CVE Catalog

A host confusion vulnerability has been identified in fast-uri versions 2.3.1 prior to 2.4.2, 3.0.0 prior to 3.1.3, and 4.0.0 prior to 4.1.0. The vulnerability arises because these versions do not recognize a literal backslash character as an authority delimiter. This oversight leads to a discrepancy when compared to Node's native WHATWG URL parser, which normalizes backslashes to forward slashes for certain schemes like http, https, ws, wss, ftp, and file. Consequently, the two parsers can extract different hosts from the same input string. Applications using fast-uri to enforce host-based policies—such as allowlists, denylists, loopback or Server-Side Request Forgery (SSRF) filtering, redirect validation, or outbound proxy routing—may be misled to unintended destinations, including cloud metadata endpoints, loopback, or internal hosts.

A vulnerability in the Linux kernel's batman-adv networking component has been addressed. The issue was a divide-by-zero vulnerability in the TCP throughput meter implementation, specifically in the function batadv_tp_update_cwnd(). The problem arose because the congestion window (cwnd) value, which should always be between the maximum segment size (MSS) and 0x20000000, was incorrectly handled as an unsigned 32-bit value. When cwnd reached 0x20000000, it wrapped around to zero, leading to an invalid calculation that attempted to divide by zero. This vulnerability could potentially be exploited to cause a denial-of-service condition by manipulating the TCP congestion control parameters.

A vulnerability exists in the Linux kernel's batman-adv module, specifically related to the handling of OGM (Optimized Geometric Mesh) packet aggregation on disabled hard interfaces. When a hard interface is disabled, the corresponding aggregation list is freed. However, the function responsible for sending OGM packets can still enqueue new packets to the aggregation list. This queuing continues until the RCU-protected list of hard interfaces is no longer accessible, leading to a situation where the queued packets are neither processed nor freed, causing a memory leak. The issue arises because the interface disable function does not properly block the queuing of OGM packets, allowing for a buildup of unhandled data.

A vulnerability in the Linux kernel's batman-adv module can lead to a denial-of-service condition. When the unacked_list is unbound, an attacker can send messages with small lengths and specific sequence numbers, creating gaps that force the receiver to allocate more unacked_list entries. This can cause an out-of-memory situation or increase management overhead, wasting CPU cycles on list searches. The vulnerability affects the Linux kernel stable tree.

A vulnerability in the Linux kernel's NTFS3 file system implementation allows unprivileged users to write to reserved extended attribute names that are used for internal Windows Subsystem for Linux (WSL) permission metadata. This vulnerability is present in the Linux kernel NTFS3 component, specifically through a combination of the empty-prefix extended attribute handler and writable NTFS3 mounts. When a file owner writes to these reserved attributes, it can result in planting root ownership and the set-user-ID (S_ISUID) attribute on their own files. After the inode is reloaded, this manipulation grants them elevated privileges, effectively allowing them to execute commands as the root user.

A vulnerability in the Linux kernel's Wi-Fi MT76 driver can lead to a use-after-free condition. This issue arises because the MT7925 MAC station addition function publishes the Wireless Context Identifier (WCID) without proper checks, causing corruption in the station polling list. The vulnerability was introduced in the Linux 7.1 release candidate 4 and affects the stable Linux kernel.

A vulnerability in the Linux kernel's mac802154 layer can lead to data corruption and kernel crashes. This issue arises from in-place cryptographic operations on socket buffer (skb) data, which can inadvertently modify shared data references. The problem is exacerbated under concurrent 802.15.4 traffic with security enabled, causing use-after-free errors and crashes. The vulnerability affects several versions of the Linux kernel.

A vulnerability exists in the Linux kernel's handling of the sk_msg scatterlist copy bitmap, which is crucial for managing entry ownership. The issue arises because certain sk_msg transformation processes can inadvertently clear the copy bit for entries backed by external pages, such as those from the file cache. This mismanagement can lead to exposure of these entries through writable BPF context data, allowing BPF stores to modify the original page cache. The vulnerability affects the Linux kernel stable tree and has been addressed by ensuring that the sg.copy state is properly synchronized with the sg.data entries during transformations, particularly in BPF-related operations and TLS record handling.

A vulnerability exists in the Linux kernel's handling of IP GRE tunnels, specifically in the change link operation. The issue arises because the operation only verifies the CAP_NET_ADMIN privilege against the network namespace of the device being modified, not the namespace of the tunnel itself. This oversight allows a privileged caller to alter a tunnel in a different namespace without the necessary permissions. The vulnerability affects the Linux kernel stable tree.

A vulnerability in the Linux kernel's AppArmor security module allows a confined task to bypass connection mediation for outbound TCP connections using Fast Open. This issue arises because the AppArmor socket send message function only verifies the permission to send data, not to establish a connection. As a result, a profile that permits sending but denies connecting can exploit this oversight, particularly with TCP or Multipath TCP (MPTCP) connections. The vulnerability affects several versions of the Linux kernel.

A use-after-free vulnerability has been identified in the Linux kernel's AppArmor subsystem, specifically within the profile loading process. This issue arises in versions of the Linux kernel prior to the patch included in version 7.1-rc5. The vulnerability is rooted in how the kernel manages reference counts for profile data. When the last reference count drops, the entry is removed from the raw data list, but a brief window exists where the entry can be accessed again, leading to a use-after-free condition. This was exacerbated by a recent refactor that changed how reference counts are handled, introducing a race condition that could be exploited. The vulnerability was reproduced in a QEMU/KVM environment running Ubuntu 24.04, using the stress-ng tool to simulate the conditions necessary for exploitation.

A use-after-free vulnerability has been identified in the Linux kernel's framebuffer (fbdev) subsystem, specifically within the 'store_modes()' function. This vulnerability arises when 'store_modes()' replaces a framebuffer's modelist with modes from userspace. Upon successful replacement, the old modelist is freed, but two fields remain pointing to the freed memory. One field, 'fb_display[i].mode', represents the mode a console is using. The 'fbcon_new_modelist()' function can update these pointers, but it only affects consoles still mapped to the framebuffer. Unmapped consoles retain their stale pointers, leading to a use-after-free condition when the old pointer is accessed. The second field, 'fb_info->mode', indicates the current mode and is set through the mode sysfs attribute. However, 'store_modes()' does not update this field, leaving it to point to the freed list. The issue can be exploited by sending an 'FBIOPUT_VSCREENINFO' ioctl with 'FB_ACTIVATE_INV_MODE', which triggers the use-after-free by accessing the stale pointer through the mode string handler.

A vulnerability in the Linux kernel's handling of GCOV instrumentation can lead to concurrent access crashes, particularly during IP Payload Compression (IPComp) processing. This issue arises because GCOV counters, which are global and not per-CPU, can be modified by one CPU while another CPU is reading the same counter. This interference causes inconsistent values and out-of-bounds memory writes. The problem manifests when the 'inflate_fast()' function is executed concurrently on multiple CPUs, leading to a page fault and a crash. The vulnerability has been addressed by modifying the kernel's build process to use atomic updates for GCOV counters, preventing the optimization that merges global counters with loop variables. This fix is applied selectively, depending on the architecture and the availability of atomic operations, ensuring compatibility without introducing unnecessary dependencies on external libraries.

A buffer overflow vulnerability has been identified in the Linux kernel's handling of asymmetric keys. This issue arises in the 'keyctl_pkey_params_get_2' function, where the internal output buffer length is incorrectly calculated. As a result, a buffer overflow can occur if a buffer that is too small is provided. The vulnerability affects several versions of the Linux kernel, specifically in the stable tree, and has been present since version 4.20.

A use-after-free vulnerability has been identified in the Linux kernel's key management system, specifically within the request key authorization process. This issue arises when the request_key_auth payload is not properly managed during key instantiation and rejection, leading to a reference being used after it has been freed. The vulnerability is present in the Linux kernel stable tree, affecting versions 5.10 and later.

A double free vulnerability has been identified in the Linux kernel's ath11k wireless driver for Qualcomm IEEE 802.11ax devices. This issue arises when an error occurs during firmware initialization, leading to the premature release of transmission status buffers. These buffers are subsequently released again when the device is unbound, causing a double free condition. The vulnerability is consistently reproducible in a virtual machine environment due to a failure in the Message Signaled Interrupts (MSI) addressing initialization.

A memory leak vulnerability has been identified in the Linux kernel's WiFi driver for Realtek RTW88 USB chips. This issue arises when the function rtw_usb_write_port() fails to submit a USB Request Block (URB), due to reasons such as device disconnection or memory allocation errors. The failure prevents the completion callback from executing, which is crucial for freeing allocated socket buffers and transaction control blocks. As a result, the driver inadvertently leaks memory by not releasing these resources. The vulnerability was discovered during real-world device disconnection and reconnection scenarios, as well as under conditions of memory pressure.

A vulnerability in the Linux kernel's F2FS (Flash-Friendly File System) can lead to a deadlock situation where read operations on large folios are not completed. This issue arises because the function responsible for reading data can retain a read bio (block I/O) across multiple readahead folios. If an error occurs with a later folio before its blocks are added to the bio, the folio is not considered part of the bio, and the error handling routine exits without submitting the bio. As a result, the bio for earlier folios remains unsubmitted, causing those folios to miss read completion. Readers can then be left waiting indefinitely on the locked folios.

A vulnerability in the Linux kernel's F2FS (Flash-Friendly File System) implementation can cause a kernel panic. This issue arises from a lack of proper sanity checks in the 'f2fs_get_node_folio_ra' function, which can lead to corrupted inode handling. When a direct node in the inode has the same inode number and node ID in its footer, it creates a conflict. The 'f2fs_do_truncate_blocks' function then encounters an invalid state, triggering a kernel bug and a system crash. This vulnerability affects the Linux kernel stable tree.

A vulnerability exists in the Linux kernel's handling of orphan inodes in the F2FS file system. The issue arises because the orphan recovery process trusts the entry count from the orphan block when replaying inodes from the checkpoint pack. If the entry count is corrupted and exceeds the maximum allowed, the recovery loop can read past the intended data array, misinterpreting subsequent data as inode numbers. This flaw can lead to a kernel panic. The vulnerability is present in the F2FS file system within the Linux kernel.

A vulnerability in the Linux kernel's F2FS (Flash-Friendly File System) implementation can lead to improper validation of compressed cache inodes. This issue arises because the F2FS_COMPRESS_INO() function uses a synthetic inode number that only exists when the compress_cache mount option is enabled. When this option is disabled, the synthetic inode number falls outside the valid range, allowing corrupted directory entries to be incorrectly processed. The vulnerability allows F2FS to bypass necessary inode range checks, potentially leading to the instantiation of fake internal inodes.

A use-after-free vulnerability has been identified in the Linux kernel's F2FS (Flash-Friendly File System) implementation. This issue arises in the atomic write handling of F2FS inodes, specifically when the garbage collection process is performed on copy-on-write (COW) files. During this process, the kernel fails to properly manage references to inodes, leading to the potential for accessing freed memory. The vulnerability is triggered when the F2FS garbage collector processes COW files without maintaining a valid reference to the atomic inode, allowing for memory corruption.

A vulnerability in the Linux kernel's F2FS filesystem allows for an out-of-bounds read caused by improper validation of inline extended attribute sizes. When the flexible inline extended attribute feature is enabled, the inode reader loads the inline attribute size without proper checks. This oversight can be exploited by crafting an image that manipulates the attribute size, leading to negative values that cause the filesystem to read beyond allocated buffers. The issue arises in inodes with inline data or directories that do not have the appropriate flags set, allowing for exploitation during directory reads.

A vulnerability in the Linux kernel's F2FS file system allows for improper validation of Access Control List (ACL) entry sizes. The issue arises because the F2FS ACL counting function only checks the total length of the ACL extended attribute, leaving room for a malformed ACL to place user or group entries in a way that bypasses size checks. This flaw can lead to a 'slab-out-of-bounds' memory access, where the kernel reads beyond the allocated memory for short ACL entries, potentially causing memory corruption.

A race condition vulnerability has been identified in the Linux kernel's F2FS (Flash-Friendly File System) implementation, specifically in versions prior to the latest patch. This vulnerability can lead to kernel panics, particularly when the F2FS partition is nearly full. The issue arises because an F2FS page can be freed to the buddy allocator without being removed from the Least Recently Used (LRU) list, causing a corruption of the LRU links. The root cause is a race introduced by a previous commit, which altered how garbage collection handles folios (a type of memory management unit) in the page cache. This change allows the garbage collector to evict folios from the cache, but if the eviction process races with other operations that manage the folio's reference counts, it can result in the folio being freed while still linked in the LRU, leading to a detected list corruption.

A vulnerability exists in the Linux kernel's handling of the FI_NO_EXTENT flag within the F2FS file system. When the __destroy_extent_node() function sets the FI_NO_EXTENT flag, it fails to reset the largest extent length to zero and update the associated inode folio. This oversight can lead to stale cached extent information, causing errors during file system checks. The issue arises because, after the flag is set, modifications to the extent tree are prohibited, yet the cached data may no longer be accurate. The problem has been observed in F2FS file systems, particularly when running xfstests.

A vulnerability in the Linux kernel's f2fs filesystem allows for a general protection fault due to improper handling of copy-on-write (COW) data during atomic write operations. When an atomic-write file is updated, the f2fs_write_begin() function may inadvertently read data from the COW inode using the original inode's encryption context. This issue arises because the COW inode, created as a temporary file, inherits an encryption policy that can differ from that of pre-existing files. As a result, the decryption process may encounter a null pointer, leading to a crash. The vulnerability affects the Linux kernel's stable branch.

A vulnerability in the Linux kernel's handling of the bdev pseudo-filesystem has been addressed. This internal filesystem should not be accessed by userspace. The vulnerability arose because the system call move_mount() relied on pointers in the inode_operations structure that were always null for the bdev pseudo-filesystem. This led to a kernel NULL pointer dereference error when files were accessed, causing a crash. The issue has been fixed by unregistering the bdev filesystem, preventing userspace from attempting to mount it.

A vulnerability in the Linux kernel's handling of sysctl write buffers can lead to memory corruption. The issue arises in the BPF (Berkeley Packet Filter) subsystem, where the 'proc_sys_call_handler' function allocates a temporary sysctl buffer using 'kvzalloc'. This buffer is then passed to '__cgroup_bpf_run_filter_sysctl'. However, 'kvzalloc' may revert to 'vmalloc' for large allocations, making it inappropriate to free the buffer with 'kfree', as this can cause memory corruption. The correct approach is to use 'kvfree', which safely manages both 'kmalloc' and 'kvzalloc'/'vmalloc' allocations. This vulnerability was initially detected by an experimental analysis tool designed to identify kernel memory management issues, during a review of version 6.13-rc1. Although the tool is still being developed and is not yet available to the public, a manual inspection has verified that the vulnerability persists in version 7.1-rc5.

A use-after-free vulnerability has been identified in the Linux kernel's exFAT filesystem implementation, specifically within the directory entry handling function, exfat_find_dir_entry(). The issue arises because the function releases a buffer containing directory entry data before it has finished reading the information, particularly when processing extended entries. This can lead to undefined behavior, as the memory may be reused before the data is fully processed. The vulnerability was confirmed on a QEMU x86_64 environment with specific kernel configurations that enabled memory debugging features, using a crafted exFAT image designed to exploit the flaw.

A vulnerability in the Linux kernel's KVM module for x86 architecture can lead to out-of-bounds memory access when handling hugepages in the shadow memory management unit (MMU). This issue arises because the kernel fails to verify that the guest's hugepage mappings are within the bounds of the designated memory slot before checking the maximum allowable mapping level. If a guest mapping extends beyond the slot's limits, it can cause a page fault in the host, as the associated page information is allocated in a way that is not resilient to such overflows. The problem is exacerbated when the guest's memory usage exceeds KVM's current mapping capabilities, prompting KVM to create a direct shadow page that may link to an out-of-bounds guest frame number.

A vulnerability in the Linux kernel's KVM component allows for guest-triggered alignment issues when handling IOeventfd datamatch signals. This problem arises because KVM's x86 emulator processes memory writes that cross page boundaries or involve emulated MMIO on separate pages. The vulnerability has existed since 2009, triggered by unaligned data accesses that the original code did not properly validate. Exploitation can cause a kernel panic by hitting a BUG_ON() assertion, indicating an invalid opcode error.

A vulnerability in the Linux kernel's crypto subsystem, specifically within the NX cryptography context management, has been addressed. The issue arose because the function 'nx_crypto_ctx_shash_exit' incorrectly called 'nx_crypto_ctx_exit' with a context type intended for a different purpose, leading to a kernel oops error. This type mismatch caused a fault by attempting to access invalid memory, disrupting normal kernel operations. The problem was similar for 'nx_crypto_ctx_skcipher_exit', but this issue had not been encountered for several years.

A use-after-free vulnerability has been identified in the Linux kernel's GFS2 file system, specifically within the quota deallocation process. The issue arises in the 'gfs2_qd_dealloc()' function, which is called as a Read-Copy Update (RCU) callback. This function accesses the superblock object after the quota data object has been freed, leading to potential memory corruption. The vulnerability can be triggered when 'gfs2_quota_cleanup()' is called during the unmount process, causing the premature disposal of quota objects while RCU callbacks referencing them are still pending.

A use-after-free vulnerability has been identified in the Linux kernel's handling of PPP control protocols (LCP, IPCP, IPV6CP). Each protocol registers a timer, but the corresponding state is not properly synchronized before being freed, particularly during protocol teardown. This oversight allows a timer callback to access freed memory, creating a use-after-free condition. The vulnerability arises because the PPP protocol does not register a detach callback, leaving timer synchronization unaddressed during critical transitions. The issue has been resolved by introducing a detach helper that synchronizes timers before freeing the associated state, ensuring proper memory management and preventing exploitation.

A use-after-free vulnerability has been identified in the Linux kernel's block cgroup management. This issue arises when multiple block cgroup groups (blkgs) within the same block cgroup (blkcg) are released simultaneously. The vulnerability occurs because one blkg's flush operation can inadvertently remove another blkg's I/O statistics entries, leading the second blkg to incorrectly perceive an empty list and free itself while the first blkg is still processing its entries. This flaw has been addressed by changing the timing of the flush operation, ensuring that the necessary synchronization is in place before freeing resources.

A slab-use-after-free vulnerability has been identified in the Linux kernel's TIPC (Transparent Inter-Process Communication) module, specifically within the AEAD (Authenticated Encryption with Associated Data) decryption process. This issue arises because the decryption function does not properly manage references to the network namespace, unlike the encryption counterpart. When the decryption operation is offloaded for asynchronous processing, it can lead to the decryption completion function accessing freed memory, causing a use-after-free error. This vulnerability was reproduced under the Kernel Address Sanitizer (KASAN) with a specific workload that exploited the missing reference management, highlighting the potential for memory corruption.

A use-after-free vulnerability has been fixed in the Linux kernel's pNFS implementation. The issue arose in the 'pnfs_update_layout()' function when the 'NFS_LAYOUT_RETURN' branch was executed. The function first called 'pnfs_prepare_to_retry_layoutget(lo)', and if successful, it then called 'pnfs_put_layout_hdr(lo)' before triggering a tracepoint that still referenced 'lo'. This sequence created a use-after-free condition when the tracepoint accessed 'lo's fields. The vulnerability has been addressed by rearranging the order of operations, moving the tracepoint call before 'pnfs_put_layout_hdr(lo)'.

A vulnerability in the Linux kernel's handling of per-CPU CID (Context Identifier) management can lead to out-of-bounds memory corruption. This issue arises in the 'mm_cid_fixup_cpus_to_tasks()' function, where a newly forked or executed task may have its CID set to 'MM_CID_UNSET'. CIDs are assigned lazily, and if a task is active with an unset CID, the transition bit can be incorrectly manipulated. This flaw allows a bounded out-of-bounds write to occur, specifically clearing bit 31 of the CID bitmap, which is only num_possible_cpus() bits wide. The corruption affects kernel memory in an unpredictable manner, although it is not an arbitrary write. The vulnerability is triggered in per-CPU CID mode when a task's CID is still unset, creating a window of opportunity for memory corruption to occur.

A resource leak vulnerability has been identified in the Linux kernel's ImgTec PDC IRQ chip driver. When the driver is removed, it fails to free allocated generic interrupt chips and does not clear installed chained handlers. This oversight leaves dangling references that can be accessed by interrupt chip callbacks, potentially causing a use-after-free condition and leading to a kernel crash. Additionally, the residual chained handlers for peripheral and syswake interrupts can trigger spurious interrupts that access freed memory.

A use-after-free vulnerability has been identified in the Linux kernel's rpmsg character device handling. When the rpmsg_chrdev_probe() function is called, it stores a pointer to a newly allocated endpoint device (eptdev) in the default endpoint's private data. If the subsequent call to rpmsg_chrdev_eptdev_add() fails, the eptdev is freed, but the default endpoint may still attempt to use the stale pointer, leading to potential memory corruption. This vulnerability affects the Linux kernel stable tree.

A vulnerability in the Linux kernel's OCFS2 file system allows for the acceptance of oversized group bitmap descriptors. The issue arises because the validation function only checks bitmap bits against the parent allocator's chain geometry. This oversight enables a malicious descriptor to claim a size and bit count that exceeds the physical capacity of the group descriptor block. As a result, subsequent bitmap scans and updates can overwrite memory, leading to a use-after-free error. This vulnerability has been addressed by adding a physical capacity check that rejects descriptors exceeding the allowed size or bit count, while maintaining the original geometry check to ensure consistency between the on-disk layout and allocator metadata.

A vulnerability in the Linux kernel's 9p file system handling can cause a use-after-free or reference count underflow. This issue arises in the 'p9_client_walk()' function when the 'clone' parameter is set to false. In this scenario, the file identifier (fid) being used can mistakenly reference an old fid, which is still expected to be valid by the caller. If the walk operation fails after the request has been sent, the error handling process unconditionally releases the reference to the old fid. This premature release can lead to the old fid being destroyed while it is still in use, causing a use-after-free condition. The vulnerability can be triggered when a multi-component walk is divided into separate 'p9_client_walk()' calls, and a subsequent non-cloning walk fails. A reproducer for this vulnerability, along with reference count warning logs, is available upon request.

A vulnerability in the Linux kernel's KVM SVM module has been identified, specifically within the SEV debugging cryptography functions. The issue arises because the transfer length for each iteration is limited by the source page offset but not by the destination page offset. This oversight can lead to a page overflow when certain conditions are met, allowing the PSP (Platform Security Processor) to write beyond the allocated buffer, causing a use-after-free error. The vulnerability can be triggered by manipulating the offsets and the length of the data being processed, particularly in the encryption path of the SEV debug commands.

A use-after-free vulnerability has been addressed in the Linux kernel's NTFS file system handling. The issue arose because the volume label was not properly synchronized, allowing concurrent read and write operations to interfere with each other. Specifically, when the FS_IOC_SETFSLABEL command was used to change the volume label, the FS_IOC_GETTSLABEL command could simultaneously read the old label, leading to a use-after-free condition. This vulnerability affects the Linux kernel's stable releases.

A null pointer dereference vulnerability has been identified in the Linux kernel's framebuffer (fbdev) subsystem. This issue arises in the 'fb_new_modelist' function, where the current video mode of a framebuffer ('info->var') is expected to have a corresponding entry in the mode list ('info->modelist'). The function 'var_to_display' relies on this consistency and treats any mismatch as an error. While 'fb_set_var' and 'do_register_framebuffer' correctly update the modelist, 'fb_new_modelist' fails to ensure that the current mode is still valid after a console takeover, particularly when 'fbcon' is unbound. This oversight can lead to a situation where 'var_to_display' receives a null mode, causing a dereference error.

A vulnerability in the Linux kernel's framebuffer console (fbcon) component can lead to an out-of-bounds read and potential memory disclosure. This issue arises in the 'fbcon_do_set_font()' function when a memory allocation failure occurs during 'vc_resize()', causing the function to skip restoring the 'hi_font' state. As a result, the virtual terminal (VT) subsystem continues to accept character indices greater than 255 from userspace, which are then incorrectly mapped to the screen buffer. This desynchronization allows for accessing invalid memory regions, creating a risk of kernel memory disclosure.

A use-after-free vulnerability has been identified in the Linux kernel's OMAP2 framebuffer (fbdev) subsystem. This issue arises in the 'omapfb_mmap()' function, which handles memory mapping for framebuffer regions. The vulnerability is caused by a race condition between the 'omapfb_mmap()' function and the 'OMAPFB_SETUP_PLANE' ioctl handler. While 'omapfb_mmap()' holds the memory management lock, it does not hold the framebuffer info lock, allowing concurrent execution that can lead to memory safety issues. The vulnerability can be reproduced by mapping a framebuffer region while simultaneously issuing an ioctl command that modifies the region's metadata. This creates a scenario where the mapped memory can be freed while still in use, leaving a dangling pointer that can be exploited to access freed physical memory.

A race condition vulnerability in the Linux kernel's I2C core has been addressed. The issue arose during the registration of I2C adapters, which can be looked up by their ID using the 'i2c_get_adapter()' function. This function references the associated 'struct device', necessitating that the adapter be fully initialized before it is added to the IDR (Identifier Radix Tree). Failure to do so could result in accessing uninitialized data, potentially leading to NULL-pointer dereferences or use-after-free errors. The vulnerability was particularly relevant for the 'i2c-dev' character device, which is registered via a bus notifier and relies on 'i2c_get_adapter()'. Therefore, it was crucial to add the adapter to the IDR before its registration.

A vulnerability in the Linux kernel's NFS server implementation can lead to a use-after-free issue. When a layout state ID (stid) is allocated and then a lease set operation fails, the state ID is freed without properly removing it from the IDR (Identifier Radix Tree) management. This leaves a dangling pointer that can be accessed by subsequent operations, potentially causing memory corruption. The vulnerability arises because the error handling path does not follow the correct procedure for releasing the state ID, leading to a situation where freed memory can be incorrectly accessed.