CVE Vulnerability Catalog

In the Linux kernel, the accel/amdxdna driver's amdxdna_cmd_set_error() takes a reference to the first BO of a command chain but fails to drop it on the mapping failure path, leaking the reference. The path is reachable when the BO handle is recycled by userspace after submission and a dma-buf without a vmap implementation is imported onto the same id.

In the Linux kernel, the accel/ethosu driver reads bits 15:14 of NPU_SET_{IFM,OFM}_PRECISION as an activation storage mode, but on U65 the same field holds the rounding mode. This causes valid U65 command streams to fail CMDSTREAM_BO_CREATE with -EINVAL and produces bogus feature map size calculations.

In the Linux kernel, the drm/cirrus-qemu driver did not validate the BAR0 size during PCI probe. If a PCI device with BAR0 smaller than 4 MB (CIRRUS_VRAM_SIZE) was bound to the driver, the mapped VRAM was smaller than expected, allowing framebuffers larger than the mapped memory to be created and copied out of bounds, causing a supervisor write page fault.

In the Linux kernel, update_reparse_data() in the ntfs driver ignores the return value of set_reparse_index(). When index insertion fails, the code removes the just-written reparse data as cleanup but still returns 0, so symlink(2) reports success while no reparse data exists on disk.

In the Linux kernel, write_mft_record_nolock() in the ntfs driver maps the MFT record folio with kmap_local_folio(), but the pre_write_mst_fixup() and bio_add_folio() failure paths jump to the error label without unmapping it. Since kmap_local mappings are stack-ordered per task, leaking one corrupts the nesting for any outer mapping.

In the Linux kernel, ntfs_cluster_free_from_rl_nolock() in the ntfs driver adds a run's length to nr_freed whenever the error bookkeeping condition is false, which includes cases where ntfs_bitmap_clear_run() actually failed. Since a failed ntfs_bitmap_clear_run() rolls back its partial modifications, no bits were cleared for that run, yet its length still inflates vol->free_clusters.

In the Linux kernel, ntfs_sync_fs() in the ntfs driver unconditionally clears the dirty bit, whereas ntfs_put_super() and the remount-read-only path only clear it when NVolErrors(vol) is false. As a result, any sync() on a volume that recorded an error marks that volume clean, so no recovery is run.

In the Linux kernel, ntfs_dio_zero_range() in the ntfs driver returns either 0 or a negative errno from blkdev_issue_zeroout(); it never returns a positive value. The zeroing failure check in ntfs_attr_fallocate() therefore never fired, so a failed zeroing operation was silently ignored and newly allocated clusters were folded into initialized_size.

In the Linux kernel, ntfs_attr_find_in_attrdef() in the ntfs driver walks the in-memory $AttrDef table, but the loop condition bounds only the start of each entry, not the whole entry. A volume whose $AttrDef data size is smaller than one entry (e.g. 120 bytes) causes an out-of-bounds read when creating a file.

In the Linux kernel, is_boot_sector_ntfs() in the ntfs driver checks the boot sector's sectors_per_cluster field with a range test that rejects 0x81..0xf3 but accepts 0 and other non-power-of-two counts. A zero value reaches parse_ntfs_boot_sector(), where ffs(0) is 0, making the shift undefined.

A vulnerability in the Linux kernel BPF verifier allows it to incorrectly infer that a pointer is non-null. The bug occurs when comparing two pointers where one has a type without the PTR_MAYBE_NULL flag but can still be NULL at runtime. As a result, the verifier fails to catch a null pointer dereference, potentially leading to a crash or unauthorized code execution.

In the Linux kernel, ntfs_set_ea() in the ntfs driver unconditionally updates the HasEA flag based on ea_info_qsize in its exit path. When an error occurs before ea_info_qsize is updated, NInoClearHasEA() hides existing on-disk extended attributes (EAs) until the inode is evicted.

In the Linux kernel, the BPF verifier could incorrectly downgrade scalar zero spills to STACK_ZERO when part of the spilled bytes were already dead. This broke precision propagation chains and could lead to incorrect verification of BPF programs. The fix simply avoids converting zero spills to STACK_ZERO.

In the Linux kernel's stmmac network driver, stmmac_tso_xmit() failed to unmap DMA mappings created for the linear part and earlier fragments of an skb when mapping a subsequent fragment failed. This led to a DMA mapping leak. The fix releases descriptors and DMA mappings using stmmac_free_tx_buffer() and stmmac_release_tx_desc().

In the Linux kernel's SCTP_CMD_TIMER_START handling, a TOCTOU race exists: checking timer_pending() before timer_reduce() can allow the timer to expire and detach between these operations. Then timer_reduce() rearms the timer without taking the association reference, leading to an unbalanced reference count and use-after-free during association teardown. The fix uses the return value of timer_reduce() to determine whether the timer was actually armed.

In the Linux kernel's scsi mpi3mr driver, mpi3mr_sas_port_add() does not check the NULL return value from sas_port_alloc_num() on memory allocation failure, leading to a NULL pointer dereference. Additionally, if sas_port_add() fails, the allocated port is not freed, leaking the sas_port structure. The fix adds a NULL check and calls sas_port_free().

In the Linux kernel's scsi mpi3mr driver, mpi3mr_sas_port_add() does not release the target device (tgtdev) reference in the out_fail error path if the reference was previously acquired by mpi3mr_get_tgtdev_by_addr(). This leads to a reference count leak and prevents the target device structure from being freed. The fix adds a tgtdev put in the out_fail path guarded by a NULL check.

In the Linux kernel's SMB client, smb3_insert_range() does not check whether the new file size (i_size + len) is valid. This allows FALLOC_FL_INSERT_RANGE to bypass RLIMIT_FSIZE, exceed s_maxbytes, or produce a size outside the loff_t range. The fix uses check_add_overflow() to calculate the new EOF and validates it with inode_newsize_ok().

In the Linux kernel SMB client, smb3_zero_range() may extend a file's EOF without checking RLIMIT_FSIZE when FALLOC_FL_ZERO_RANGE is used without FALLOC_FL_KEEP_SIZE. The fix calls inode_newsize_ok() before sending the zero-range request when the operation would extend EOF.

In the Linux kernel SMB client, smb3_insert_range() and smb3_collapse_range() failed to properly invalidate the page cache when the offset or old EOF was not page-aligned. Boundary pages were only partially zeroed and remained uptodate, so the client could return stale data after a successful insert/collapse range operation.