines. When a VHE guest hypervisor updates ZCR_EL2, the kernel improperly manages the ZCR_EL2.LEN field, which can disrupt software relying on its full, stateful representation. The issue arises because KVM treats ZCR_EL2 and ZCR_EL1 accesses inconsistently: ZCR_EL2 traps are immediately capped at the virtual machine's vector length limit, while ZCR_EL1 accesses are ignored. This mismanagement can allow an L2 guest to access vector lengths it shouldn't, particularly if the guest hypervisor uses ZCR_EL1 to update the register. The vulnerability has been addressed by ensuring that ZCR_EL2 is always programmed with a capped value, regardless of the access method, and by making ZCR_EL2 a sanitized register that only allows the LEN field to be stateful.

A vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) SEV (Secure Encrypted Virtualization) module has been addressed. This vulnerability involved Port I/O requests with a length of zero, which could cause issues when setting up the software scratch area. The kernel now explicitly ignores such requests, preventing potential underflows and allowing for warnings when the scratch area is configured with a length of zero.

A vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) SEV (Secure Encrypted Virtualization) implementation has been addressed. The issue arose in the management of the GHCB (Guest Hypervisor Communication Block) scratch area length when the area was located in the GHCB shared buffer. The vulnerability could lead to buffer overflows. The problem occurred because KVM initially handled the length correctly for most scenarios, but not for Page State Change (PSC) requests, where the length parameter only indicated the minimum required size. To rectify this, the length parameter has been renamed to better reflect its purpose, and the calculation of the scratch area length has been adjusted to prevent potential buffer overflows.

A vulnerability in the Linux kernel's KVM SEV (Secure Encrypted Virtualization) implementation has been addressed. This issue involved improper validation of Page State Change (PSC) request indices against the actual size of the buffer. When processing PSC requests, the kernel did not adequately check the PSC buffer against the effective size of the scratch area, which could be smaller than expected if the guest provided a pointer that was not aligned with the beginning of the GHCB (Guest Hypervisor Communication Block) shared buffer. This flaw could potentially lead to buffer-related errors or vulnerabilities.

A vulnerability in the Linux kernel's KVM SEV (Secure Encrypted Virtualization) module has been addressed. The issue involved a time-of-check-to-time-of-use (TOCTOU) vulnerability when reading entries from the guest-accessible Page State Change (PSC) buffer. This vulnerability could be exploited by misbehaving guests to interfere with the processing of PSC entries, potentially leading to incorrect behavior in virtual machine management.

A vulnerability exists in the Linux kernel's MediaTek MT6359 auxiliary ADC driver, specifically in the 'mt6358_read_imp()' function. The issue arises because the function reads a value into the variable 'val_v' using 'regmap_read()' without checking if the read operation was successful. If the read fails, 'val_v' remains uninitialized, and its random stack content is mistakenly reported as a measurement result. This flaw can lead to unintended data exposure. The vulnerability has been addressed by modifying the code to initialize 'val_v' to zero, ensuring that a predictable value is reported in the event of a bus failure. This change also prevents potential leakage of stack data and satisfies static analysis tools that may flag the variable as being used without initialization.

A vulnerability in the Linux kernel's NXP SAR ADC driver can lead to a division by zero error. This issue occurs when a user writes a zero or negative value to the sampling_frequency sysfs attribute, triggering the error in the kernel. The vulnerability also includes an unsigned integer underflow risk when the calculated cycle count is less than a specific conversion time, potentially wrapping the cycle count to a large value. The vulnerability affects the stable version of the Linux kernel.

A vulnerability exists in the ITG3200 gyroscope driver of the Linux kernel, specifically within the I2C reading function. The issue arises because the function 'itg3200_read_all_channels' incorrectly handles the buffer parameter, leading to a functional bug and an information leak. Instead of writing data into the caller's scan buffer, the I2C transfer overwrites a local stack slot, which is then discarded when the function returns. This mistake causes uninitialized data to be sent to userspace via the IIO device interface, while the actual sensor data is not delivered. The problem does not affect the non-buffered data reading method, which operates correctly.

A division by zero vulnerability has been identified in the Linux kernel's IIO gyro ADIS16260 driver. This issue arises when a user writes zero to the 'sampling_frequency' sysfs attribute, leading to a kernel panic due to the zero divisor. The vulnerability affects the Linux kernel stable group.

A vulnerability in the Linux kernel's handling of serial replies from the MH-Z19B CO2 sensor has been addressed. The issue arose because the 'mhz19b_receive_buf()' function did not properly check if incoming data chunks fit within the designated buffer, leading to potential buffer overflows. This flaw could allow oversized replies to overwrite important state information before the command processing could validate the response. The vulnerability has been fixed by adding checks to reject oversized replies and by resetting the reply state before each command, ensuring that the buffer is not improperly overwritten.

A division by zero vulnerability has been identified in the Linux kernel's SCD30 chemical sensor driver, specifically in the 'write_raw' function. This issue arises when a user writes a zero fractional part to the 'sampling_frequency' sysfs attribute, leading to a kernel crash. The vulnerability affects several versions of the Linux kernel.

A use-after-free vulnerability has been identified in the Linux kernel's IIO (Industrial Input/Output) buffer hardware consumer management. This issue arises in the 'iio_hw_consumer_alloc()' function, where the code improperly manages buffer references. During the error handling process, the function iterates through buffers using 'list_for_each_entry()'. While doing so, it calls 'iio_buffer_put()', which can free the current buffer if its reference count drops to zero. The iteration then attempts to access the next buffer in the list, leading to the potential use of a freed memory area. The vulnerability affects the Linux kernel stable group.