CVE Vulnerability Catalog

In the Linux kernel iommu/amd driver, iommu_init_ga_log() unconditionally assigns the ga_log and ga_log_tail pointers, so each resume replaces the boot-time pointers and leaks both allocations. The function also uses GFP_KERNEL from a syscore resume callback, where interrupts are disabled and non-boot CPUs are offline. The fix returns early if both buffers are already allocated and clears the pointers in free_ga_log().

In the Linux kernel iommu/amd driver, amd_iommu_pdom_id_alloc() returns an int (domain ID or negative errno), but amd_iommu_alloc_domain_nested() stores the result in the u32 field gdom_info->hdom_id, discarding the sign. As a result, -ENOSPC becomes 0xffffffe4 and the "<= 0" test never fires, so the nested domain is set up with an unallocated ID. The fix keeps the value in an int, tests it, and stores it only after validation.

In the Linux kernel hwmon ltc4282 driver, ltc428_clk_provider_setup() does not initialize all members of the clk_init_data structure, in particular init.num_parents remains uninitialized despite being assumed NULL. With CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE enabled, this may cause a crash. The fix ensures all members are fully initialized.

In the Linux kernel pec_store() takes a guard(mutex)(&hwdev->lock). If the chip write operation returns an error other than -EOPNOTSUPP, the code jumps to the put label, which calls put_device(hdev); if this drops the final reference, the device is freed, and when the function returns the guard cleanup attempts to unlock the freed mutex (UAF). The fix uses scoped_guard() instead of guard().

In the Linux kernel, the netfilter nfnetlink_log module has a bug related to concurrent instance destruction. Unlinking an instance from the hashes can occur at any refcount, not only on the 1 to 0 transition. Uncooperative userspace can force a situation where a queue is pending destruction from a netlink event while a different socket with the same portid processes an UNBIND request, leading to the instance being unhashed again and a general protection fault.

In the Linux kernel, the virtio_ring packed ring handling leaves stale AVAIL and USED descriptor flags after a failed packed add. These descriptors can be misinterpreted by the device as another command entry, blocking the virtqueue. This typically occurs in swiotlb configurations under memory pressure when vring_map_one_sg() fails for larger I/O requests.

A use-after-free vulnerability exists in the Linux kernel's unregister_virtio_device() function. After device_unregister() is called, the memory holding the virtio_device object may be freed, and virtio_debug_device_exit() then reads the debugfs_dir field from that freed object. The affected transports are virtio_mmio, virtio_vdpa, virtio_uml, mlxbf-tmfifo, and virtio_ccw.

In the Linux kernel, the virtio_console module has a bug where control-out buffers are freed on device removal. __send_control_msg() publishes &portdev->cpkt as the control-out virtqueue cookie, and remove_vqs() passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages. If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object, reported by KASAN as slab-out-of-bounds.

In the Linux kernel, the vhost/vdpa module has a bug where a queue size VRING_NUM larger than the device maximum is accepted. vhost_vring_set_num() accepts any non-zero power-of-two queue size fitting in 16 bits, and vhost-vdpa passes that value to set_vq_num() without comparing it with get_vq_num_max(). A process with access to /dev/vhost-vdpa-* can configure a queue larger than the device advertises, leading to an out-of-bounds read in the vringh IOTLB path (KASAN reports a 16-byte out-of-bounds read).

In the Linux kernel, the vhost-vdpa module has a bug where the eventfd_ctx_fdget() error is installed in config_ctx. vhost_vdpa_set_config_call() swaps the eventfd_ctx_fdget() return value into v->config_ctx before checking it, so on failure the field briefly holds an ERR_PTR. vhost_vdpa_config_cb() only tests for NULL, so a config interrupt delivered inside that window hands the ERR_PTR to eventfd_signal(). Additionally, a rejected fd can tear down a working config interrupt.

A use-after-free vulnerability exists in the Linux kernel's vhost-vdpa mechanism. The vhost_vdpa_config_cb() function reads the v->config_ctx pointer without a lock or reference, while a concurrent VHOST_VDPA_SET_CONFIG_CALL ioctl frees the old eventfd context via eventfd_ctx_put(), leading to use of freed memory. The issue is reachable from userspace when using VDUSE (access to /dev/vduse, root by default).

In the Linux kernel, the vdpa_sim_blk module has a bug where out-of-range sector starts are accepted. vdpasim_blk_check_range() logs an invalid start sector but continues validating the request; the subsequent unsigned capacity subtraction can underflow and let an out-of-range buffer offset reach the data path. This leads to an out-of-bounds write (VIRTIO_BLK_T_OUT, VIRTIO_BLK_T_WRITE_ZEROES) or out-of-bounds read (VIRTIO_BLK_T_IN).

In the Linux kernel, the vdpa_sim_net module has a bug where the TX pull result is not checked before the RX copy. vringh_iov_pull_iotlb() returns a signed byte count; a failed TX pull is currently added to the unsigned byte counter and then passed as a size_t length to receive_filter() and vringh_iov_push_iotlb(). A negative error can therefore become a large length in the RX path.

In the Linux kernel, the vduse module has a bug where virtqueue alignment is not validated. vduse_validate_config() only checks the upper bound of vq_align, so invalid values can reach vring_create_virtqueue_map(). The split-ring helpers use align - 1 as a bit mask, so the alignment must be a non-zero power of two; a zero value makes vring_size() drop the descriptor and available-ring part and vring_init() leave the used ring pointer NULL. Opening a virtio-net device created with vq_align=0 triggers a null-ptr-deref in virtqueue_kick_prepare_split().

In the Linux kernel, the vhost subsystem has an issue with invalidating vring access on IOTLB transitions. When VIRTIO_F_ACCESS_PLATFORM changes, cached vring pointers and IOTLB metadata are interpreted in a different address space, potentially leaving stale ring mappings in use. A common vhost_clear_device_iotlb() helper was added to serialize the transition with workers and prevent mixed address space mappings.

In the Linux kernel, the virtio_input driver has a flaw in the error path of input device registration. Probe marks the device DRIVER_OK before calling input_register_device(); if registration fails, the error path clears vi->ready and calls del_vqs() while the device is still live, potentially causing DMA to already torn-down queues. The fix calls virtio_reset_device() before tearing down the virtqueues.

In the Linux kernel, the virtio_input driver has an ordering issue during device removal. virtinput_remove() unregisters the input device before resetting the virtio device, allowing a callback to use vi->idev after it is freed. The fix resets the device first and rechecks vi->ready after taking the lock.

In the Linux kernel, the AF_UNIX subsystem has a bug in manage_oob() that fails to update the last skb marker. As a result, a blocking recv(MSG_PEEK) call can hog CPU by busy-waiting for a new skb. The fix updates the @last marker in manage_oob().

The Linux kernel has a UDP length overflow when sending large packets over IPv6 UDP sockets with IPV6_MTU_DISCOVER set to IPV6_PMTUDISC_DO or IPV6_PMTUDISC_PROBE and a network device with an unusually large MTU. The cork->base.fragsize value is not bounded to IP6_MAX_MTU, causing the 16-bit UDP length field to overflow and triggering a WARN in udp_set_len_short. The issue affects UDP sockets only and was fixed by limiting fragsize to IP6_MAX_MTU.

In the Linux kernel, the vduse module has a bug in compat ioctl handling. The compat handler handles VDUSE_IOTLB_GET_FD and VDUSE_VQ_GET_INFO but then calls the native handler, which returns -ENOIOCTLCMD due to different command sizes. For GET_FD, this overwrites receive_fd()'s return value after the descriptor is installed, leaking one fd per call. The fix returns handled compat results directly.