CVE Vulnerability Catalog

In the Linux kernel, rtw89_mac_check_he_obss_narrow_bw_ru_iter() reads extended capability byte 10 but only rejects datalen values below 10, while reading byte 10 requires at least 11 bytes. The missing length check can lead to an out-of-bounds read.

In the Linux kernel, gb_audio_gb_get_topology() fetches a topology blob of a module-supplied size, and gbaudio_tplg_parse_data() uses the size_dais, size_controls and size_widgets fields to compute section offsets without validating them against the fetched size. A module reporting a small topology size but large section sizes makes offsets point past the allocation, causing out-of-bounds reads.

In the Linux kernel, the staging octeon driver's cvm_oct_tx_shutdown does not call tasklet_kill, so the TX cleanup tasklet can be scheduled by the watchdog IRQ handler and run after cvm_oct_remove() frees net_device structures. This causes a use-after-free in cvm_oct_tx_do_cleanup() while iterating the cvm_oct_device[] array.

In the Linux kernel, the staging octeon driver's cvm_oct_rx_shutdown calls free_irq and netif_napi_del without disabling the NAPI instance first. Since free_irq only waits for hard interrupt handlers to complete, the NAPI poll function may still be active, and if cvm_oct_remove frees the plat structure holding the NAPI instances, the active poll function accesses freed memory.

In the Linux kernel, the RDMA/bnxt_re driver's destroy callbacks zero the udata output after tearing down driver resources. If the userspace access fails, uverbs preserves the uobject and allows the destroy callback to run again even though the driver resource has already been freed. The fix moves ib_no_udata_io() before teardown and ib_respond_empty_udata() to the start of create and modify flows.

In the Linux kernel, the phy-rcar-gen3-usb2 driver's devm_regulator_get_exclusive() initializes the regulator with enable_count = 1, requiring the consumer to disable it before release. The devm disable action was only registered when the caller explicitly requested enable, so when the regulator was left in its initial enabled state without an explicit enable call, the cleanup path skipped decrementing enable_count, triggering a WARN_ON during regulator release on device removal.

In the Linux kernel, the perf/x86/intel/pt driver has an imbalance between perf_aux_output_begin() and perf_aux_output_end() calls. When pt_event_stop() is called without the PERF_EF_UPDATE flag (e.g. due to group throttling), a subsequent pt_event_start() reopens the AUX context, violating the no-nesting rule and triggering a WARNING in perf_aux_output_begin(). This affects scenarios such as AUX area sampling.

In the Linux kernel, the bcm2835 pinctrl driver's bcm2835_pinctrl_probe() calls gpiochip_remove() before the GPIO chip is registered by gpiochip_add_data() when devm_pinctrl_register() fails. This leaves gpio_chip.gpiodev as NULL, resulting in a null pointer dereference inside gpiochip_remove().

In the Linux kernel, the tps6594_regulator_probe() multiphase configuration loop failed to release device node references (np, np_parent, np_pmic_parent) obtained via of_find_node_by_name() and of_get_parent(), causing a reference leak on every iteration. Additionally, a missing NULL check after of_find_node_by_name() could lead to a NULL pointer dereference.

In the Linux kernel, the qcom_wcnss remoteproc driver changed the info pointer increment from num_pd_vregs to num_pds, which for the pronto-v3 platform (no power domain regulators in vregs) shifted the pointer past the end of the array. This manifested as a "regulator request with no identifier" error on SDM632 devices with LLVM-compiled kernels.

In the Linux kernel, the ath11k Wi-Fi driver could receive HT/VHT/HE frames with an MCS above the maximum expressible in the mac80211 rate space (e.g., HE with MCS 12). The ath11k_dp_rx_h_rate() function left an out-of-range rate_idx and never set encoding, causing mac80211 to drop the frame with a warning and discard otherwise valid data.

In the Linux kernel, the BPF interpreter ignored the 'off' field of the BPF_MOV64_PERCPU_REG (BPF_ADDR_PERCPU) instruction, which requires JIT compilation to native code. As a result, loading memory from such a register triggered a page fault and a kernel oops.

In the Linux kernel, ext4_ext_migrate() had a circular lock dependency between s_writepages_rwsem and sb_internal (freeze protection). Calling iput(tmp_inode) before releasing ext4_writepages_up_write() caused a deadlock with concurrent orphan inode cleanup during mount.

In the Linux kernel, ext4_try_to_expand_extra_isize() called during mount (!SB_ACTIVE) could move xattrs to external blocks and release ea_inodes via iput(), creating a circular lock dependency: s_writepages_rwsem -> jbd2_handle -> xattr_sem -> s_writepages_rwsem.

In the Linux kernel, the RDMA/core uverbs_free_dmah() function called rdma_restrack_del() too late, after vendor-specific resources associated with the dmah had already been freed. This left a short window where the dmah remained accessible through restrack, potentially leading to a use-after-free.

In the Linux kernel on arm64, the rsi_attestation_token_init function copying the challenge to &regs.a1 triggered a FORTIFY field-spanning write warning, because register a1 is treated as a single 8-byte field while 64 bytes were copied.

In the Linux kernel, the PCI/pwrctrl tc9563 driver parsing both functions of the integrated Ethernet MAC Endpoint under DSP3 caused an out-of-bounds access past the tc9563_pwrctrl->cfg array. The fix parses the Endpoint node under DSP3 instead of both functions.

In the Linux kernel, the RDMA/efa driver, when registering an MR and creating an indirect PBL, wrongly computed the last chunk length as 0 if the PBL page count was a multiple of EFA_PTRS_PER_CHUNK. This caused the device to see the chunk as empty and reject the memory registration.

In the Linux kernel, the eswin driver for EIC7700 chips has functions eswin_clk_register_pll() and eswin_register_clkdiv() that do not initialize all fields of a stack-allocated clk_init_data structure. Uninitialized stack data causes incorrect clock parent resolution and leads to a NULL pointer dereference during clock registration.

In the Linux kernel, in the md/raid5-ppl module, the ppl_do_flush() function continues iterating after calling ppl_io_unit_finished(), which frees the io object. Subsequent access to io->pending_flushes leads to a use-after-free.