CVE Vulnerability Catalog

A flaw was found in the Linux kernel's batman-adv module in the batadv_bla_add_claim() function, which adds claims and modifies backbone CRC values. When the new-claim code path runs in parallel with the change-backbone code path, the backbone_gw pointer can be switched twice, producing an incorrect CRC. This wrong CRC is never recomputed from stored claims, causing persistent inconsistency.

A bug in the Linux kernel's I3C subsystem causes recursive locking during registration of new I3C devices. The function i3c_master_register_new_i3c_devs() registers devices while holding i3c_bus_normaluse_lock(), and device_register() can immediately trigger a probe callback that tries to acquire the same lock again, leading to a deadlock. The fix separates device creation from registration and uses the maintenance lock.

In the Linux kernel, the dm-pcache module did not validate cache segment IDs from persistent memory before indexing into cache->segments[]. With only CRC protection using a public seed, an attacker with CAP_SYS_ADMIN supplying the cache device could cause out-of-bounds reads and writes via crafted metadata. The fix adds validation and rejects invalid segment IDs with -EIO.

The Linux kernel's i3c master subsystem had a use-after-free vulnerability in the master->this pointer. Sysfs attribute callbacks dereferenced master->this, which was freed in i3c_master_detach_free_devs() before the master device was released. The fix keeps master->this alive until i3c_masterdev_release() and resets it on error paths.

In the Linux kernel, the i3c_master_search_i3c_dev_duplicate() function that searches for duplicate I3C devices can incorrectly match the master device itself (master->this), returning the controller as a duplicate. Since the controller is not a target device, it cannot be a duplicate of one. The fix excludes master->this from matching.

In the Linux kernel, the dm-pcache module does not validate the persisted dirty_tail chain at load. A crafted image, whose on-media fields are authenticated only by a crc32c with a fixed seed, can aim dirty_tail at a chain of last ksets that never terminates, causing cache_writeback_fn() to re-arm itself forever. The fix adds validation of the dirty_tail chain at load with a hop cap.

A bug in the Linux kernel's memcg subsystem causes LRU size accounting to be copied to the parent instead of moved when a memory cgroup is offlined, leaving stale counters on the child. This makes the LRU (or MGLRU) scanner read phantom sizes and grind through empty lists on dying cgroups, over-budgeting limits and wasting CPU. On one host, counters described 476 GiB of pages—1.89x the machine's RAM.

A use-after-free vulnerability was found in the Linux kernel's virtio_pmem driver for NVDIMM persistent memory. The issue occurs when a request has already been freed by the submitter but is still reachable via the virtqueue, leading to waking up freed memory during interrupt handling.

In the Linux kernel, the drm/bridge synopsys dw-dp driver initializes and registers the DisplayPort AUX channel during dw_dp_bind(), but never unregisters it. This may lead to resource leaks and/or use-after-free. The fix adds the missing dw_dp_unbind() function to allow cleanup.

In the Linux kernel, the drm/rockchip dw_dp driver initializes and registers core resources such as the DisplayPort AUX channel during dw_dp_bind(), but never unregisters them. This leads to memory leaks and/or use-after-free, as shown in a KASAN report. The issue is fixed by using the exported dw_dp_unbind() function in the component's unbind() callback and in its bind() error path.

In the Linux kernel, the drm/rockchip analogix_dp driver has an OF node reference leak in rockchip_dp_drm_encoder_enable(), because of_get_child_by_name() does not call of_node_put() symmetrically. The fix uses __free(device_node) to automatically manage reference release.

In the Linux kernel, the drm/v3d driver does not clear queue->active_job when v3d_fence_create() fails. The run_job() callbacks for BIN, RENDER, TFU and CSD assign the job to queue->active_job before calling v3d_fence_create(); on failure they return NULL, leaving a dangling pointer. The fix adds a failure path clearing active_job.

In the Linux kernel, smack_msg_queue_msgrcv() incorrectly checks permissions of the 'current' task instead of the 'target' task. In the pipelined_send() optimization path, the sender checks on behalf of the receiver, so an unauthorized receiver can get the message, violating Smack MAC policy. The fix checks permissions on the 'target' task.

In the Linux kernel, cros_typec_register_partner_pdos() copies partner PDOs from the EC TYPEC_STATUS response into the fixed caps_desc.pdo[PDO_MAX_OBJECTS] array (7 entries) without validating the count. If source_cap_count or sink_cap_count exceeds 7, memcpy writes past the stack array — a count of 255 overflows it by about 1 KB. The fix validates the counts and skips PDO registration when exceeded.

A use-after-free vulnerability exists in the Linux kernel HID subsystem. When a driver calls hid_device_io_start() and then fails during later initialization, unwinding via hid_hw_stop() can free the hidraw structure while in-flight HID reports are still being processed on another CPU, causing a dereference of freed memory. Eight drivers are affected because they do not call hid_device_io_stop() before hid_hw_stop().

In the Linux kernel, the HID roccat driver uses an 8-bit, device-supplied profile index without a range check, even though the profiles array has only 5 elements. A malicious USB device claiming the Roccat Kone id can send a switch-profile event with an out-of-range value, causing an out-of-bounds read that is exposed via the actual_dpi sysfs attribute.

In the Linux kernel, the ASoC SOF functions sof_ipc4_widget_setup_comp_src() and sof_ipc4_widget_setup_comp_asrc() print an error and jump to the cleanup label when the number of input or output formats is zero, but 'ret' is still 0. As a result, the function returns success even though the widget setup actually failed.

In the Linux kernel, the cxl/mbox CXL_MEM_SEND_COMMAND bounds the user's in.size to the mailbox payload size but leaves out.size unbounded, which is then used in kvzalloc(). A large out.size drives a huge allocation, above INT_MAX it warns and taints the kernel, and with panic_on_warn=1 it panics.

In the Linux kernel, the ASoC rt700-sdw driver has a vulnerability where rt700_sdw_remove() drains jack_detect_work and jack_btn_check_work only when the hw_init flag is set. This flag is cleared when the SoundWire device becomes UNATTACHED, potentially leaving active work objects and causing DEBUG_OBJECTS to report an active timer after removal.

In the Linux kernel, the ASoC fsl_audmix component leaves the AUDMIX block powered off and suspended after pm_runtime_enable() until the first runtime resume. Register writes issued between probe() and the first resume target unpowered hardware and cause a system hang.