A flaw was found in the Linux kernel's synaptics-rmi4 input driver. This vulnerability occurs because the driver incorrectly allocates memory for a keymap, leading to an out-of-bounds memory access. A local user with access to a specially crafted input device could exploit this to read or write to unauthorized memory regions. This could result in information disclosure or potentially allow for further system compromise.

A flaw was found in the Linux kernel's Elan I2C touchpad driver. This vulnerability occurs when the driver receives invalid zero values for touchpad dimensions from device firmware or the device tree, or when a calculated width is too small. A local attacker with control over device input or a malicious device could exploit this to trigger a division-by-zero error, leading to a kernel panic and a denial of service.

A flaw was found in the Linux kernel's Goodix touchscreen driver. An attacker with physical access to the I2C bus, or a malicious touchscreen controller, could exploit a vulnerability where the driver fails to properly validate the number of reported touch points. This could lead to a stack out-of-bounds write, potentially causing a system crash (denial of service).

A flaw was found in the Linux kernel's iforce input driver. A malicious actor with a specially crafted input device could exploit an out-of-bounds write vulnerability by sending an unvalidated force-feedback effect index. This could allow the attacker to corrupt memory, potentially leading to system instability or other unpredictable behavior.

A flaw was found in the Linux kernel's `mms114` touch screen driver. The driver misinterprets the size of touch event data, causing it to read information from incorrect memory locations. This issue, known as an out-of-bounds read, could be exploited by a local attacker to disrupt system operations or potentially access sensitive data, leading to a denial of service or information disclosure.

A flaw was found in the Linux kernel's `touchwin` input driver. A malicious, malfunctioning, or counterfeit Touchwindow peripheral can exploit an unbounded heap out-of-bounds write vulnerability by streaming specific non-zero bytes. This prevents the packet index from resetting, allowing the peripheral to write arbitrary data beyond the intended buffer. This could lead to arbitrary code execution, enabling an attacker to take control of the affected system.

No description is available for this CVE.

A flaw was found in the Linux kernel's RDMA (Remote Direct Memory Access) rtrs-srv module. A remote attacker can exploit this vulnerability by sending a crafted RDMA-Write length during an RTRS READ operation that exceeds the intended buffer size. This out-of-bounds read can lead to information disclosure, allowing the attacker to read sensitive host memory. In some configurations, this could also result in a denial of service.

No description is available for this CVE.

A flaw was found in the Linux kernel's Filesystem in Userspace (FUSE) component. On 32-bit systems, an integer overflow vulnerability exists in the handling of `FUSE_NOTIFY_PRUNE` messages. A malicious FUSE daemon or a local user could craft a prune notification with a specific count, causing an integer overflow during payload length validation. This can lead to the kernel attempting to read non-existent data, resulting in a system crash and a Denial of Service (DoS).

A flaw was found in the Linux kernel's FUSE (Filesystem in Userspace) component. The `fuse_ref_folio()` function does not properly re-lock a request after unlocking it, which can lead to a use-after-free vulnerability. A local attacker could exploit this flaw to potentially execute arbitrary code or cause a denial of service.

A flaw was found in the Linux kernel's fuse component. When a fuse request is interrupted and then resent, a specific interrupt entry (`intr_entry`) is not properly cleared. If the requesting task subsequently receives a fatal signal, this uncleared entry can lead to a use-after-free condition. This vulnerability can result in memory corruption, potentially causing a system crash, and may also lead to the disclosure of sensitive data to userspace.

A flaw was found in the Linux kernel's FUSE (Filesystem in Userspace) component. An error handling vulnerability in the fuse_uring_commit function allows a positive error code to overwrite a critical negative error, causing FUSE operations to be incorrectly reported as successful. This can lead to FUSE callers processing uninitialized or partial data, potentially resulting in data integrity issues or unexpected system behavior.

A flaw was found in the Linux kernel's fuse-uring component. This vulnerability arises from the incorrect handling of cancelled entries, which are moved to a list where a subsequent operation unconditionally attempts to access a null pointer. A local attacker could exploit this flaw to trigger a system crash, leading to a Denial of Service (DoS).

A flaw was found in the `fuse-uring` component of the Linux kernel. When `io_uring` task work is canceled, the system fails to properly end a `fuse_req` (FUSE request). This can cause the originating system call thread to block indefinitely, leading to a Denial of Service (DoS) for the affected system. Additionally, repeated cancellations can exhaust background request limits, further stalling operations.

A flaw was found in the Linux kernel's `fuse-uring` component. This use-after-free vulnerability allows a local attacker to potentially achieve privilege escalation. The issue arises when the `fuse_uring_async_stop_queues()` function attempts to access memory that has already been freed, leading to unpredictable system behavior or unauthorized access. This flaw is mitigated by ensuring that a proper reference to the `fuse_conn` structure is maintained until the associated work queue has fully terminated.

A flaw was found in the `fuse-uring` component of the Linux kernel. A race condition exists where the `queue->stopped` flag is not consistently checked under a lock. This can allow a `struct fuse_req` to be prematurely freed while other operations are still in progress, potentially leading to memory corruption. A local attacker could exploit this vulnerability to cause system instability or potentially escalate privileges.

A flaw was found in the Linux kernel's fuse-uring component. A local attacker could exploit a race condition by sending specially crafted requests before they are fully processed. This could lead to a use-after-free vulnerability, potentially allowing for arbitrary code execution or denial of service.

A flaw was found in the `fuse-uring` component of the Linux kernel. When a copy operation to the userspace ring buffer fails, a request can be terminated improperly, leading to a NULL pointer dereference. This vulnerability could allow a local attacker to cause a system crash, resulting in a Denial of Service (DoS).

A flaw was found in the Linux kernel's Server Message Block (SMB) client. A remote attacker could exploit a vulnerability where the client improperly handles SMB2 responses containing overlapping data areas. This incorrect processing of malformed network data could lead to a denial of service (DoS) or other severe system impact, compromising the availability and potentially the confidentiality of the affected system.