CVE Vulnerability Catalog

In the Linux kernel, the AFS subsystem's afs_dir_search_bucket() fails to kunmap the block it is using in the "bad:" path. This results in a missing kernel memory unmap.

In the Linux kernel, the AFS filesystem has a double-unmap issue in directory block handling. Manual kunmapping without clearing the pointer can lead to a double-kunmap if afs_dir_find_block() is called twice in a row.

In the Linux kernel, afs_lookup_server() incorrectly frees an existing server's endpoint state during candidate cleanup. The candidate record does not have an endpoint state at that point, so the free is unnecessary.

In the Linux kernel AFS subsystem, a use-after-free vulnerability was found due to improper clearing of peer app data during server address list updates, potentially leading to access of freed memory.

In the Linux kernel, the gpio-fan hwmon driver has a use-after-free in alarm work. The queued alarm work is not cancelled, and after unbind it may run after memory is freed.

In the Linux kernel, the Verisilicon Hantro HEVC driver has unbounded tile loops in prepare_tile_info_buffer(). The function writes entries to a DMA buffer, but loops may go out of bounds.

In the Linux kernel, the rkvdec HEVC driver has unbounded tile loops and PPS id in compute_tiles_uniform(), compute_tiles_non_uniform(), and assemble_hw_pps(). These functions may write out of bounds.

In the Linux kernel, the mediatek vcodec AV1 driver has an unbounded tile-start copy in vdec_av1_slice_setup_tile(). The function copies entries into mi_col_starts[] and mi_row_starts[] without bounds checking.

In the Linux kernel, the Verisilicon Rockchip VPU981 AV1 driver has an unguarded division and tile buffer write. The function rockchip_vpu981_av1_dec_set_tile_info() divides by tile_cols which can be zero, and writes descriptors without bounding to buffer capacity.

In the Linux kernel, the Verisilicon Rockchip AV1 driver does not reject frames exceeding tile capacity. The function rockchip_vpu981_av1_dec_set_tile_info() may read out of bounds and program hardware for more tiles than the buffer holds.

In the Linux kernel, v4l2-ctrls lacks validation of HEVC tile counts. Tile column and row counts are not bounded to array capacity, which can lead to out-of-bounds reads.

In the Linux kernel, std_validate_compound() did not bound the tile_cols and tile_rows fields for V4L2_CTRL_TYPE_AV1_FRAME controls. These values are used as loop bounds, array indices, and a divisor, and their product bounds per-tile descriptor buffers. Validation was added to reject values exceeding V4L2_AV1_MAX_TILE_COLS/_ROWS or whose product exceeds V4L2_AV1_MAX_TILE_COUNT.

In the Linux kernel, bnxt_queue_mem_alloc() shallow-copied the live RX ring into a clone, leaving rx_tpa and rx_tpa_idx_map pointing at the live ring's memory. If a later allocation failure took the err_free_tpa_info label, the live ring's memory could be freed while still in use. The fix initializes the clone's pointers to NULL.

In the Linux kernel, bnxt_rx_ring_reset() ignored the result of reallocating RX ring buffers. When bnxt_alloc_one_rx_ring() failed with -ENOMEM, some rxr->rx_tpa[] entries remained zeroed while TPA was re-enabled. The fix falls back to a global reset on allocation failure.

In the Linux kernel, bnxt_init_nic() discarded the return value of bnxt_init_rx_rings() and called bnxt_init_chip(), enabling TPA despite an allocation failure. This could leave rxr->rx_tpa[] partially zeroed. The fix propagates the error out of bnxt_init_nic().

In the Linux kernel, bnxt_queue_mem_alloc() discarded the return value of bnxt_alloc_one_tpa_info_data(), which returns -ENOMEM on the first failed allocation, leaving some rxr->rx_tpa[] entries zeroed. The partially initialized ring was installed by bnxt_queue_start(). The fix checks the return value and unwinds.

In the Linux kernel, the bnxt_en driver has an out-of-bounds write in bnxt_alloc_agg_idx. When firmware advertises fewer concurrent TPAs (e.g., 32) than the maximum, the TPA ID can exceed the size of the rx_tpa array, leading to invalid memory access and a kernel crash at boot.

In the Linux kernel, the bnxt_en driver has a bug that can cause the transmit queue to stop. When the driver defers completions for a burst of packets and then a large USO packet cannot fit in a small ring, the ring may become full of packets with suppressed completions, permanently stalling the queue. This affects small rings (up to 457 descriptors) and was fixed by clearing the NO_CMPL bit in bnxt_txr_db_kick().

In the Linux kernel, the MPTCP syncookies mechanism used an uninitialized bit when copying information in subflow_ulp_clone(). The fix remembers the backup flag by using one bit for both structures without extending join_entry.

In the Linux kernel, a race between disconnect() and retransmission (rtx) in the MPTCP stack was identified, leading to inconsistent state. The fix prevents the race using a synchronous timer stop operation.