CVE Vulnerability Catalog

In the Thunderbolt driver, after stopping the domain, the root_switch pointer is not set to NULL. The fix sets it to NULL, causing tb_xdp_handle_request() to return an error to the remote host. However, the uuid must be kept alive to respond until the domain is released.

In the dm1105 driver, a missing error check for DMA memory allocation is found. The return value of dm1105_dma_map() is ignored in dm1105_hw_init(). If dma_alloc_coherent() fails, the driver uses a NULL pointer for DMA transfers, leading to a kernel oops or invalid hardware access. The fix adds a check and propagates -ENOMEM on failure.

In the Linux kernel, the crypto ixp4xx driver has a vulnerability to NULL pointer dereference during buffer chain allocation. On allocation failure, the code sets buf to NULL and later dereferences it unconditionally, which can lead to a system crash. Additionally, the partially built chain is not properly released.

In the Linux kernel, the PCI/sysfs subsystem lacks a CAP_SYS_ADMIN check in __resource_resize_store(). This allows unprivileged users to change BAR sizes, potentially disrupting drivers.

In the Linux kernel, the lenovo_se10_wdt watchdog driver has a use-after-free vulnerability and resource leak risk. The issue involves the se10_pdev pointer not being nulled after free, and the DMI callback.

In the Linux kernel, the genirq/proc subsystem has a buffer that is too small for 10-digit interrupt numbers in /proc/irq/<n>/ directory names. This can lead to buffer overflow during name formatting.

In the Linux kernel, the davinci MMC driver has a NULL pointer dereference vulnerability in the IRQ handler. When host->data is NULL and TOUTRD or CRCWR/CRCRD bits are set in qstatus, the code dereferences data without checking, leading to a crash.

In the Linux kernel, the mediatek paris pinctrl driver has an issue with pinctrl_gpio_direction_input/output taking the pinctrl mutex, causing gpiochip operations to sleep. Since .can_sleep is not set, a spinlock may be used instead of a mutex, triggering warnings.

In the Linux kernel, the rtw89 phy WiFi driver lacks a length check before parsing the PHY status IE. Hardware may report an unexpected length, leading to out-of-bounds access.

In the Linux kernel, the coresight perf subsystem has a race condition related to the per-CPU csdev_src pointer during device registration and unregistration. The patch retrieves the path and source from event data to avoid the race.

In the Linux kernel, the drm/amdgpu/userq driver does not pin the mqd and fw objects, which can lead to their eviction. During eviction, the hardware uses invalid addresses, causing page faults and system hangs.

In the Linux kernel, the drm/amdkfd driver's allocate_sdma_queue does not bounds-check the restore_sdma_id parameter, which could lead to invalid memory access.

In the Linux kernel, the get_wave_state() function in the drm/amdkfd driver trusts cp_hqd_cntl_stack_size and cp_hqd_cntl_stack_offset values read directly from the MQD. On the CRIU-restore path (AMDKFD_IOC_RESTORE_PROCESS) these values are attacker-controlled, leading to an unbounded copy_to_user() that can leak adjacent GTT/kernel memory (up to ~4 GiB via integer underflow or 1 MiB against a 4 KiB allocation).

In the Linux kernel, the allocate_doorbell function in the drm/amdkfd driver allows setting the doorbell id to a specific value (used by CRIU) without bounds checking. The lack of validation may allow out-of-range values to be used.

In the Linux kernel, the drm/amdgpu driver's psp_copy_fw function was changed from void to int to return -ENODEV when drm_dev_enter fails and -EINVAL when the image size is zero or larger than the 1 MiB PSP private buffer. Open-coded memset/memcpy into fw_pri_buf was replaced with psp_copy_fw.

In the Linux kernel, the drm/amdgpu driver does not properly bound the GPIO I2C table entry count from VBIOS. The fix rejects undersized tables and caps the derived entry count to AMDGPU_MAX_I2C_BUS to avoid overrunning adev->i2c_bus[] or walking an absurd number of entries on corrupt size fields.

In the Linux kernel, the wifi: mac80211 subsystem calls ieee80211_handle_reconfig_failure on NAN reconfiguration failure, marking all interfaces as not in the driver. Then cfg80211_shutdown_all_interfaces destroys the interfaces, but other interfaces' state (e.g., BSS station) is not reported to the driver, potentially leaving dangling pointers to stations and links (at least for iwlwifi).

In the Linux kernel, the net/rds subsystem's rds_ib_conn_path_shutdown function sleeps on a wait_event call, blocking other work items in the queue and causing a hang when tearing down ib network configs. The fix changes wait_event to a timeout-based wait_event and loops until the wait check succeeds.

In the Linux kernel, the affs filesystem uses buffer_heads, which do not handle block size > PAGE_SIZE well. Without the fix, mounting triggers BUG_ON(offset >= folio_size(folio)) in folio_set_bh on the first __bread_gfp call.

In the Linux kernel, the bfs filesystem uses buffer_heads, which do not handle block size > PAGE_SIZE well. Without the fix, mounting triggers BUG_ON(offset >= folio_size(folio)) in folio_set_bh on the first __bread_gfp call.