CVE Vulnerability Catalog

In the Linux kernel, the drm/lima driver calls lima_vm_create() before va_start and va_end are set up, so both are 0. When DRM_DEBUG_MM is enabled, the DRM_MM_BUG_ON check in drm_mm_init() fires a kernel BUG, as seen on exynos4412-odroid-u2.

A vulnerability was fixed in the Linux kernel scheduler (sched/fair) involving a u32 overflow in update_tg_cfs_runnable(). The overflow corrupts runnable_sum, leading to a divide-by-zero in propagate_entity_load_avg() and a kernel crash. The issue can be triggered by workloads such as hackbench.

In the Linux kernel, the perf/x86/intel/uncore code has incorrect ordering of uncore_box_ref()/uncore_box_unref() relative to uncore_change_context(). In uncore_event_cpu_online(), uncore_box_ref() runs while box->cpu is still -1, so the box is never initialized on the first CPU in a die, and in the offline path the box is torn down on the second-to-last CPU.

In the Linux kernel, the drm/panthor driver has a NULL pointer dereference (NPD) issue during partial unmap of an evicted buffer object (BO). When BO pages are released on eviction, the 'bo->backing.pages' pointer is set to NULL, and the logic for handling GPU mapping splits did not completely skip this case for the VMA of an evicted BO, leading to a NULL dereference and kernel crash.

In the Linux kernel, the drm/amd/powerplay module had a flaw in the loop parsing the VoltageObjectInfo table. A malformed VBIOS could supply an invalid object size, leading to an infinite loop or heap out-of-bounds read.

In the Linux kernel, the drm/amdgpu/pm/powerplay module lacked bounds checks on vddInd and vddcInd indices from VBIOS-parsed tables. Invalid indices could cause out-of-bounds access to voltage lookup tables.

In the Linux kernel, the drm/amdgpu/pm/powerplay module lacked bounds checks on vddInd, vddciInd and mvddInd indices from VBIOS-parsed tables across nine sites. Invalid indices could cause out-of-bounds access to vddc, vddci and vddmem lookup tables.

In the Linux kernel, the drm/amd/display module's amdgpu_dm_plane_drm_plane_reset() freed the old state before allocating a new one. If kzalloc() failed, the state pointer was left dangling to freed memory.

In the Linux kernel, the drm/amd/display module's amdgpu_dm_crtc_reset_state() freed the old state before allocating a new one. If kzalloc() failed, the state pointer was left dangling to freed memory.

In the Linux kernel's BPF subsystem, copy_map_value_long() failed to copy the padding between map->value_size and round_up(map->value_size, 8) for per-CPU maps. As a result, UAPI LOOKUP_ELEM paths could return stale heap contents to user space.

In the Linux kernel's BPF/LSM subsystem, security_bpf_prog_free() called from softirq context (via __bpf_prog_put_rcu) triggered a "sleeping function called from invalid context" BUG when a sleepable LSM program was attached to the hook. The fix drops bpf_prog_free from sleepable_lsm_hooks.

In the Linux kernel's mm/mm_init, a missing allocation failure check for pgdat->per_cpu_nodestats in free_area_init_core_hotplug led to a NULL dereference when offsetting into the per-CPU area. The fix propagates -ENOMEM and leaves per_cpu_nodestats pointing at boot_nodestats.

In the Linux kernel's leds: lp5860 driver, lp5860_device_init() would double-unlock an already unlocked mutex if lp5860_init_dt() failed. The fix reworks how the lock is taken and released.

In the Linux kernel's dmaengine: xilinx_dma driver, a race condition existed in the AXIDMA and MCDMA interrupt handlers. The channel could be incorrectly marked idle and start spurious transfers while descriptors were still being processed, leading to descriptor corruption or missed completions.

In the Linux kernel, zynqmp_dma_remove() disabled runtime PM only after checking state and performing a manual suspend, which can race with runtime PM in the remove/unbind (rmmod) path. The fix disables runtime PM first, then suspends only if the device is not already suspended, preventing further runtime PM transitions.

In the Linux kernel, the dmaengine xilinx_dma driver's xilinx_dma_poll_timeout function, when called with delay_us=0 and a condition that is never fulfilled, caused the CPU to busy-wait for a prolonged time. Instead of timing out after approximately XILINX_DMA_LOOP_COUNT microseconds, the timeout occurred after several minutes, leading to a CPU stall. The fix introduces the XILINX_DMA_POLL_DELAY_US constant and uses delay_us=10.

In the Linux kernel, the syscall trace path reloads syscall arguments from pt_regs before calling the handler. On C-SKY ABIv2, the code adjusts sp before loading LSAVE_A4 and LSAVE_A5, so the wrong slots are fetched and traced syscalls using the 5th or 6th argument (e.g., mmap2) receive corrupted arguments. The fix loads a4/a5 from pt_regs before changing sp.

In the Linux kernel, the rtw89_ppdu_str() function in the rtw89 Wi-Fi driver uses a '>' comparison instead of '>=', which can lead to an out-of-bounds access. The fix changes the operator to '>=' to avoid the invalid memory access.

In the Linux kernel, in the platform/chrome sensorhub module, max_response and sensor_num come from different EC commands. With malfunctioning EC firmware, the number of read bytes can be less than expected, causing an overread of the resp->fifo_info buffer in cros_ec_sensorhub_ring_handler(). The fix checks the return value of cros_ec_cmd_xfer_status() and aborts on length mismatch.

A vulnerability in the Linux kernel's uprobes mechanism on x86 has been fixed. Optimized uprobes could clobber the user stack redzone area because the call instruction stored a return address on the stack while user code might keep temporary data there without adjusting rsp. The fix moves optimized uprobes from the nop5 to the nop10 instruction, allowing an additional lea instruction to adjust rsp before the call.