CVE Vulnerability Catalog

In the Linux kernel's BPF subsystem for s390 architecture, there is an issue with the 'ly' instruction that does not zero the upper bits of a 64-bit register when loading a 32-bit value. The 'llgf' instruction should be used instead, as it correctly zeroes the upper bits.

In the Linux kernel's proc_timens_set_offset() function, there is a lack of validation for the tv_nsec field, which should be in the range [0, 999999999]. Invalid values can lead to incorrect calculations or unexpected behavior when adding times.

In the Linux kernel's qcom gdsc clock driver, there is an issue with improper removal of genpd domains during unregistration. The gdsc_unregister() function does not call pm_genpd_remove() for registered domains, leaving entries on the global list and causing errors on re-registration.

In the Linux kernel's BPF subsystem, there is a vulnerability allowing writes through untrusted BTF pointers, bypassing the read-only policy for pointers created by helpers such as bpf_rdonly_cast(). Non-read accesses are not rejected at the common entry point.

In the Linux kernel's staging media ipu7 driver, there is a pm_runtime refcount leak in ipu7_resume(). Using pm_runtime_get_sync() without balancing on error leaves the usage count incremented.

In the Linux kernel's rcar thermal driver, there is an error checking issue in probe(). The thermal_zone_device_enable() function is called before checking if thermal zone registration succeeded, which could lead to an error pointer dereference.

In the Linux kernel's USB gadget r8a66597 driver, there is a double free of ep0_req in the probe error path. If usb_add_gadget_udc() fails, ep0_req is freed twice, which could lead to memory corruption.

A vulnerability exists in the Linux kernel's UDF filesystem. When an I/O error occurs while writing the Logical Volume Integrity Descriptor (LVID) buffer, the block layer clears the BH_Uptodate flag even though the in-memory LVID data remains valid. If the filesystem is later remounted read-write or synced, udf_open_lvid() and udf_sync_fs() modify the buffer and call mark_buffer_dirty(), triggering a spurious WARN_ON_ONCE(!buffer_uptodate(bh)) warning.

In the Linux kernel's drm/amdgpu/mes driver, the loop initializing the hung_queue_db_array iterated only AMDGPU_MAX_MES_PIPES times, leaving entries uninitialized for multi-XCC GPUs. This can lead to null pointer dereferences when accessing arrays indexed by XCC ID >= 2. The fix extends the loop to cover all XCCs.

In the Linux kernel, bpf_get_btf_vmlinux() has a race condition when publishing the parsed vmlinux BTF result. The result is published via a plain store and read locklessly, which on weakly ordered architectures could allow observing the pointer before initialized data is visible. The fix adds memory barriers (smp_store_release/smp_load_acquire).

In the Linux kernel, bpf_find_vma() reads task->mm and calls mmap_read_trylock() without holding a reference to mm_struct. For a foreign task, concurrent exit_mm() can free the mm_struct between the read and the trylock, leading to use-after-free. The fix pins the mm under task->alloc_lock and uses mmput_async(), rejecting irqs-disabled contexts and !CONFIG_MMU.

In the Linux kernel's bus: mhi: ep driver, mhi_ep_create_device() takes device references for UL and DL channels. If dev_set_name() or device_add() fails, the error path drops only one reference, causing a reference leak and leaving channels associated with an unregistered device. The fix routes both failures through a common unwind path.

In the Linux kernel, when an architecture implements bpf_jit_inlines_helper_call(), the verifier skips rewriting the helper call offset. If JIT is disabled or JIT compilation fails, the program falls back to the interpreter, causing a jump to an invalid address and kernel panic. The fix sets prog->jit_required = 1 to reject such programs when JIT is unavailable.

In the Linux kernel's printk, during legacy printing a handover to another context can occur, releasing the console SRCU read lock and potentially invalidating the console struct pointer. console_flush_one_record() did not check for this after emission, leading to possible use-after-free. The fix moves further @con usage after the handover check.

In the Linux kernel's riscv_acpi_add_prt_dep(), the acpi_get_handle() call can fail, leaving link_handle uninitialized. The fix checks the return status of acpi_get_handle() and skips the entry if it fails.

In the Linux kernel's riscv_acpi_add_prt_dep(), the loop handles error conditions incorrectly by continuing without updating the entry pointer, skipping entries. The fix rewrites the loop as a for loop with correct continuation and uses helper functions.

In the Linux kernel's platform/x86: dell-privacy driver, there is a race condition when accessing priv->features_present. Access must be done with the list mutex held, otherwise priv can be freed at any moment. The fix ensures the mutex is held during access.

In the Linux kernel's platform/x86: dell-wmi-base driver, there is a resource leak on module load failure. The fix ensures proper cleanup of the SMBIOS request and the privacy driver when the module load fails.

In the Linux kernel, the platform/x86 dell-wmi-base module has an indexing bug when handling the ultra performance key. The event data passed to dell_wmi_process_key() is already parsed, so using the wrong index to access the first data field can cause a buffer overread.

In the Linux kernel, the platform/x86 lg-laptop module mishandles LED resources. The event notification callback may access kbd_backlight even when it was not successfully registered with the LED subsystem, and acpi_remove() unregisters LED devices unconditionally.