CVE Catalog

A vulnerability in the Linux kernel's OcteonTX2 AF mailbox handling can lead to an out-of-bounds write. The issue arises in the 'rvu_mbox_handler_rep_event_notify' function, where a sender-controlled 'REP_EVENT_NOTIFY' request body is queued and subsequently forwarded to various internal functions without proper bounds checking. This vulnerability affects Virtual Functions (VFs) attached to a Physical Function (PF) in switchdev representor mode, allowing for manipulation of memory and potential exploitation through crafted mailbox messages.

A vulnerability in the Linux kernel's IPv6 extension header processing has been addressed. The issue arose because the function 'ip6_parse_tlv()' cached the network header while processing IPv6 Type Length Values (TLVs). The 'ipv6_dest_hao()' function could modify the header for cloned socket buffers, potentially invalidating the cached header pointer. The vulnerability required the network header to be refreshed after 'ipv6_dest_hao()' was called, ensuring that any additional padding or TLVs were correctly processed. This update aligns with the established protocol for handling TLVs that can alter header information.

A vulnerability in the Linux kernel's Virtual Tunnel Interface version 6 (VTI6) management can lead to unauthorized packet injection across different tenant spaces on container hosts. This issue arises because the VTI6 tunnel update process does not correctly handle network namespace migrations, allowing an unprivileged user to manipulate tunnel parameters and intercept packets through a controlled network device.

A vulnerability in the Linux kernel's handling of IPv6 extension headers can lead to an unprivileged slab-out-of-bounds read. This issue arises in the 'ip6_datagram_recv_specific_ctl()' function, which processes certain control messages by relying on the 'hdrlen' byte from the header. The vulnerability exists because the length validation is only performed when parsing the header, not before the data is copied to the control message. An nftables payload-write expression can manipulate the 'hdrlen' value after parsing, creating an opportunity for exploitation. This vulnerability is accessible from an unprivileged user namespace.

A vulnerability in the Linux kernel's XFRM (IPsec transformation) module has been addressed. The issue involved improper management of network namespace references during deferred transport reinjection, which could lead to invalid memory access. The vulnerability was present in the stable branch of the Linux kernel.

A use-after-free vulnerability has been identified in the Linux kernel's L2TP (Layer 2 Tunneling Protocol) implementation. The issue arises in the function 'l2tp_session_get_by_ifname()', which can return a pointer to a session whose reference count has already reached zero. This occurs because the function uses 'refcount_inc()' to increase the reference count, leaving it vulnerable to a race condition. In contrast, other session retrieval functions in the same file properly use 'refcount_inc_not_zero()' to avoid such issues. The vulnerability can lead to a slab-use-after-free condition, where memory is freed while still being accessed, potentially causing memory corruption or other unintended behavior.

A vulnerability in the Linux kernel's VTI6 (Virtual Tunnel Interface version 6) implementation allows for a use-after-free condition. This issue arises from improper handling of network namespaces, which can be exploited by an unprivileged user in a container environment. The vulnerability was introduced in a previous commit that enabled namespace changing for VTI6 devices, but failed to maintain proper references during the transition, leaving stale entries that can be cleaned up improperly, potentially leading to memory corruption.

A vulnerability has been identified in the Linux kernel's Wacom HID driver, specifically in the function wacom_hid_set_device_mode(). The issue arises because the function incorrectly assumes that the HID_DG_INPUTMODE usage is always in the first field of the feature report. In reality, this usage can be in a different field. If it is not in the first field and the first field's report count is smaller than the usage index of HID_DG_INPUTMODE, an out-of-bounds write occurs. This vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's NFC HCI implementation allows for an out-of-bounds heap read. This issue arises in both the 'nfc_hci_recv_from_llc()' and 'nci_hci_data_received_cb()' functions, where 'packet->header' is read from 'skb->data' without verifying that the buffer contains at least one byte. A malicious NFC peer can send a 0-byte HCP frame that bypasses the SHDLC layer, leading to the out-of-bounds read. Additionally, if the 0-byte frame is sent as a non-final fragment, it causes the reassembly loop to underflow 'msg_len', resulting in a panic when the reassembled skb is processed.

A vulnerability in the Linux kernel's handling of XFRM_MSG_MIGRATE notifications has been identified. The issue arises because the migration notifications are hardcoded to the initial network namespace, rather than the namespace of the caller. This flaw affects the IKEv2 protocol's MOBIKE and address-update handling, particularly for daemons running in non-initial network namespaces.

A vulnerability in the Linux kernel's TCP connection tracking can force a connection into the CLOSE state using a RESET packet with an invalid sequence number. This issue arises because the connection tracking logic does not properly verify the direction of the packet in relation to the expected response. As a result, a crafted sequence of packets can prematurely terminate active network address translation (NAT) entries, disrupting ongoing connections.

A vulnerability has been identified in the Linux kernel's handling of the Encapsulating Security Payload (ESP) in both IPv4 and IPv6. The issue arises in the fast path of ESP processing, where the trailer is added before the destination page fragment is allocated. This can lead to improper handling of data lengths, potentially causing the skb_page_frag_refill() function to revert to using a single page, while the destination scatter-gather still covers the combined data length. The vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's IPTFS (In-Place Transport File System) implementation can lead to use-after-free and double-free errors. The issue arises in the xfrm subsystem, where the iptfs_clone_state function improperly clones runtime state data that should not be shared with the original Security Association (SA). This includes critical runtime objects such as the sk_buff_head (socket buffer head), hrtimers (high-resolution timers), spinlocks, and in-flight reassembly or reorder states. If the xfrm_state_migrate function fails after the state has been cloned but before it is properly initialized, the garbage-collected cloned state can inadvertently free socket buffers owned by the original IPTFS queue. This vulnerability affects several versions of the Linux kernel.

A use-after-free vulnerability has been addressed in the Linux kernel's dma-buf subsystem. This issue arises in the dma_buf_fd() function, where the file descriptor (fd) can be closed by a thread before the DMA_BUF_TRACE() macro is executed. This race condition leads to a slab-use-after-free scenario, as the tracepoint attempts to access the dma_buf after it has been freed. The vulnerability affects the Linux kernel stable tree, specifically in version 7.0.x.

A vulnerability has been identified in the Linux kernel's ksmbd component, specifically within the smb_check_perm_dacl() function. This issue arises from a transposed bounds check introduced in a previous commit, which effectively created dead code by allowing an invalid comparison that never breaks the loop. As a result, the function can read memory out-of-bounds, reopening a previously patched heap corruption issue. This out-of-bounds read occurs during SMB2_CREATE operations, potentially leading to memory disclosure or corruption.

A vulnerability has been identified in the Linux kernel's Atmel MXT touchscreen driver, specifically in the function that prepares configuration memory. The issue arises when a configuration file specifies an object size larger than what the driver recognizes. The current boundary check fails to properly discard the extra bytes, leading to a memory overwrite. This flaw allows the driver to unintentionally write over adjacent memory, potentially causing data corruption or other unintended behavior.

A double free vulnerability has been identified in the Linux kernel's UIO PCI Generic SVA implementation. The issue arises because the 'uio_pci_sva' function allocates memory for the 'uio_pci_sva_dev' structure using 'devm_kzalloc()' during the probe phase. However, it also calls 'kfree()' on this memory both when the probe encounters an error and during the device removal process. This explicit deallocation can lead to a double free situation, as 'devm_kzalloc()' allocations are automatically managed and freed when the device is detached. The vulnerability was discovered through static analysis and manual review, and has been addressed by removing the redundant 'kfree()' calls.

A use-after-free vulnerability has been identified in the Linux kernel's USB driver for the OMAP2430 platform. The issue arises in the 'omap2430_probe()' function, where the 'of_node_put(np)' call is made prematurely, before the last access to 'np'. This mismanagement can lead to a use-after-free condition if the reference count of the node drops to zero. The vulnerability affects the Linux kernel stable tree.

A use-after-free vulnerability has been identified in the Linux kernel's USBIP virtual USB device controller (VUDC) implementation. This issue arises in the 'vudc_remove' function, where the controller's data structure can be freed while a timer is still active, leading to a race condition. The vulnerability was reported by Zheng Wang and can be reproduced on an unpatched x86_64 QEMU guest with specific kernel configurations. The problem occurs when the 'vudc_remove' function is called, freeing the VUDC structure while a timer, initiated by 'v_start_timer' and 'v_kick_timer', is still pending or being executed. This mismanagement of the timer's lifecycle can be exploited, as confirmed by Kernel Address Sanitizer (KASAN) during testing.

A vulnerability has been identified in the Linux kernel USB Test and Measurement Class (USBTMC) driver, specifically in how it handles interrupt notifications from USBTMC devices. The driver fails to verify the presence of required two-byte header information before accessing data buffers. This oversight can lead to two potential issues: an out-of-bounds read, where the driver reads beyond the allocated buffer space, or the consumption of outdated data from a previous notification. The vulnerability arises when the actual length of the received data (URB actual_length) is insufficient to accommodate the headers, allowing for improper data handling and potential exploitation.

A vulnerability exists in the Belkin USB serial driver within the Linux kernel. The issue arises because the driver's interrupt callback misinterprets interrupt data as a four-byte status report, leading to potential out-of-bounds reads of status bytes. This flaw occurs because the interrupt-in buffer length is based on the endpoint's wMaxPacketSize, allowing short interrupt transfers to be processed incorrectly. The vulnerability has been addressed by adding a check for the actual length of the interrupt packet before parsing the status fields, ensuring that short transfers are ignored and do not cause invalid memory accesses. This vulnerability was reported using the Kernel Address Sanitizer (KASAN), which detected a slab-out-of-bounds error in the Belkin interrupt callback.

A vulnerability has been identified in the Linux kernel's USB serial Cypress M8 driver. The issue arises in the 'cypress_read_int_callback' function, which processes the interrupt-in buffer based on the chosen Cypress packet format. Format 1 requires a two-byte status/count header, while Format 2 needs a one-byte combined status/count header. The USB serial core allocates the interrupt-in buffer according to the endpoint descriptor's maximum packet size. However, successful interrupt transfers can be shorter than expected if the 'URB_SHORT_NOT_OK' flag is not set. This vulnerability allows for out-of-bounds reads of header bytes, as the driver does not properly validate the received packets before processing them. The kernel's AddressSanitizer (KASAN) has reported a slab-out-of-bounds error, indicating that the vulnerability could be exploited to read memory beyond the allocated buffer.

A memory corruption vulnerability has been identified in the Linux kernel's USB serial Digi Acceleport driver. This issue arises from the absence of proper sanity checks on the bulk-out buffer sizes, allowing for out-of-bounds memory accesses or slab corruption. The vulnerability can be exploited if a malicious device reports smaller buffer sizes than expected. The problem has been addressed by adding the necessary buffer size checks to prevent such memory corruption.

A vulnerability exists in the Linux kernel's USB serial Keyspan driver, specifically for the USA-49WG model. The issue arises from a missing sanity check on incoming data transfers, which can lead to the driver parsing outdated or uninitialized memory. This vulnerability has been addressed by adding the necessary checks to prevent such data from being processed.

A memory corruption vulnerability has been addressed in the Linux kernel's USB serial MXUport driver. The issue arose because the driver did not properly validate the maximum packet size of bulk-out endpoints, allowing user-controlled slab corruption. This could occur if a malicious device reported a smaller endpoint size, leading to memory corruption. The vulnerability affects several versions of the Linux kernel.

A memory corruption vulnerability has been identified in the Linux kernel's USB serial MCT U232 driver. This issue arises because the driver improperly overrides the maximum transfer size for devices that only accept 16-byte packets on their 32-byte bulk-out endpoints. The vulnerability can lead to slab corruption if a malicious device reports a smaller endpoint maximum packet size than expected.

A vulnerability in the Linux kernel's USB serial MCT U232 driver has been addressed by adding a missing sanity check for interrupt-in transfer sizes. This vulnerability could lead to the driver parsing outdated or uninitialized memory, potentially leaking sensitive information to user space. The issue was introduced in Linux version 2.6.12-rc2 and has been fixed in the stable branch.

An integer underflow vulnerability has been identified in the WebUSB GET_URL handler of the Linux kernel's USB gadget composite driver. This issue arises when the host-supplied wLength is smaller than the WebUSB URL descriptor header length, causing an unsigned subtraction to wrap. As a result, the handler inadvertently copies nearly UINT_MAX bytes from the landing page into the request buffer, leading to a slab-out-of-bounds error. This vulnerability can be exploited by a USB host sending a SETUP packet to a gadget with WebUSB enabled and a landing page configured.

A vulnerability in the Linux kernel's FunctionFS USB gadget implementation allows uninitialized memory to be sent to userspace. This issue arises because the control-OUT data buffer is allocated with kmalloc() using the length specified in the Setup packet. The function then copies the entire length to userspace, regardless of the actual bytes received. As a result, any uninitialized slab residue from the buffer is delivered to the FunctionFS daemon. This vulnerability is present in the Linux kernel stable tree and affects several versions.

A use-after-free vulnerability has been identified in the Linux kernel's USB gadget FunctionFS implementation, specifically within the DMABUF handling. The issue arises because the function 'ffs_epfile_dmabuf_io_complete' frees a USB request but leaves a pointer to the freed memory, creating a race condition. This freed pointer can be accessed later, leading to undefined behavior. The vulnerability was reproduced under the Kernel Address Sanitizer (KASAN) on both detach and close paths, indicating that the issue can be triggered during normal operation of the FunctionFS DMABUF interface.

A vulnerability exists in the Linux kernel's Thunderbolt driver, specifically in the property handling for XDomain peers. The issue arises because the 'value' field, which is a 32-bit unsigned integer, can be manipulated to wrap around when combined with the 'length' field, a 16-bit unsigned integer. This wrapping allows a malicious XDomain peer to bypass validation checks and access memory beyond allocated boundaries. The vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's Thunderbolt property handling has been addressed. The issue involved improper validation of the 'dir_len' property, which could lead to a size_t underflow and out-of-bounds memory access. This vulnerability was present in the non-root path of the Thunderbolt driver, where the 'dir_len' was taken from an entry's length. If the length was less than 4, it could bypass validation and cause the UUID copy process to read beyond the intended memory block, potentially leading to kernel crashes or memory corruption.

A denial-of-service vulnerability has been identified in the Linux kernel's Thunderbolt property handling. The issue arises in the 'property' parser, where a DIRECTORY entry's value is used as the directory offset for recursive calls into the parsing function, '__tb_property_parse_dir()', without any depth counter. This flaw allows a malicious peer to create a back-referencing loop by chaining DIRECTORY entries, causing the parser to recursively process the entries until the kernel stack is exhausted and the guard page is triggered. This vulnerability can be exploited by any untrusted XDomain peer, such as a cable, dock, in-line inspector, or adjacent host, during the PROPERTIES_REQUEST control-plane exchange, and does not require authentication.

A denial-of-service vulnerability has been identified in the Linux kernel's SCSI FCoE subsystem. The issue arises in the FCoE control VLAN, where the CVL walker function improperly handles FIP descriptors with a length of zero. This oversight allows an unauthenticated L2 peer to disrupt FCoE initiators by sending a malformed FIP CVL frame. The vulnerability exists in several versions of the Linux kernel.

A denial-of-service vulnerability has been identified in the Linux kernel's Fibre Channel transport component. This issue arises from the Link-Integrity and Peer-Congestion FPIN walkers, which improperly handle the pname_count field, leading to an infinite loop. The vulnerability can be exploited by an adjacent Fibre Channel fabric actor that delivers an FPIN ELS frame to a vulnerable Linux initiator, such as those using the lpfc or qla2xxx drivers. The attacker must be able to inject fabric traffic, potentially through a compromised switch or fabric controller, or as a same-zone N_Port on a fabric that allows source spoofing.

A vulnerability in the Linux kernel's iSCSI target implementation has been addressed. This issue involves a buffer overread and a double-free condition in the Text-phase command handler. The buffer overread occurs when the DataDigest CRC is processed, leading to a read operation that exceeds the allocated memory. This flaw, present since the initial integration of iSCSI support in version 4.1, can be reproduced using the Kernel Address Sanitizer (KASAN) tool. The double-free issue arises when a Text Request is dropped due to a DataDigest mismatch, causing the same memory to be freed multiple times, which can lead to memory corruption or a remote kernel bug on certain system configurations.

A heap buffer overflow vulnerability has been identified in the Linux kernel's SCSI target iSCSI implementation. The issue arises in the 'iscsi_encode_text_output' function, which concatenates 'key=value' records into a response buffer allocated 8192 bytes via 'kzalloc'. The function's three 'sprintf' call sites do not check the remaining buffer capacity, leading to a potential overflow. While the input Login PDU payload is bounded, a single PDU can carry up to 2048 'a=b' pairs, each unknown key expanding to a 16-byte output record. This can result in 32 KiB of output being written into an 8 KiB buffer, causing approximately 24 KiB of heap memory to be overwritten.

A vulnerability in the Linux kernel's iSCSI target implementation allows for improper validation of CHAP_R length in BASE64-encoded responses. The issue arises in the chap_server_compute_hash() function, where the input length is not checked before decoding, leading to potential buffer overflows. With MAX_RESPONSE_LENGTH set to 128, up to 127 BASE64 characters can be processed, which can exceed the allocated digest size and cause memory corruption. This vulnerability affects several versions of the Linux kernel.

A race condition vulnerability has been identified in the Linux kernel's Direct Rendering Manager (DRM) Graphics Execution Manager (GEM) handling. The issue arises in the 'drm_gem_change_handle_ioctl' function, where the old handle remains active in the IDR (Identifier Radix Tree) during the interval between unlocking and relocking the table. This creates a window of opportunity for a concurrent 'drm_gem_handle_delete' operation on the old handle to succeed, reducing the handle count to zero and freeing the GEM object, even while the new handle's IDR entry still points to it. The vulnerability has been addressed by nullifying the old handle's IDR entry before releasing the table lock, ensuring that any simultaneous 'GEM_CLOSE' operation on the old handle receives a NULL reference and returns an error. The old entry is restored if an error occurs during the handling process.

A use-after-free vulnerability has been identified in the Linux kernel's Intel graphics driver (drm/i915) within the memory management component for buffer objects (TTM). This issue affects several versions of the Linux kernel and can lead to a general protection fault, particularly under heavy use on affected hardware. The vulnerability arises because the TTM page vector container, which is crucial for managing memory pages of graphics objects, can be replaced while a pointer to the original container is still in use. This flaw allows for the potential dereference of a file pointer field of a TTM page vector container associated with an object being purged on eviction, creating a window for exploitation.

A kfifo underflow vulnerability has been identified in the Linux kernel's Qcom GenI serial driver. This issue arises when the 'uart_flush_buffer()' function is called before the DMA completion interrupt is processed, creating a race condition. The problem occurs as follows: DMA transmission begins with 'tx_remaining' bytes, and the kfifo buffer holds the same number of bytes. Once the DMA completes in hardware, the interrupt is still pending. If 'uart_flush_buffer()' is executed at this point, it resets the kfifo length to zero while 'tx_remaining' remains unchanged. When the DMA interrupt finally arrives, it attempts to advance the transmission on an empty kfifo, leading to a situation where the kfifo length inaccurately reports available data. This miscalculation causes the next DMA transfer to include outdated buffer data, potentially disrupting the intended data transmission process.

A NULL pointer dereference vulnerability has been identified in the Linux kernel's AMD GPU driver (AMDKFD). This issue arises in the 'svm_range_set_attr' function, where the 'process_info' variable can be NULL if the user does not call 'kfd_ioctl_acquire_vm' before 'kfd_ioctl_svm'. This vulnerability has been addressed by adding a check to ensure 'process_info' is valid before proceeding, preventing potential crashes or undefined behavior.

An integer overflow vulnerability has been fixed in the Linux kernel's AMD KFD (Kernel Fusion Driver) debugger. The issue arose in the `get_queue_ids()` function, which calculated the size of an array based on the number of queues. This calculation could overflow on 32-bit systems, leading to potential memory corruption or other unintended behavior. The vulnerability has been addressed by using a safer method that prevents overflow by saturating the value to the maximum size allowed.

A denial-of-service vulnerability has been identified in the Linux kernel's AMDGPU graphics driver. The issue arises in the GEM operation 'AMDGPU_GEM_OP_GET_MAPPING_INFO' within the 'amdgpu_gem_op_ioctl' function. When the function attempts to allocate memory using 'kvcalloc()', a failure can occur, returning an 'ENOMEM' error. This failure path, however, bypasses the necessary cleanup process, leading to a leak of three critical resources: a reference to the GEM object, a lock on the executed GEM, and a lock on the per-process virtual memory root page directory. The leaked lock on the virtual memory directory is particularly problematic, as it blocks any subsequent operations on the same virtual memory, such as further GEM operations or command submissions, creating a local denial-of-service condition for the affected GPU context. This vulnerability can be exploited by any process with access to the '/dev/dri/renderD*' devices.

A vulnerability in the Linux kernel's AMD GPU driver has been addressed. The issue arose in the page retrieval function for the Heterogeneous Memory Management (HMM) range, where the notifier sequence could be read multiple times, potentially leading to the use of invalid pages. This vulnerability affects the Linux kernel stable tree.

A vulnerability in the Linux kernel's AMD GPU driver allows for memory allocation issues in the GEM_OP GET_MAPPING_INFO operation. The vulnerability arises because the driver does not properly validate the user-supplied entry count, leading to potential memory allocations that exceed system limits. This flaw can cause a kernel warning and, on systems configured to panic on warnings, a complete system crash. The issue has been addressed by implementing a size check to prevent excessive entry counts from causing harmful allocations.

A vulnerability has been identified in the Linux kernel's handling of the DECstation DZ serial driver. The issue arises from the driver using legacy probing methods, which can lead to a null pointer dereference and a kernel crash when the first serial port is initialized. This problem occurs because no device is available with the old probing method, and the driver fails to properly manage the serial controller resources. The vulnerability affects the Linux kernel versions prior to the latest stable release, specifically in the DECstation DZ serial driver.

A vulnerability has been addressed in the Linux kernel's handling of the DECstation Z85C30 serial driver. The issue arose because the driver was not properly initializing the first serial port, leading to a kernel crash. This crash occurred due to a null pointer dereference when the driver attempted to access the parent device of the serial port. The vulnerability was present in the Linux kernel versions prior to 6.4.0-rc3 and was caused by the driver using legacy probing methods to discover devices, which is no longer recommended. Instead, the driver has been updated to use platform devices, allowing for a more reliable initialization process that prevents such crashes.

A vulnerability in the Linux kernel's handling of page table entries can lead to incorrect page table walks on ARM64 architectures. This issue arises when the 'huge_pmd_unshare()' function is called to unshare a PMD table. The 'tlb_unshare_pmd_ptdesc()' function sets 'tlb->unshared_tables=true', but the subsequent 'tlb_flush()' call only checks 'tlb->freed_tables'. As a result, stale PMD page table entries can remain in the walk cache, potentially causing errors in page table traversal.

A race condition vulnerability has been identified in the Linux kernel's MCTP USB transport driver. This issue arises from a timing conflict between completing a USB Request Block (URB) and canceling a scheduled retry operation, which can lead to unintended behavior. The vulnerability is present in the Linux kernel stable tree.