CVE Catalog

A vulnerability exists in the Linux kernel's USB serial Keyspan driver, specifically for the USA-49WG model. The issue arises from a missing sanity check on incoming data transfers, which can lead to the driver parsing outdated or uninitialized memory. This vulnerability has been addressed by adding the necessary checks to prevent such data from being processed.

A memory corruption vulnerability has been addressed in the Linux kernel's USB serial MXUport driver. The issue arose because the driver did not properly validate the maximum packet size of bulk-out endpoints, allowing user-controlled slab corruption. This could occur if a malicious device reported a smaller endpoint size, leading to memory corruption. The vulnerability affects several versions of the Linux kernel.

A memory corruption vulnerability has been identified in the Linux kernel's USB serial MCT U232 driver. This issue arises because the driver improperly overrides the maximum transfer size for devices that only accept 16-byte packets on their 32-byte bulk-out endpoints. The vulnerability can lead to slab corruption if a malicious device reports a smaller endpoint maximum packet size than expected.

A vulnerability in the Linux kernel's USB serial MCT U232 driver has been addressed by adding a missing sanity check for interrupt-in transfer sizes. This vulnerability could lead to the driver parsing outdated or uninitialized memory, potentially leaking sensitive information to user space. The issue was introduced in Linux version 2.6.12-rc2 and has been fixed in the stable branch.

An integer underflow vulnerability has been identified in the WebUSB GET_URL handler of the Linux kernel's USB gadget composite driver. This issue arises when the host-supplied wLength is smaller than the WebUSB URL descriptor header length, causing an unsigned subtraction to wrap. As a result, the handler inadvertently copies nearly UINT_MAX bytes from the landing page into the request buffer, leading to a slab-out-of-bounds error. This vulnerability can be exploited by a USB host sending a SETUP packet to a gadget with WebUSB enabled and a landing page configured.

A vulnerability in the Linux kernel's FunctionFS USB gadget implementation allows uninitialized memory to be sent to userspace. This issue arises because the control-OUT data buffer is allocated with kmalloc() using the length specified in the Setup packet. The function then copies the entire length to userspace, regardless of the actual bytes received. As a result, any uninitialized slab residue from the buffer is delivered to the FunctionFS daemon. This vulnerability is present in the Linux kernel stable tree and affects several versions.

A use-after-free vulnerability has been identified in the Linux kernel's USB gadget FunctionFS implementation, specifically within the DMABUF handling. The issue arises because the function 'ffs_epfile_dmabuf_io_complete' frees a USB request but leaves a pointer to the freed memory, creating a race condition. This freed pointer can be accessed later, leading to undefined behavior. The vulnerability was reproduced under the Kernel Address Sanitizer (KASAN) on both detach and close paths, indicating that the issue can be triggered during normal operation of the FunctionFS DMABUF interface.

A vulnerability exists in the Linux kernel's Thunderbolt driver, specifically in the property handling for XDomain peers. The issue arises because the 'value' field, which is a 32-bit unsigned integer, can be manipulated to wrap around when combined with the 'length' field, a 16-bit unsigned integer. This wrapping allows a malicious XDomain peer to bypass validation checks and access memory beyond allocated boundaries. The vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's Thunderbolt property handling has been addressed. The issue involved improper validation of the 'dir_len' property, which could lead to a size_t underflow and out-of-bounds memory access. This vulnerability was present in the non-root path of the Thunderbolt driver, where the 'dir_len' was taken from an entry's length. If the length was less than 4, it could bypass validation and cause the UUID copy process to read beyond the intended memory block, potentially leading to kernel crashes or memory corruption.

A denial-of-service vulnerability has been identified in the Linux kernel's Thunderbolt property handling. The issue arises in the 'property' parser, where a DIRECTORY entry's value is used as the directory offset for recursive calls into the parsing function, '__tb_property_parse_dir()', without any depth counter. This flaw allows a malicious peer to create a back-referencing loop by chaining DIRECTORY entries, causing the parser to recursively process the entries until the kernel stack is exhausted and the guard page is triggered. This vulnerability can be exploited by any untrusted XDomain peer, such as a cable, dock, in-line inspector, or adjacent host, during the PROPERTIES_REQUEST control-plane exchange, and does not require authentication.

A denial-of-service vulnerability has been identified in the Linux kernel's SCSI FCoE subsystem. The issue arises in the FCoE control VLAN, where the CVL walker function improperly handles FIP descriptors with a length of zero. This oversight allows an unauthenticated L2 peer to disrupt FCoE initiators by sending a malformed FIP CVL frame. The vulnerability exists in several versions of the Linux kernel.

A denial-of-service vulnerability has been identified in the Linux kernel's Fibre Channel transport component. This issue arises from the Link-Integrity and Peer-Congestion FPIN walkers, which improperly handle the pname_count field, leading to an infinite loop. The vulnerability can be exploited by an adjacent Fibre Channel fabric actor that delivers an FPIN ELS frame to a vulnerable Linux initiator, such as those using the lpfc or qla2xxx drivers. The attacker must be able to inject fabric traffic, potentially through a compromised switch or fabric controller, or as a same-zone N_Port on a fabric that allows source spoofing.

A vulnerability in the Linux kernel's iSCSI target implementation has been addressed. This issue involves a buffer overread and a double-free condition in the Text-phase command handler. The buffer overread occurs when the DataDigest CRC is processed, leading to a read operation that exceeds the allocated memory. This flaw, present since the initial integration of iSCSI support in version 4.1, can be reproduced using the Kernel Address Sanitizer (KASAN) tool. The double-free issue arises when a Text Request is dropped due to a DataDigest mismatch, causing the same memory to be freed multiple times, which can lead to memory corruption or a remote kernel bug on certain system configurations.

A heap buffer overflow vulnerability has been identified in the Linux kernel's SCSI target iSCSI implementation. The issue arises in the 'iscsi_encode_text_output' function, which concatenates 'key=value' records into a response buffer allocated 8192 bytes via 'kzalloc'. The function's three 'sprintf' call sites do not check the remaining buffer capacity, leading to a potential overflow. While the input Login PDU payload is bounded, a single PDU can carry up to 2048 'a=b' pairs, each unknown key expanding to a 16-byte output record. This can result in 32 KiB of output being written into an 8 KiB buffer, causing approximately 24 KiB of heap memory to be overwritten.

A vulnerability in the Linux kernel's iSCSI target implementation allows for improper validation of CHAP_R length in BASE64-encoded responses. The issue arises in the chap_server_compute_hash() function, where the input length is not checked before decoding, leading to potential buffer overflows. With MAX_RESPONSE_LENGTH set to 128, up to 127 BASE64 characters can be processed, which can exceed the allocated digest size and cause memory corruption. This vulnerability affects several versions of the Linux kernel.

A race condition vulnerability has been identified in the Linux kernel's Direct Rendering Manager (DRM) Graphics Execution Manager (GEM) handling. The issue arises in the 'drm_gem_change_handle_ioctl' function, where the old handle remains active in the IDR (Identifier Radix Tree) during the interval between unlocking and relocking the table. This creates a window of opportunity for a concurrent 'drm_gem_handle_delete' operation on the old handle to succeed, reducing the handle count to zero and freeing the GEM object, even while the new handle's IDR entry still points to it. The vulnerability has been addressed by nullifying the old handle's IDR entry before releasing the table lock, ensuring that any simultaneous 'GEM_CLOSE' operation on the old handle receives a NULL reference and returns an error. The old entry is restored if an error occurs during the handling process.

A use-after-free vulnerability has been identified in the Linux kernel's Intel graphics driver (drm/i915) within the memory management component for buffer objects (TTM). This issue affects several versions of the Linux kernel and can lead to a general protection fault, particularly under heavy use on affected hardware. The vulnerability arises because the TTM page vector container, which is crucial for managing memory pages of graphics objects, can be replaced while a pointer to the original container is still in use. This flaw allows for the potential dereference of a file pointer field of a TTM page vector container associated with an object being purged on eviction, creating a window for exploitation.

A kfifo underflow vulnerability has been identified in the Linux kernel's Qcom GenI serial driver. This issue arises when the 'uart_flush_buffer()' function is called before the DMA completion interrupt is processed, creating a race condition. The problem occurs as follows: DMA transmission begins with 'tx_remaining' bytes, and the kfifo buffer holds the same number of bytes. Once the DMA completes in hardware, the interrupt is still pending. If 'uart_flush_buffer()' is executed at this point, it resets the kfifo length to zero while 'tx_remaining' remains unchanged. When the DMA interrupt finally arrives, it attempts to advance the transmission on an empty kfifo, leading to a situation where the kfifo length inaccurately reports available data. This miscalculation causes the next DMA transfer to include outdated buffer data, potentially disrupting the intended data transmission process.

A NULL pointer dereference vulnerability has been identified in the Linux kernel's AMD GPU driver (AMDKFD). This issue arises in the 'svm_range_set_attr' function, where the 'process_info' variable can be NULL if the user does not call 'kfd_ioctl_acquire_vm' before 'kfd_ioctl_svm'. This vulnerability has been addressed by adding a check to ensure 'process_info' is valid before proceeding, preventing potential crashes or undefined behavior.

An integer overflow vulnerability has been fixed in the Linux kernel's AMD KFD (Kernel Fusion Driver) debugger. The issue arose in the `get_queue_ids()` function, which calculated the size of an array based on the number of queues. This calculation could overflow on 32-bit systems, leading to potential memory corruption or other unintended behavior. The vulnerability has been addressed by using a safer method that prevents overflow by saturating the value to the maximum size allowed.

A denial-of-service vulnerability has been identified in the Linux kernel's AMDGPU graphics driver. The issue arises in the GEM operation 'AMDGPU_GEM_OP_GET_MAPPING_INFO' within the 'amdgpu_gem_op_ioctl' function. When the function attempts to allocate memory using 'kvcalloc()', a failure can occur, returning an 'ENOMEM' error. This failure path, however, bypasses the necessary cleanup process, leading to a leak of three critical resources: a reference to the GEM object, a lock on the executed GEM, and a lock on the per-process virtual memory root page directory. The leaked lock on the virtual memory directory is particularly problematic, as it blocks any subsequent operations on the same virtual memory, such as further GEM operations or command submissions, creating a local denial-of-service condition for the affected GPU context. This vulnerability can be exploited by any process with access to the '/dev/dri/renderD*' devices.

A vulnerability in the Linux kernel's AMD GPU driver has been addressed. The issue arose in the page retrieval function for the Heterogeneous Memory Management (HMM) range, where the notifier sequence could be read multiple times, potentially leading to the use of invalid pages. This vulnerability affects the Linux kernel stable tree.

A vulnerability in the Linux kernel's AMD GPU driver allows for memory allocation issues in the GEM_OP GET_MAPPING_INFO operation. The vulnerability arises because the driver does not properly validate the user-supplied entry count, leading to potential memory allocations that exceed system limits. This flaw can cause a kernel warning and, on systems configured to panic on warnings, a complete system crash. The issue has been addressed by implementing a size check to prevent excessive entry counts from causing harmful allocations.

A vulnerability has been identified in the Linux kernel's handling of the DECstation DZ serial driver. The issue arises from the driver using legacy probing methods, which can lead to a null pointer dereference and a kernel crash when the first serial port is initialized. This problem occurs because no device is available with the old probing method, and the driver fails to properly manage the serial controller resources. The vulnerability affects the Linux kernel versions prior to the latest stable release, specifically in the DECstation DZ serial driver.

A vulnerability has been addressed in the Linux kernel's handling of the DECstation Z85C30 serial driver. The issue arose because the driver was not properly initializing the first serial port, leading to a kernel crash. This crash occurred due to a null pointer dereference when the driver attempted to access the parent device of the serial port. The vulnerability was present in the Linux kernel versions prior to 6.4.0-rc3 and was caused by the driver using legacy probing methods to discover devices, which is no longer recommended. Instead, the driver has been updated to use platform devices, allowing for a more reliable initialization process that prevents such crashes.

A vulnerability in the Linux kernel's handling of page table entries can lead to incorrect page table walks on ARM64 architectures. This issue arises when the 'huge_pmd_unshare()' function is called to unshare a PMD table. The 'tlb_unshare_pmd_ptdesc()' function sets 'tlb->unshared_tables=true', but the subsequent 'tlb_flush()' call only checks 'tlb->freed_tables'. As a result, stale PMD page table entries can remain in the walk cache, potentially causing errors in page table traversal.

A race condition vulnerability has been identified in the Linux kernel's MCTP USB transport driver. This issue arises from a timing conflict between completing a USB Request Block (URB) and canceling a scheduled retry operation, which can lead to unintended behavior. The vulnerability is present in the Linux kernel stable tree.

A reference leak vulnerability has been identified in the Linux kernel's AMD DNA acceleration component. The issue arises in the 'aie2_populate_range()' function, which fails to properly release a reference to the 'mm_struct' before jumping back to a previous label, leading to a memory leak. This vulnerability affects the Linux kernel stable tree.

A vulnerability exists in the Linux kernel's ESP (Encapsulating Security Payload) handling for both IPv4 and IPv6. When the 'inplace' flag is false, the old page fragments are replaced with new ones from the xfrm page fragment cache. The source scatterlist is created from the old fragments before the replacement, and a function is supposed to release the old page references after the cryptographic operation. However, if the process of building the destination scatterlist from the new page fails, the old page references in the source scatterlist are not released, leading to a memory leak. This issue arises because the error handling only frees the memory for the new page, leaving the old ones unreferenced.

A data-race vulnerability has been identified in the Linux kernel's Bluetooth ISO connection management. The issue arises in several functions, including iso_connect_bis(), iso_connect_cis(), iso_listen_bis(), and iso_conn_big_sync(). These functions call hci_get_route() using certain socket fields without holding the necessary lock, allowing concurrent modifications by other operations. This oversight leads to data-races, as reported by the Kernel Concurrency Sanitizer (KCSAN). The vulnerability has been addressed by modifying the functions to snapshot the required fields under lock before calling hci_get_route(), thereby preventing concurrent access issues.

A vulnerability exists in the Linux kernel's handling of packets on 6LoWPAN interfaces. The issue arises when the AoE driver (or similar) sends non-IPv6 packets, such as those carrying the AoE Ethernet protocol, through the 6LoWPAN interface. The 6LoWPAN header creation process fails to properly initialize the necessary address information for these packets, leading to the transmission of data with uninitialized fields. This vulnerability can be exploited by queuing non-IPv6 packets for transmission on a 6LoWPAN interface, either manually or through automated testing.

A vulnerability in the Linux kernel's mac80211 wireless subsystem allows for out-of-bounds bit shifting when parsing the radiotap header of injected frames. The issue arises in the 'ieee80211_parse_tx_radiotap' function, where an 8-bit value from userspace is used as a shift count. This can lead to undefined behavior, as the shift exponent can exceed the limits of a 64-bit unsigned long, causing a shift-out-of-bounds error. The vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's GARP (Generic Attribute Registration Protocol) attribute parser has been identified, specifically in the receive-side processing of GARP attributes. The issue arises from the parser incorrectly calculating the data length by subtracting the on-wire attribute length (which includes the GARP header) from the size of the attribute structure. This miscalculation creates an unsigned integer underflow, as normal attributes with data have a length greater than the size of the structure. The underflowed value is then truncated and passed to the `garp_attr_lookup()` function, leading to a mismatch between the parsed data length and the length of locally registered attributes. As a result, GARP Join/Leave events are ignored, disrupting the GARP receive path for common attributes like GVRP VLAN registration. The vulnerability affects several versions of the Linux kernel.

A time-of-check to time-of-use (TOCTOU) race condition vulnerability has been identified in the Linux kernel's Multipath TCP (MPTCP) implementation. This issue arises because the MPTCP output path accesses the MPTCP-level acknowledgment sequence multiple times without proper locking, potentially leading to inconsistencies. The vulnerability affects the announced receive window for the same packet, which could confuse the peer. The issue has been addressed by refactoring the code to ensure that the MPTCP receive window is updated only when the egress packet contains a Data-Synchronization Service (DSS) acknowledgment.

A vulnerability exists in the Linux kernel's WiFi MT76 MT7996 driver, where the Wireless Client Identifier (WCID) pointer is not properly cleared when deinitializing a station link. This issue can lead to potential memory management problems. The vulnerability affects several versions of the Linux kernel.

A vulnerability exists in the Linux kernel's handling of certain BPF LSM hooks, specifically 'task_to_inode' and 'inet_conn_established'. These hooks are not compatible with sleepable LSM programs due to being called under contexts that do not allow sleeping. The issue has been addressed by removing these hooks from the sleepable LSM context.

A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem has been addressed. The issue arose because a recent commit added a function to handle tail calls in BPF but failed to check for errors from that function. This oversight could lead to improper handling of stack liveness during BPF tail calls, potentially causing issues in BPF program execution.

A vulnerability has been identified in the Linux kernel's Direct Rendering Manager (DRM) GPU Shared Virtual Memory (SVM) handling. This issue involves an unbalanced lock and unlock sequence for the GPU SVM notifier lock, which can lead to potential synchronization problems. The vulnerability was introduced in version 6.19.0-rc6 and has been fixed in the stable branch.

A vulnerability in the Linux kernel's PCI Mediatek Gen3 controller has been addressed. The issue involved improper handling of IRQ domains in the 'mtk_pcie_setup_irq()' function. IRQ domains were allocated before retrieving the controller's IRQ. If the IRQ retrieval failed, the function returned an error without cleaning up the allocated domains, potentially leading to a resource leak. The vulnerability has been fixed by changing the order of operations, ensuring that IRQ domains are allocated only after successfully fetching the controller's IRQ.

A vulnerability exists in the Linux kernel's SPI MTK SNFI driver, specifically within the NAND Flash Interface handling. The issue arises because the driver fails to properly unregister the on-host NAND Error Correction Code (ECC) engine during probe failures and device removals. This oversight can lead to resource leaks or undefined behavior, as the ECC engine remains registered even when it is no longer needed. The vulnerability affects the Linux kernel stable tree.

A vulnerability in the Linux kernel's RDMA (Remote Direct Memory Access) component has been addressed. The issue arose because certain netlink attributes were treated as C-strings for comparison purposes, but the attribute type 'NLA_STRING' did not ensure the presence of a null terminator. This could lead to improper string handling and potential vulnerabilities. The solution was to change the attribute type to 'NLA_NUL_STRING', which correctly accounts for the null terminator. This change was necessary to prevent any ambiguity in string termination, ensuring that user space applications can reliably interpret the strings being passed.

A vulnerability exists in the Linux kernel's handling of the QDMA TX queue for Airoha Ethernet drivers. The issue arises because the TX descriptors are not properly reset in the cleanup routine, which can lead to incorrect management of the TX ring. This vulnerability affects the stable version of the Linux kernel.

A vulnerability in the Linux kernel's netfilter component, specifically within the nf_tables subsystem, has been addressed. This issue involved the management of hook transactions during the deletion of device hooks, which could disrupt the proper functioning of netlink dump operations. The vulnerability arose because the previous method of handling hook deletions interfered with readers of the RCU-protected hook list, leading to potential inconsistencies.

A vulnerability exists in the Linux kernel's Airoha Ethernet driver, specifically in the fragment transmission loop of the 'airoha_dev_xmit' function. During the final iteration of the loop, the function reads fragment addresses and lengths when the loop index matches the number of fragments. At this point, the fragment data is uninitialized, creating a risk of an unsafe read that could trigger a page fault. Although the uninitialized data is not used, the read operation itself poses a potential risk. This vulnerability affects the Linux kernel stable tree.

A vulnerability in the Linux kernel's AMDGPU VCN 2.0 encoder and decoder rings has been addressed. These rings do not support 64-bit user fence writes, leading to a rejection of command submissions that include user fences. The vulnerability has been fixed by setting the 'no_user_fence' option for the VCN 2.0 rings, allowing them to properly handle command submissions without user fence interference.

A vulnerability in the Linux kernel's AMDGPU VCN version 2.5 encoder and decoder rings has been addressed. These rings do not support 64-bit user fence writes and previously rejected command stream submissions that included user fences. The vulnerability has been resolved by modifying the ring functions to disable user fence support, ensuring compatibility with the hardware's capabilities.

A vulnerability in the Linux kernel's AMDGPU driver for VCN 3.0 has been addressed. The issue arose because the VCN encoder and decoder rings do not allow 64-bit user fence writes, leading to a rejection of command submissions that include user fences. This vulnerability was present in the Linux kernel stable tree.

A vulnerability in the Linux kernel's AMDGPU VCN 4.0 encoder and decoder rings has been addressed. These rings do not support 64-bit user fence writes, leading to a rejection of command submissions that include user fences. The vulnerability has been fixed by setting the 'no_user_fence' option for the VCN 4.0 encoding ring, ensuring compatibility with the hardware's capabilities.

A vulnerability in the Linux kernel's AMDGPU VCN 4.0.3 encoder and decoder rings has been addressed. These rings do not support 64-bit user fence writes, which can lead to issues when command submissions include user fences. The vulnerability arises because the VCN 4.0.3 encoding ring rejects command submissions that use user fences, creating a potential disruption in processing.

A vulnerability in the Linux kernel's AMDGPU VCN 4.0.5 encoder and decoder rings has been addressed. These rings do not support 64-bit user fence writes, leading to a rejection of command submissions that include user fences. The issue has been fixed by setting the 'no_user_fence' option for the VCN 4.0.5 encoding ring.