CVE Vulnerability Catalog

In the Linux kernel, the qnx4 filesystem uses buffer_heads, which do not handle block size > PAGE_SIZE well. Without the fix, mounting triggers BUG_ON(offset >= folio_size(folio)) in folio_set_bh on the first __bread_gfp call.

In the Linux kernel, the jfs filesystem uses buffer_heads, which do not handle block size > PAGE_SIZE well. Without the fix, mounting triggers BUG_ON(offset >= folio_size(folio)) in folio_set_bh on the first __bread_gfp call.

In the Linux kernel, the hpfs subsystem does not correctly handle set_blocksize failures. The hpfs filesystem uses buffer_heads, which do not support block sizes larger than PAGE_SIZE, causing a BUG_ON in folio_set_bh during mount.

Similarly to hpfs, omfs in the Linux kernel fails to handle set_blocksize errors. The filesystem uses buffer_heads that do not support block sizes larger than PAGE_SIZE, leading to a BUG_ON in folio_set_bh during mount.

In the usbip vhci_hcd driver, status_show_vhci does not properly check for a NULL value from platform_get_drvdata(). If a VHCI controller probe fails (e.g., due to USB bus number exhaustion), hcd is NULL and hcd_to_vhci_hcd() dereferences a NULL pointer.

In the Linux kernel (USB HCD) there is a possible deadlock during control transfers to root hubs. When handling SCSI errors, memory allocations must not trigger I/O, but device resetting involves control transfers to the parent hub (possibly a root hub); usbcore does not properly pass flags to usb_submit_urb() in such cases. The issue affects all storage drivers.

In the USB gadget goku_udc driver, there is a NULL pointer dereference in the log when an INT_USBRESET interrupt occurs. If the controller raises a USB reset before any gadget driver is bound (or after unbinding), dev->driver is NULL and the INFO() call dereferences it, causing a crash.

In the Linux kernel's 8250 serial driver, there is a vulnerability due to missing FIFO error IRQ (FIFOE) handling. During the startup phase this can cause a soft lockup in the ISR because reporting IRQ_HANDLED without handling the error immediately retriggers the IRQ.

In the Linux kernel, the function serial8250_register_8250_port() has a NULL dereference vulnerability when both the existing uart slot and up have a NULL ->dev. The code only checks if up->port.dev is non-NULL, but then unconditionally calls has_acpi_companion(uart->port.dev), leading to a NULL dereference and kernel crash.

In the Linux kernel, a driver core issue causes a spurious kernel warning when removing a device whose supplier is in the process of unbinding. This occurs when the supplier's link status is not DL_DEV_DRIVER_BOUND but DL_DEV_UNBINDING, which is legitimate during cascading consumer unbinding. The warning is triggered in __device_links_no_driver during driver removal, e.g., for lan966x_pci.

A use-after-free vulnerability was found in the Linux kernel's virt: acrn module during eventfd shutdown. A race between acrn_irqfd_deassign() and the EPOLLHUP wakeup can free the same hsm_irqfd structure twice, allowing an attacker to exploit a dangling pointer. The issue was fixed by adopting the KVM irqfd lifetime model.

In the Linux kernel (RDMA/counter) there is a leak of the num_counters variable in alloc_and_bind() when __rdma_counter_bind_qp() fails. The error path does not decrement num_counters, which, after repeated failures, can permanently prevent the port from switching to AUTO mode (-EBUSY) and block the MANUAL→NONE auto-revert.

A vulnerability was fixed in the Linux kernel's RDS module where RDS_INFO_* getsockopt options did not filter the global lists they read by the caller's network namespace. An unprivileged user in a fresh user and network namespace could read the addresses and sequence numbers of every RDS socket and connection on the host.

In the Linux kernel, the tegra/soctherm driver did not unregister cooling devices on module removal, leaving the thermal framework with references to freed memory. The change switches to devm-based registration, which automatically releases resources and fixes the issue.

In the Linux kernel, the iwlwifi driver (MLD mode) has a vulnerability causing a kernel panic during failed reconfiguration after a NIC error. The issue stems from processing asynchronous notifications from dead firmware that reference freed memory (dangling pointer). The fix purges notifications immediately upon NIC error notification.

In the Linux kernel, rapl_add_package_cpuslocked() in powercap/intel_rapl returns an error without freeing the previously allocated rapl_package structure, leaking memory on every failed package addition. The fix uses the existing err_free_package label to release the allocation.

In the Linux kernel, after a router temporarily deprecates an IPv6 prefix and later restores it, the kernel permanently loses the ability to generate temporary privacy addresses (RFC 8981) for that prefix. The fix resets the regen_count check for the latest temporary address when processing an incoming Router Advertisement.

In the Linux kernel, the ACPICA component fixes the condition check for AML_ELSE_OP in acpi_ps_parse_loop() to prevent out-of-bounds access. The flaw could lead to reading or writing outside the allowed memory region.

In the Linux kernel, the ACPICA component fixes a use-after-free in acpi_ds_terminate_control_method() by clearing references to method locals and arguments. The flaw could lead to use of freed memory.

In the Linux kernel, the ACPICA component adds boundary checks in acpi_ps_get_next_field() to prevent out-of-bounds access. The flaw could lead to reading or writing outside the allowed memory region.