CVE Vulnerability Catalog

In the Linux kernel, the BPF verifier mishandles scalar ids when filling the stack with sign-extending narrowing loads. The shared scalar id is not dropped, so two registers can share the same id while holding different values, allowing the verifier to infer incorrect bounds and enabling an out-of-bounds access.

In the Linux kernel, the remoteproc qcom_q6v5_adsp driver has a device node reference leak. The adsp_map_carveout function calls of_parse_phandle_with_args() but does not release the node reference via of_node_put().

In the Linux kernel, the BPF subsystem fails to validate the rdonly_buf_size and rdwr_buf_size kfunc arguments. Values exceeding U32_MAX are not rejected but truncated when assigned to the u32 mem_size field, causing the verifier to record an incorrect memory size bound.

In the Linux kernel, the platform/x86 asus-wireless module's asus_wireless_probe() returns success when acpi_match_acpi_device() finds no match. This leaves an input device without a notify handler, and when force-bound to a device without an ACPI companion it stores a NULL pointer, causing a NULL pointer dereference on unbind.

In the Linux kernel, the qcom-geni serial DMA TX completion path advanced the transmit FIFO by the byte count stored in port->tx_remaining. If uart_flush_buffer() ran after the hardware completed a DMA transfer but before the completion interrupt was handled, a stale DMA completion could advance and discard new bytes written after the flush. The fix marks an in-flight DMA transfer as stale when the transmit FIFO is flushed.

In the Linux kernel USB gadget UAC1/UAC2 module, configfs rate-list attributes did not validate the input length before storing values into fixed-size arrays of UAC_MAX_RATES (10) entries. Supplying more than ten rates caused an out-of-bounds write past p_srates[] or c_srates[], leading to memory corruption. Additionally, freeing the advanced strsep() cursor caused a memory leak or an interior pointer free.

In the Linux kernel, the error paths for endpoint-disabled (ESHUTDOWN) and request-allocation failure (ENOMEM) in ffs_dmabuf_transfer() of the USB gadget f_fs driver called dma_fence_put() on a fence that had only been kmalloc'd, without dma_fence_init() having been called. Calling dma_fence_put() on such an uninitialized object leads to undefined behavior. The fix replaces it with kfree().

In the Linux kernel, os_desc_qw_sign_show() in the USB gadget configfs driver passed OS_STRING_QW_SIGN_LEN (14) as the input length to utf16s_to_utf8s(), but that argument counts UTF-16 code units while the qw_sign[] array holds only 7 units. When the stored signature fills the array without a NUL terminator, the conversion reads up to 7 units past the end of qw_sign[], exposing adjacent bytes of struct gadget_info through the configfs attribute.

In the Linux kernel, ljca_enumerate_gpio() in the USB ljca driver reads desc->bank_num from the device and loops writing into valid_pin[], which holds only 2 entries. Existing checks do not bound bank_num against the size of valid_pin[], so a device reporting bank_num 9 with pins_per_bank 7 passes validation and overruns the stack. A broken or malicious LJCA device can therefore overflow the stack.

In the Linux kernel, ast_udc_probe() in the USB gadget aspeed_udc driver allocates a coherent DMA buffer used as backing store for endpoint buffers, and ast_udc_init_ep() derives per-endpoint pointers from udc->ep0_buf. A failed allocation is dereferenced during probe, and the existing error path calls ast_udc_remove(), which is unsafe before usb_add_gadget_udc() succeeds. The fix adds an allocation check and a local cleanup helper.

In the Linux kernel, dynamic USB IDs are only guaranteed to be valid while usb_dynids_lock is held, as remove_id_store can free the node. usb_probe_interface used these IDs without copying them, leading to a use-after-free when probe runs concurrently with dynamic ID removal. The fix makes a copy of the ID in usb_probe_interface.

In the Linux kernel, the error path labels in asus_wmi_add() of the platform/x86 asus-wmi driver are out of order relative to the subsystem registration sequence. As a result, failures in asus_wmi_custom_fan_curve_init() or asus_screenpad_init() skip cleanup calls for previously registered resources, leaking them. The fix reorders the labels to match the reverse order of allocations.

In the Linux kernel, mlxbf_pmc_probe() in the platform/mellanox mlxbf-pmc driver passes the result of ACPI_COMPANION() to acpi_device_hid(), which dereferences it. Since a platform driver can be force-bound to a device without an ACPI companion, this leads to a NULL pointer dereference. The fix adds an ACPI_COMPANION() check against NULL and returns -ENODEV.

In the Linux kernel, san_probe() in the platform/surface acpi-notify driver dereferences the result of ACPI_COMPANION() when installing the GSBUS address space handler. Since a platform driver can be force-bound to a device without an ACPI companion, this leads to a NULL pointer dereference. The fix checks the ACPI companion against NULL and returns -ENODEV.

In the Linux kernel, a vulnerability was resolved in the clk: qcom: camcc-sc8280xp driver where CAMCC_GDSC_CLK was not unregistered. With the introduction of sync_state support in the clk and pmdomain subsystems, a kernel warning about titan_top_gdsc status stuck at 'on' occurred when unused clocks were shut down.

In the Linux kernel, bpf_cpumask_populate() writes to its destination with bitmap_copy(), but the destination is typed as struct cpumask *. This allows the verifier to accept borrowed cpumask pointers returned by read-only kfuncs (e.g., scx_bpf_get_online_cpumask()) as a writable destination. The fix changes the destination type to struct bpf_cpumask * so it follows the same ownership rule as other mutating cpumask kfuncs.

In the Linux kernel, the tracing_multi link does not set ftrace_managed, causing failure to release the tracing_multi link when attaching a tracing_multi link followed by an fentry link. This triggers a warning in bpf_trampoline_multi_detach and potential resource leaks. The fix sets 'ftrace_managed = true' in register_fentry_multi().

In the Linux kernel, put_gid_ndev() is queued with call_rcu() and implemented in ib_core. Stopping the workqueues does not drain already queued callbacks, so RCU could invoke it after the module code has been unloaded. synchronize_rcu() does not wait for callbacks; the fix waits for them after all producers have stopped.

In the Linux kernel, devx_free_subscription() can remain queued after the last DevX event file drops its module reference or an auxiliary driver detaches its devices. mlx5_ib can then unload before the callback runs. Registration error unwind has the same risk; the fix waits after all drivers have stopped.

In the Linux kernel, IPoIB reclamation completions can be signaled from inside an RCU callback. Teardown can wake before the callback returns and unload ib_ipoib while its code is still executing. Client registration failure can also remove already-added devices and queue callbacks; the fix waits after client and workqueue teardown.