CVE Vulnerability Catalog

In the Linux kernel, the NVMe driver lacks validation of descriptor sizes while walking the FDP configurations log. A descriptor with dsze == 0 or one past the log end can cause unbounded iteration or reads past the buffer.

In the Linux kernel, the iwlwifi (mvm) driver's P2P-Device binding handling can leave the phy_ctxt pointer as a PHY cache after remain-on-channel ends. A subsequent binding update by the station interface re-adds the P2P-Device to the binding, and its removal deletes the PHY context still in the binding, causing a firmware crash.

In the Linux kernel, the drm/amd/display driver's separate call to dc_update_planes_and_stream for a stream and its phantom stream causes a NULL pointer dereference, since the phantom is destroyed on the first call.

In the Linux kernel, the xhci driver may queue new commands on the command ring even when the xHC is marked inaccessible via HCD_FLAG_HW_ACCESSIBLE. This flag is set and cleared during suspend and resume.

In the Linux kernel, the drm/amdkfd driver's wait_on_destroy_queue() drops locks to wait for queue resume, allowing a concurrent destroy to free the queue and cause a use-after-free (UAF).

In the Linux kernel, the drm/amdgpu driver's FRU PIA parsing uses an open-coded TLV walk without read bounds. Replacing it with fru_pia_advance() and fru_pia_copy_field() helpers bounds every read by the actual EEPROM data length.

In the Linux kernel, the drm/amd/pm driver's pp_dpm_set_pp_table() uses memcpy with a size from the sysfs store count (up to PAGE_SIZE) without an upper bound, while the hardcode_pp_table buffer is allocated once with soft_pp_table_size. This causes a heap overflow.

In the Linux kernel, the drm/amdgpu/pm driver's SmartShift bias sysfs store handler returns a parse error after acquiring PM access, causing an unbalanced PM reference count.

In the Linux kernel, a buffer overflow vulnerability exists during vBIOS update in the drm/amdgpu driver. The write position is not clamped to the maximum buffer size, potentially allowing out-of-bounds access. The fix adds a clamp that blocks unsafe access via the VFS layer.

In the Linux kernel, the drm/amdgpu/ras driver has an issue with cp_ecc_error_irq interrupt handling. The interrupt is acquired in one place and released in another, potentially leading to double-release or use-after-free. The fix moves the release to appropriate functions and adds a ras_suspend callback.

In the Linux kernel, the cxl/region driver has an out-of-bounds array access vulnerability. The construct_region() function uses the part value to index an array without checking for a negative value. If the partition is not resolved, part remains -1, causing an invalid memory access.

In the Linux kernel, the drm/amdkfd driver has an information leak vulnerability across processes. The kfd_smi_ev_enabled() function skips the privilege check for pid=0, and PROCESS_START, PROCESS_END, and VMFAULT events are emitted with pid=0 while carrying other processes' data. This allows users in the render group to monitor all GPU workloads.

In the Linux kernel, the ib_umem_find_best_pgsz() function has boundary condition issues, especially on 32-bit architectures. The iova value may be truncated, and lengths greater than 4GB can overflow. The fix uses proper u64 arguments and adds necessary checks.

A vulnerability in the Linux kernel's BPF sysctl replacement mechanism lacks NUL termination in the buffer passed to handlers, leading to out-of-bounds reads in parsers like bitmap_parse. The fix appends a '\0' to restore expected semantics.

In the Linux kernel, the HSR driver has an issue with sending netlink notifications to the wrong network namespace. The functions hsr_nl_ringerror() and hsr_nl_nodedown() use genlmsg_multicast(), which only delivers in the default init_net namespace, while HSR devices can operate in other namespaces. This causes events to not reach the appropriate recipients.

In the Linux kernel, the ALSA es18xx driver has a possible NULL pointer dereference during control creation. The snd_es18xx_mixer() function does not check if the control allocation succeeded, which under memory pressure could lead to a NULL pointer access.

In the Linux kernel, the netfilter nf_conntrack module has an alignment issue in the tcp_sack() function. The timestamp-only fast path dereferences the option stream as a __be32 value, assuming 4-byte alignment that TCP options do not guarantee. Using get_unaligned_be32() is safer.

In the Linux kernel, a vulnerability in the Btrfs filesystem causes a null-pointer dereference during balance operations when corrupted metadata leaves a chunk entry without a corresponding block group in the in-memory cache. The function btrfs_may_alloc_data_chunk() fails to properly check the result of the block group lookup, leading to a kernel crash when CONFIG_BTRFS_ASSERT is disabled.

In the Linux kernel, the btrfs tree-checker did not validate names in ROOT_REF and ROOT_BACKREF items. A corrupted item could cause readers to use the on-disk name length directly, leading to out-of-bounds reads and copying too many bytes into the UAPI buffer in BTRFS_IOC_GET_SUBVOL_INFO. Validation was added in tree-checker and the copy length was limited to the validated name length.

In the Linux kernel, the ASoC driver for MediaTek mt8365, mt8365_afe_suspend(), did not check the result of the register backup buffer allocation, which could lead to a NULL pointer dereference. A missing NULL check was added and the error is now propagated in mt8365_afe_dev_runtime_suspend() to avoid updating the suspended state on failure.