CVE Vulnerability Catalog

In the Linux kernel tracing subsystem there is a memory leak. When the same variable is used three or more times in one hist trigger, removing the trigger leaks the variable reference and its strings. The reference count is only incremented and freeing occurs at 0 or 1, so three or more references leak.

A vulnerability in the Linux kernel tracing subsystem (histograms) causes a memory leak when a histogram field is rejected due to an invalid modifier (e.g., .log2). The field is not properly freed because it is not added to the fields[] list before the error path. This can lead to unreferenced objects and memory exhaustion.

In the Linux kernel, print_entries() in the tracing/histogram subsystem uses n_entries both as the number of sort entries and as its return value. When the stats allocation fails, the stored -ENOMEM overwrites the count that is later passed to tracing_map_destroy_sort_entries(), which takes an unsigned int and loops up to it, causing an out-of-bounds read and free (vmalloc-out-of-bounds).

In the Linux kernel tracing subsystem there is a use-after-free bug. event_hist_trigger_named_init() first publishes the trigger on the global named_triggers list and only then takes the reference; if initialization fails, the trigger is not removed from the list and gets freed, so the next lookup by name reads the freed object.

A vulnerability in the Linux kernel tracing subsystem related to histogram trigger registration has been discovered. The flaw can cause a trigger to be freed while still present on the global named_triggers list, leading to a use-after-free condition. The fix adjusts the registration/unregistration order to prevent this.

In the Linux kernel accel/ivpu driver, ivpu_to_cpu_addr() did not validate the full buffer range. The lack of a check that the whole [vpu_addr, vpu_addr + size) range stays within the BO could lead to out-of-bounds access.

In the Linux kernel accel/ivpu driver, fw_log_print_buffer() re-read the log header fields from shared memory after they had been validated. This allowed a TOCTOU attack where the NPU firmware changes the values between check and use, causing out-of-bounds reads while printing logs.

In the Linux kernel accel/ivpu driver, printing the name from the tracing buffer header was not limited to the field size. The name field is a fixed-size array populated by the NPU firmware and is expected to be NUL-terminated, but a missing terminator caused reads past the field and exposed adjacent bytes via dmesg and debugfs.

In the Linux kernel accel/ethosu driver, ethosu_job_open() returned the value from WARN_ON() (0 or 1) instead of the original negative errno. This caused an incorrect return code to be passed to userspace.

In the Linux kernel accel/ethosu driver, the command stream was not ensured to end with a stop op. Although the QSIZE register setting should prevent out-of-bounds access, it is unclear whether the hardware generates the required interrupt, which could lead to a timeout.

In the Linux kernel, in the accel: ethosu driver, on SRAM mapping failure, the SRAM size is left non-zero. This allows jobs to access SRAM which points to physical base address 0x0.

In the Linux kernel, in the accel: ethosu driver, userspace can set the job SRAM size to 0 but still have SRAM accesses in the command stream. When the job SRAM size is 0, setting the region base register is skipped, leading to use of a stale base address from a prior job.

In the Linux kernel, the ASoC driver for Spreadtrum platforms (sprd) lacks validation of compress buffer sizes against fixed memory allocations. A local user can configure a logical buffer up to ~4GB, causing overflow of the IRAM (32K) or DDR (2M) buffers during copy operations from user space.

In the Linux kernel, in ASoC: sti, uni_reader_init() registers the shared IRQ before initializing reader->irq_lock. A pending interrupt can invoke the handler while the lock is still uninitialized.

In the Linux kernel, in Bluetooth: btqcomsmd, the teardown order is incorrect: hci_dev is freed before destroying the RPMsg endpoints. If WCNSS delivers data in that window, the callback can run with an already freed hci_dev.

In the Linux kernel, in Bluetooth: btrtl, when parsing firmware format v2, if key_id from chip is zero, rtlbt_parse_firmware_v2() intentionally ignores all security headers, but the implementation simply breaks from a switch and leaks uninitialized return code.

In the Linux kernel, in bootconfig, in get_boot_config_from_initrd(), a crafted initrd with a huge bootconfig size (e.g., 0xFFFFFFFF) can cause pointer arithmetic to wrap around on 32-bit systems, bypassing bounds checks and leading to a fatal page fault during early boot.

In the Linux kernel, in cpufreq, the policy CPU mask (policy->cpus) is allocated without zeroing (alloc_cpumask_var), leaving the bitmap uninitialized. Sysfs attributes are published before the mask is initialized, allowing access to invalid data.

In the Linux kernel, in cpufreq, the policy rwsem is initialized after the sysfs directory and default attributes are created. A sysfs access can reach a policy callback before the semaphore has been initialized.

A use-after-free vulnerability exists in the Linux kernel's proc_flush_pid() function during process exit. Due to an incorrect assumption about holding a reference to thread_pid, the PID can be freed by an RCU callback before proc_flush_pid() completes. The vulnerability can be triggered by an unprivileged user via a race between wait4(-1) and setsid().