CVE Vulnerability Catalog

In the Linux kernel's ARM SCMI subsystem, a vulnerability exists where protocol IDs from the device tree (DT) outside the allowed range are not rejected, potentially leading to truncation and misinterpretation of the protocol. This can also cause aliasing of protocol identities.

In the Linux kernel's ARM SCMI subsystem, a vulnerability exists where on protocol bind failure, the SCMI handle is not released, leading to reference leaks and leaving an inconsistent state. This also applies when device_link_add() fails.

In the Linux kernel's ARM SCMI subsystem, a vulnerability exists where on failure to configure an additional TX receiver channel, the primary mailbox channel is not released, leaving the channel busy.

In the Linux kernel's ARM SCMI subsystem, a vulnerability exists where on failure to configure an additional P2A receiver channel, the primary P2A channel is not released, leaving the channel busy.

In the Linux kernel, the arm_scmi firmware driver has a device lifetime management flaw. scmi_child_dev_find() drops the reference returned by device_find_child() before returning the scmi_device pointer, so a concurrent unregister can release the device while the destroy path still uses the returned pointer. Additionally, the SCMI bus ID may be reused before the old sysfs entry is removed.

In the Linux kernel, the arm_scmi firmware driver has a flaw in transport device lookup during channel teardown. scmi_device_destroy() uses the same protocol/name matching as driver binding, so it fails to find transport devices that must be unregistered. Additionally, duplicate protocol nodes in firmware can reuse an existing transport device and then destroy it.

In the Linux kernel, the cxl/features module's cxlctl_get_feature() sizes its output buffer from the user's fwctl_rpc.out_len but tells the device to write cxl_mbox_get_feat_in.count bytes, where count is a separate user-controlled value. Nothing bounds count against out_len, so a small out_len with a large count overflows the kvzalloc()'d buffer, causing a heap out-of-bounds write reachable from FWCTL_RPC.

In the Linux kernel, the cxl/features module's cxlctl_set_feature() sizes its output buffer from the user's fwctl_rpc.out_len but never checks it is large enough to hold even the fwctl_rpc_cxl_out header. With out_len == 0, kvzalloc() returns ZERO_SIZE_PTR, which passes the !rpc_out check, and the subsequent rpc_out->size = 0 writes through the poison pointer.

In the Linux kernel, the cxl/features module's cxl_get_feature() reads a feature in a loop but passes a fixed size_out as the output capacity every iteration. On the last partial iteration the buffer has less room left, so a device that returns more than asked can overflow feat_out.

In the Linux kernel, the dax/fsdev module does not clear pgmap->vmemmap_shift when binding a static DAX device. When rebinding a static device from device_dax (which may set vmemmap_shift based on alignment) to fsdev_dax, the stale vmemmap_shift persists on the shared pgmap, causing the vmemmap to be built for a different folio order than fsdev requires.

In the Linux kernel, the dax/fsdev module's fsdev_dax_probe() sets pgmap->ops and pgmap->owner but never clears them on unbind. For a static device the pgmap is shared and long-lived, so after fsdev unbinds a static device the stale fsdev_pagemap_ops survives on the shared pgmap. A subsequent memory_failure can then dispatch through the stale, possibly freed handler.

In the Linux kernel, the dax/fsdev module's __fsdev_dax_direct_access() uses virt_addr + linear_offset instead of __va(phys) for the kaddr return. For multi-range devices with physical gaps between ranges, this linear arithmetic crosses the gap and produces a wrong kernel virtual address.

In the Linux kernel, the dax module's dax_holder_notify_failure() reads dax_dev->holder_ops twice without READ_ONCE() — once for the NULL check and once for the indirect notify_failure() call. A concurrent fs_put_dax() can clear holder_ops between the two reads, so the check observes a non-NULL pointer while the call dereferences NULL.

In the Linux kernel, the irqchip/renesas-irqc driver leaks resources on driver removal. The driver allocates domain generic chips at probe, but on removal they are not automatically freed because the domain flags do not include IRQ_DOMAIN_FLAG_DESTROY_GC. This leaks the structures and leaves them on the global list, where they may later be accessed by generic interrupt chip suspend, resume, or shutdown callbacks after the driver has been removed.

In the Linux kernel, the media bcm2835-unicam driver failed to free the asc structure allocated by v4l2_async_nf_add_fwnode_remote() in error and module removal paths. This caused a memory leak detected by kmemleak after rmmod.

In the Linux kernel, the media ipu6 driver freed pdata after auxiliary device initialization, which could lead to a double free of the same object. Error paths already call put_device() and auxiliary_device_uninit(), which trigger release via ipu6_bus_release().

In the Linux kernel OPP subsystem, the initialization order of pointers was changed so that *opp_table was initialized after *opp. This altered the cleanup function order and caused use-after-free errors when _opp_kref_release accessed the already freed opp->opp_table.

In the Linux kernel drm/amd/display driver, a teardown race exists with DM I2C adapters. Adapters can remain visible to userspace during DM teardown, and a concurrent i2c-dev transfer may call amdgpu_dm_i2c_xfer() after DM state is destroyed, leading to a NULL pointer dereference.

In the Linux kernel drm/bridge tc358767 driver, tc_aux_transfer() did not clamp the AUX read size to the request size. The controller could report up to 255 bytes, overflowing the 16-byte auxrdata stack buffer and the caller buffer.

A use-after-free vulnerability was found in the Linux kernel's PAT (Page Attribute Table) mechanism for x86. The issue occurs during concurrent module loading/unloading on multiple CPUs, when the large-page collapse operation is not protected by the proper lock, leading to a write to freed memory and system crash.