CVE Vulnerability Catalog

In the Linux kernel SPI subsystem, spi_get_device_match_data() does not check whether spi_get_device_id() returns NULL, which can lead to a NULL pointer dereference. This can happen when using driver_override without a matching SPI ID entry. The fix adds a NULL check.

In the Linux kernel TLS subsystem, the integration of TLS with sockmap (BPF psock) hides many latent bugs that are potentially exploitable. Since no active users of this integration were found, the fix rejects attempts to configure TLS keys on sockmap sockets. Adding a TLS socket to a sockmap was already rejected by sk_psock_init().

In the Linux kernel drm/amdkfd driver, the buffer size returned to user space in the AMDKFD_IOC_GET_DMABUF_INFO ioctl is controlled by the user. A hostile value (e.g. 2 GiB) can trigger an order-MAX allocation and OOM in kernel context. The fix lets the driver determine the buffer size based on the actual metadata size.

In the Linux kernel PCI iproc driver, root bus removal is not protected by the pci_rescan_remove_lock, which can race with concurrent rescan or hotplug operations triggered via sysfs. The fix holds the lock while stopping and removing the root bus.

In the Linux kernel PCI altera driver, root bus removal is not protected by the pci_rescan_remove_lock, which can race with concurrent rescan or hotplug operations triggered via sysfs. The fix holds the lock while stopping and removing the root bus.

In the Linux kernel, the PCI rockchip driver did not hold the pci_rescan_remove_lock while stopping and removing a root bus. This missing lock allowed a race with concurrent rescan or hotplug operations triggered via sysfs.

In the Linux kernel, the PCI mediatek driver did not hold the pci_rescan_remove_lock while stopping and removing a root bus. This missing lock allowed a race with concurrent rescan or hotplug operations triggered via sysfs.

In the Linux kernel, the PCI plda driver did not hold the pci_rescan_remove_lock while stopping and removing a root bus. This missing lock allowed a race with concurrent rescan or hotplug operations triggered via sysfs.

In the Linux kernel, the perf subsystem uses event::addr_filter_ranges under RCU but does not free it via RCU. The incorrect object lifetime can lead to memory errors.

In the Linux kernel, the f2fs filesystem's inline dentry conversion copies names out of the inline dentry area before checking that each recorded name length fits in the available filename slots. A corrupted image can therefore cause the conversion path to read past the inline filename storage.

In the Linux kernel, the au1000 network driver calls free_irq() in au1000_close() while holding aup->lock with spin_lock_irqsave(). free_irq() can sleep because it takes the IRQ descriptor request mutex, so it must not be called inside the spinlocked section.

In the Linux kernel, the SPI subsystem does not abort an active target-mode transfer when the controller is suspended. This can leave the hardware in an inconsistent state and prevent a clean resume.

A flaw was found in the Linux kernel's btrfs module in the validation of the INODE_REF name length (namelen). A crafted btrfs image can contain a namelen larger than the 255-byte limit, causing an out-of-bounds write and a kernel panic.

In the Linux kernel, the ksmbd server's ksmbd_vfs_set_sd_xattr function does not free the sd_ndr.data buffer allocated by ndr_encode_v4_ntacl() when a subsequent ndr_write_*() call returns an error. This causes a memory leak.

In the Linux kernel, the ksmbd server has two issues: when ndr_decode_v4_ntacl() fails, the error path does not free acl.sd_buf (memory leak), and when acl.sd_size is less than sizeof(struct smb_ntsd), the function returns success without freeing the buffer and leaves a stale *pntsd.

In the Linux kernel, a double fput() occurs in the error handling of cachefiles_create_tmpfile() in the cachefiles subsystem. This leads to incorrect release of a file reference.

In the Linux kernel, the drm/amdgpu driver has a vulnerability due to missing synchronization with RCU callbacks during module unload. This can lead to RCU callbacks executing after module memory is freed, causing a page fault and system crash.

In the Linux kernel, the ALSA usb-audio (caiaq) driver's usb_ep1_command_reply_dispatch() reads data from the URB buffer without first verifying that actual_length contains the required bytes. Missing validation of EP1 reply lengths can lead to out-of-bounds reads.

In the Linux kernel, the wifi rsi driver's rsi_hal_load_key() unconditionally copies MIC keys from offsets intended for a 32-byte TKIP key, even for other ciphers (e.g., CCMP) with shorter keys. This can read past the supplied key buffer.

In the Linux kernel, the wifi cfg80211 subsystem's cfg80211_rx_assoc_resp() initializes the status and response-IE fields from the management frame before proving the frame is long enough for those offsets. The S1G path only patches resp_ie after the unsafe initializer has already run.