CVE Catalog

A vulnerability in the Linux kernel's Bluetooth Human Interface Device Protocol (HIDP) handling has been addressed. The issue arose because the input report function did not properly check the length of the received data before processing it. This oversight could lead to out-of-bounds reads from the data buffer, especially if a paired device sent a truncated packet. Such out-of-bounds reads could be misinterpreted as phantom key presses or unintended mouse movements.

A use-after-free vulnerability has been identified in the Linux kernel's Bluetooth ISO socket implementation. The issue arises in the 'iso_recv_frame' function, where the connection's socket is accessed under a lock, but the lock is released before the socket is used, leaving a window for it to be freed by a concurrent operation. This leads to a use-after-free condition on the socket's state and received data queue. The vulnerability affects the Linux kernel stable tree.

A vulnerability in the Linux kernel's handling of Bluetooth ISO sockets can lead to a null pointer dereference or a use-after-free condition. This issue arises because the function 'iso_sock_close()' calls 'iso_sock_clear_timer()' before acquiring the necessary socket lock. 'iso_sock_clear_timer()' accesses the connection information twice without the socket lock, creating a race condition. Meanwhile, 'iso_conn_del()' operates under the socket lock and can nullify the connection reference, potentially dropping the last connection reference. The vulnerability has been addressed by synchronizing 'iso_sock_clear_timer()' with the socket lock, aligning it with the practices used in other related functions.

A use-after-free vulnerability has been identified in the Bluetooth subsystem of the Linux kernel, specifically within the connection synchronization process. The issue arises in the 'hci_le_create_cis_sync' function, where the 'conn->conn_timeout' is accessed after releasing both the 'rcu_read_lock' and 'hci_dev_lock'. This creates a window where a concurrent disconnect can free the 'hci_conn' structure, leading to a use-after-free read. The problem is exacerbated by the way pending commands are managed, as the cancellation mechanism cannot effectively prevent the issue. This vulnerability was discovered using an automated security auditing tool.

A vulnerability has been identified in the Linux kernel Xpad driver, specifically in the handling of input packets for Xbox One controllers. The issue arises in the 'xpadone_process_packet' function, where the length of the received data is used to access specific bytes related to the Share button. This creates a risk of out-of-bounds memory access, as a malfunctioning controller can send a packet with an actual length less than 18 bytes, leading to access beyond the intended array boundaries. The vulnerability has been addressed by implementing proper length checks and calculating offsets before accessing the data.

A race condition vulnerability has been identified in the Linux kernel's parport subsystem. This issue arises because port devices are registered before they are fully initialized, allowing client drivers, such as 'lp', to attach to ports that are not completely ready or are in the process of being torn down. This vulnerability can lead to system crashes, particularly when the port and client drivers are loaded as modules around the same time during boot. The problem was consistently reproduced in a virtual machine with a PC-style parallel port by patching the 'parport_pc' driver to simulate a probing failure. The vulnerability affects several versions of the Linux kernel.

A vulnerability exists in the Linux kernel's handling of the SVE Control Register (ZCR_EL2) for arm64 virtual machines. When a VHE guest hypervisor updates ZCR_EL2, the kernel improperly manages the ZCR_EL2.LEN field, which can disrupt software relying on its full, stateful representation. The issue arises because KVM treats ZCR_EL2 and ZCR_EL1 accesses inconsistently: ZCR_EL2 traps are immediately capped at the virtual machine's vector length limit, while ZCR_EL1 accesses are ignored. This mismanagement can allow an L2 guest to access vector lengths it shouldn't, particularly if the guest hypervisor uses ZCR_EL1 to update the register. The vulnerability has been addressed by ensuring that ZCR_EL2 is always programmed with a capped value, regardless of the access method, and by making ZCR_EL2 a sanitized register that only allows the LEN field to be stateful.

A vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) SEV (Secure Encrypted Virtualization) module has been addressed. This vulnerability involved Port I/O requests with a length of zero, which could cause issues when setting up the software scratch area. The kernel now explicitly ignores such requests, preventing potential underflows and allowing for warnings when the scratch area is configured with a length of zero.

A vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) SEV (Secure Encrypted Virtualization) implementation has been addressed. The issue arose in the management of the GHCB (Guest Hypervisor Communication Block) scratch area length when the area was located in the GHCB shared buffer. The vulnerability could lead to buffer overflows. The problem occurred because KVM initially handled the length correctly for most scenarios, but not for Page State Change (PSC) requests, where the length parameter only indicated the minimum required size. To rectify this, the length parameter has been renamed to better reflect its purpose, and the calculation of the scratch area length has been adjusted to prevent potential buffer overflows.

A vulnerability in the Linux kernel's KVM SEV (Secure Encrypted Virtualization) implementation has been addressed. This issue involved improper validation of Page State Change (PSC) request indices against the actual size of the buffer. When processing PSC requests, the kernel did not adequately check the PSC buffer against the effective size of the scratch area, which could be smaller than expected if the guest provided a pointer that was not aligned with the beginning of the GHCB (Guest Hypervisor Communication Block) shared buffer. This flaw could potentially lead to buffer-related errors or vulnerabilities.

A vulnerability in the Linux kernel's KVM SEV (Secure Encrypted Virtualization) module has been addressed. The issue involved a time-of-check-to-time-of-use (TOCTOU) vulnerability when reading entries from the guest-accessible Page State Change (PSC) buffer. This vulnerability could be exploited by misbehaving guests to interfere with the processing of PSC entries, potentially leading to incorrect behavior in virtual machine management.

A vulnerability exists in the Linux kernel's MediaTek MT6359 auxiliary ADC driver, specifically in the 'mt6358_read_imp()' function. The issue arises because the function reads a value into the variable 'val_v' using 'regmap_read()' without checking if the read operation was successful. If the read fails, 'val_v' remains uninitialized, and its random stack content is mistakenly reported as a measurement result. This flaw can lead to unintended data exposure. The vulnerability has been addressed by modifying the code to initialize 'val_v' to zero, ensuring that a predictable value is reported in the event of a bus failure. This change also prevents potential leakage of stack data and satisfies static analysis tools that may flag the variable as being used without initialization.

A vulnerability in the Linux kernel's NXP SAR ADC driver can lead to a division by zero error. This issue occurs when a user writes a zero or negative value to the sampling_frequency sysfs attribute, triggering the error in the kernel. The vulnerability also includes an unsigned integer underflow risk when the calculated cycle count is less than a specific conversion time, potentially wrapping the cycle count to a large value. The vulnerability affects the stable version of the Linux kernel.

A vulnerability exists in the ITG3200 gyroscope driver of the Linux kernel, specifically within the I2C reading function. The issue arises because the function 'itg3200_read_all_channels' incorrectly handles the buffer parameter, leading to a functional bug and an information leak. Instead of writing data into the caller's scan buffer, the I2C transfer overwrites a local stack slot, which is then discarded when the function returns. This mistake causes uninitialized data to be sent to userspace via the IIO device interface, while the actual sensor data is not delivered. The problem does not affect the non-buffered data reading method, which operates correctly.

A division by zero vulnerability has been identified in the Linux kernel's IIO gyro ADIS16260 driver. This issue arises when a user writes zero to the 'sampling_frequency' sysfs attribute, leading to a kernel panic due to the zero divisor. The vulnerability affects the Linux kernel stable group.

A vulnerability in the Linux kernel's handling of serial replies from the MH-Z19B CO2 sensor has been addressed. The issue arose because the 'mhz19b_receive_buf()' function did not properly check if incoming data chunks fit within the designated buffer, leading to potential buffer overflows. This flaw could allow oversized replies to overwrite important state information before the command processing could validate the response. The vulnerability has been fixed by adding checks to reject oversized replies and by resetting the reply state before each command, ensuring that the buffer is not improperly overwritten.

A division by zero vulnerability has been identified in the Linux kernel's SCD30 chemical sensor driver, specifically in the 'write_raw' function. This issue arises when a user writes a zero fractional part to the 'sampling_frequency' sysfs attribute, leading to a kernel crash. The vulnerability affects several versions of the Linux kernel.

A use-after-free vulnerability has been identified in the Linux kernel's IIO (Industrial Input/Output) buffer hardware consumer management. This issue arises in the 'iio_hw_consumer_alloc()' function, where the code improperly manages buffer references. During the error handling process, the function iterates through buffers using 'list_for_each_entry()'. While doing so, it calls 'iio_buffer_put()', which can free the current buffer if its reference count drops to zero. The iteration then attempts to access the next buffer in the list, leading to the potential use of a freed memory area. The vulnerability affects the Linux kernel stable group.

A memory leak vulnerability has been identified in the Linux kernel's IIO (Industrial I/O) subsystem, specifically within the buffer management component. The issue arises in the function 'iio_buffer_enqueue_dmabuf()', which improperly handles DMA (Direct Memory Access) fences. When this function is called, it allocates a DMA fence structure using 'kmalloc' and initializes its reference count. The function then adds the fence to a reservation object, increasing the reference count again, but fails to release the original reference before returning. This oversight causes a permanent memory leak with each buffer enqueue, as the initial allocation is never freed. The problem is exacerbated when multiple IIO devices are active, leading to a significant accumulation of unreleased memory allocations. This vulnerability has been addressed by modifying the function to properly release the fence reference after it has been added to the reservation object, ensuring that the memory is correctly managed and freed when no longer needed.

A memory corruption vulnerability has been identified in the Linux kernel's USB serial Omninet driver. This issue arises because the driver does not properly validate the size of bulk-out buffers before data transfer. If a malicious device reports a smaller maximum packet size than expected, it can lead to user-controlled slab corruption. The vulnerability affects several versions of the Linux kernel.

A use-after-free vulnerability has been identified in the Linux kernel's USB DWC2 driver, specifically within the debug code. This issue arises because the code improperly dereferences a USB request block (URB) after it has been handed back to the host controller, which can lead to undefined behavior or memory corruption. The vulnerability affects the stable versions of the Linux kernel.

A vulnerability exists in the Linux kernel's BPF sockmap implementation, specifically within the 'bpf_msg_push_data' helper function. This issue arises when data is inserted into the middle of a scatterlist entry, causing the entry to split into left and right fragments. The right fragment's offset is page-local, but the code incorrectly advances it using the message-global insertion point. This misalignment creates an inconsistent layout, particularly for inserts into non-first scatterlist entries. The vulnerability has been addressed by adjusting the right fragment offset to reflect the correct fragment-local delta, ensuring a consistent split layout.

A vulnerability in the Linux kernel's MACsec implementation allows for indefinite replay of frames under certain conditions. This issue arises when the packet number (PN) is at its maximum value, causing an overflow that disrupts proper sequence number handling. As a result, an attacker can capture and replay frames, exploiting the MACsec decryption process to reconstruct the same initialization vector (IV) and potentially interfere with secure communications.

A vulnerability has been addressed in the Linux kernel's handling of IPv6 hop-by-hop options. The issue arises because the 'ipv6_hop_jumbo' function modifies socket buffer (skb) pointers, which can disrupt the correct processing of network headers. This vulnerability affects the Linux kernel stable tree.

A vulnerability in the Linux kernel's OcteonTX2 AF mailbox handling can lead to an out-of-bounds write. The issue arises in the 'rvu_mbox_handler_rep_event_notify' function, where a sender-controlled 'REP_EVENT_NOTIFY' request body is queued and subsequently forwarded to various internal functions without proper bounds checking. This vulnerability affects Virtual Functions (VFs) attached to a Physical Function (PF) in switchdev representor mode, allowing for manipulation of memory and potential exploitation through crafted mailbox messages.

A vulnerability in the Linux kernel's IPv6 extension header processing has been addressed. The issue arose because the function 'ip6_parse_tlv()' cached the network header while processing IPv6 Type Length Values (TLVs). The 'ipv6_dest_hao()' function could modify the header for cloned socket buffers, potentially invalidating the cached header pointer. The vulnerability required the network header to be refreshed after 'ipv6_dest_hao()' was called, ensuring that any additional padding or TLVs were correctly processed. This update aligns with the established protocol for handling TLVs that can alter header information.

A vulnerability in the Linux kernel's Virtual Tunnel Interface version 6 (VTI6) management can lead to unauthorized packet injection across different tenant spaces on container hosts. This issue arises because the VTI6 tunnel update process does not correctly handle network namespace migrations, allowing an unprivileged user to manipulate tunnel parameters and intercept packets through a controlled network device.

A vulnerability in the Linux kernel's handling of IPv6 extension headers can lead to an unprivileged slab-out-of-bounds read. This issue arises in the 'ip6_datagram_recv_specific_ctl()' function, which processes certain control messages by relying on the 'hdrlen' byte from the header. The vulnerability exists because the length validation is only performed when parsing the header, not before the data is copied to the control message. An nftables payload-write expression can manipulate the 'hdrlen' value after parsing, creating an opportunity for exploitation. This vulnerability is accessible from an unprivileged user namespace.

A vulnerability in the Linux kernel's XFRM (IPsec transformation) module has been addressed. The issue involved improper management of network namespace references during deferred transport reinjection, which could lead to invalid memory access. The vulnerability was present in the stable branch of the Linux kernel.

A use-after-free vulnerability has been identified in the Linux kernel's L2TP (Layer 2 Tunneling Protocol) implementation. The issue arises in the function 'l2tp_session_get_by_ifname()', which can return a pointer to a session whose reference count has already reached zero. This occurs because the function uses 'refcount_inc()' to increase the reference count, leaving it vulnerable to a race condition. In contrast, other session retrieval functions in the same file properly use 'refcount_inc_not_zero()' to avoid such issues. The vulnerability can lead to a slab-use-after-free condition, where memory is freed while still being accessed, potentially causing memory corruption or other unintended behavior.

A vulnerability in the Linux kernel's VTI6 (Virtual Tunnel Interface version 6) implementation allows for a use-after-free condition. This issue arises from improper handling of network namespaces, which can be exploited by an unprivileged user in a container environment. The vulnerability was introduced in a previous commit that enabled namespace changing for VTI6 devices, but failed to maintain proper references during the transition, leaving stale entries that can be cleaned up improperly, potentially leading to memory corruption.

A vulnerability has been identified in the Linux kernel's Wacom HID driver, specifically in the function wacom_hid_set_device_mode(). The issue arises because the function incorrectly assumes that the HID_DG_INPUTMODE usage is always in the first field of the feature report. In reality, this usage can be in a different field. If it is not in the first field and the first field's report count is smaller than the usage index of HID_DG_INPUTMODE, an out-of-bounds write occurs. This vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's NFC HCI implementation allows for an out-of-bounds heap read. This issue arises in both the 'nfc_hci_recv_from_llc()' and 'nci_hci_data_received_cb()' functions, where 'packet->header' is read from 'skb->data' without verifying that the buffer contains at least one byte. A malicious NFC peer can send a 0-byte HCP frame that bypasses the SHDLC layer, leading to the out-of-bounds read. Additionally, if the 0-byte frame is sent as a non-final fragment, it causes the reassembly loop to underflow 'msg_len', resulting in a panic when the reassembled skb is processed.

A vulnerability in the Linux kernel's handling of XFRM_MSG_MIGRATE notifications has been identified. The issue arises because the migration notifications are hardcoded to the initial network namespace, rather than the namespace of the caller. This flaw affects the IKEv2 protocol's MOBIKE and address-update handling, particularly for daemons running in non-initial network namespaces.

A vulnerability in the Linux kernel's TCP connection tracking can force a connection into the CLOSE state using a RESET packet with an invalid sequence number. This issue arises because the connection tracking logic does not properly verify the direction of the packet in relation to the expected response. As a result, a crafted sequence of packets can prematurely terminate active network address translation (NAT) entries, disrupting ongoing connections.

A vulnerability has been identified in the Linux kernel's handling of the Encapsulating Security Payload (ESP) in both IPv4 and IPv6. The issue arises in the fast path of ESP processing, where the trailer is added before the destination page fragment is allocated. This can lead to improper handling of data lengths, potentially causing the skb_page_frag_refill() function to revert to using a single page, while the destination scatter-gather still covers the combined data length. The vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's IPTFS (In-Place Transport File System) implementation can lead to use-after-free and double-free errors. The issue arises in the xfrm subsystem, where the iptfs_clone_state function improperly clones runtime state data that should not be shared with the original Security Association (SA). This includes critical runtime objects such as the sk_buff_head (socket buffer head), hrtimers (high-resolution timers), spinlocks, and in-flight reassembly or reorder states. If the xfrm_state_migrate function fails after the state has been cloned but before it is properly initialized, the garbage-collected cloned state can inadvertently free socket buffers owned by the original IPTFS queue. This vulnerability affects several versions of the Linux kernel.

A use-after-free vulnerability has been addressed in the Linux kernel's dma-buf subsystem. This issue arises in the dma_buf_fd() function, where the file descriptor (fd) can be closed by a thread before the DMA_BUF_TRACE() macro is executed. This race condition leads to a slab-use-after-free scenario, as the tracepoint attempts to access the dma_buf after it has been freed. The vulnerability affects the Linux kernel stable tree, specifically in version 7.0.x.

A vulnerability has been identified in the Linux kernel's ksmbd component, specifically within the smb_check_perm_dacl() function. This issue arises from a transposed bounds check introduced in a previous commit, which effectively created dead code by allowing an invalid comparison that never breaks the loop. As a result, the function can read memory out-of-bounds, reopening a previously patched heap corruption issue. This out-of-bounds read occurs during SMB2_CREATE operations, potentially leading to memory disclosure or corruption.

A vulnerability has been identified in the Linux kernel's Atmel MXT touchscreen driver, specifically in the function that prepares configuration memory. The issue arises when a configuration file specifies an object size larger than what the driver recognizes. The current boundary check fails to properly discard the extra bytes, leading to a memory overwrite. This flaw allows the driver to unintentionally write over adjacent memory, potentially causing data corruption or other unintended behavior.

A double free vulnerability has been identified in the Linux kernel's UIO PCI Generic SVA implementation. The issue arises because the 'uio_pci_sva' function allocates memory for the 'uio_pci_sva_dev' structure using 'devm_kzalloc()' during the probe phase. However, it also calls 'kfree()' on this memory both when the probe encounters an error and during the device removal process. This explicit deallocation can lead to a double free situation, as 'devm_kzalloc()' allocations are automatically managed and freed when the device is detached. The vulnerability was discovered through static analysis and manual review, and has been addressed by removing the redundant 'kfree()' calls.

A use-after-free vulnerability has been identified in the Linux kernel's USB driver for the OMAP2430 platform. The issue arises in the 'omap2430_probe()' function, where the 'of_node_put(np)' call is made prematurely, before the last access to 'np'. This mismanagement can lead to a use-after-free condition if the reference count of the node drops to zero. The vulnerability affects the Linux kernel stable tree.

A use-after-free vulnerability has been identified in the Linux kernel's USBIP virtual USB device controller (VUDC) implementation. This issue arises in the 'vudc_remove' function, where the controller's data structure can be freed while a timer is still active, leading to a race condition. The vulnerability was reported by Zheng Wang and can be reproduced on an unpatched x86_64 QEMU guest with specific kernel configurations. The problem occurs when the 'vudc_remove' function is called, freeing the VUDC structure while a timer, initiated by 'v_start_timer' and 'v_kick_timer', is still pending or being executed. This mismanagement of the timer's lifecycle can be exploited, as confirmed by Kernel Address Sanitizer (KASAN) during testing.

A vulnerability has been identified in the Linux kernel USB Test and Measurement Class (USBTMC) driver, specifically in how it handles interrupt notifications from USBTMC devices. The driver fails to verify the presence of required two-byte header information before accessing data buffers. This oversight can lead to two potential issues: an out-of-bounds read, where the driver reads beyond the allocated buffer space, or the consumption of outdated data from a previous notification. The vulnerability arises when the actual length of the received data (URB actual_length) is insufficient to accommodate the headers, allowing for improper data handling and potential exploitation.

A vulnerability exists in the Belkin USB serial driver within the Linux kernel. The issue arises because the driver's interrupt callback misinterprets interrupt data as a four-byte status report, leading to potential out-of-bounds reads of status bytes. This flaw occurs because the interrupt-in buffer length is based on the endpoint's wMaxPacketSize, allowing short interrupt transfers to be processed incorrectly. The vulnerability has been addressed by adding a check for the actual length of the interrupt packet before parsing the status fields, ensuring that short transfers are ignored and do not cause invalid memory accesses. This vulnerability was reported using the Kernel Address Sanitizer (KASAN), which detected a slab-out-of-bounds error in the Belkin interrupt callback.

A vulnerability has been identified in the Linux kernel's USB serial Cypress M8 driver. The issue arises in the 'cypress_read_int_callback' function, which processes the interrupt-in buffer based on the chosen Cypress packet format. Format 1 requires a two-byte status/count header, while Format 2 needs a one-byte combined status/count header. The USB serial core allocates the interrupt-in buffer according to the endpoint descriptor's maximum packet size. However, successful interrupt transfers can be shorter than expected if the 'URB_SHORT_NOT_OK' flag is not set. This vulnerability allows for out-of-bounds reads of header bytes, as the driver does not properly validate the received packets before processing them. The kernel's AddressSanitizer (KASAN) has reported a slab-out-of-bounds error, indicating that the vulnerability could be exploited to read memory beyond the allocated buffer.

A memory corruption vulnerability has been identified in the Linux kernel's USB serial Digi Acceleport driver. This issue arises from the absence of proper sanity checks on the bulk-out buffer sizes, allowing for out-of-bounds memory accesses or slab corruption. The vulnerability can be exploited if a malicious device reports smaller buffer sizes than expected. The problem has been addressed by adding the necessary buffer size checks to prevent such memory corruption.

A vulnerability exists in the Linux kernel's USB serial Keyspan driver, specifically for the USA-49WG model. The issue arises from a missing sanity check on incoming data transfers, which can lead to the driver parsing outdated or uninitialized memory. This vulnerability has been addressed by adding the necessary checks to prevent such data from being processed.

A memory corruption vulnerability has been addressed in the Linux kernel's USB serial MXUport driver. The issue arose because the driver did not properly validate the maximum packet size of bulk-out endpoints, allowing user-controlled slab corruption. This could occur if a malicious device reported a smaller endpoint size, leading to memory corruption. The vulnerability affects several versions of the Linux kernel.

A memory corruption vulnerability has been identified in the Linux kernel's USB serial MCT U232 driver. This issue arises because the driver improperly overrides the maximum transfer size for devices that only accept 16-byte packets on their 32-byte bulk-out endpoints. The vulnerability can lead to slab corruption if a malicious device reports a smaller endpoint maximum packet size than expected.