CVE Vulnerability Catalog

In the Linux kernel wifi iwlwifi driver, the loop counter 'count' in iwl_fwrt_dump_error_logs was declared as u8 while num_pc is u32. If firmware advertises more than 255 PC entries, the counter wraps and the loop never terminates, potentially causing an infinite loop or reading past the pc_data array.

In the Linux kernel wifi iwlwifi mvm driver, iwl_mvm_frob_txf_key_iter() had an off-by-one error in calculating the start offset for key sanitization. This zeroed one byte before the match and left the final key byte unsanitized.

In the Linux kernel wifi iwlwifi mei driver, the SAP message size was not checked before reading the message. The lack of size verification could lead to a buffer overflow.

In the Linux kernel wifi iwlwifi driver, iwl_dbg_tlv_alloc_fragments could cause a division by zero when num_frags was 0. Missing checks on the required size and fragment count allowed this situation.

In the Linux kernel, the host1x driver's debug output helpers used vsnprintf(), which returns the length the formatted string would have reached with an unbounded buffer. This value was passed as the number of bytes to emit, potentially causing a read past the end of the output buffer if the string exceeded 256 bytes. The issue affected debugfs files and was unlikely in practice.

In the Linux kernel, the drm/msm/adreno driver's a6xx_gpu_init() function has a use-after-free bug on the error path. The a6xx_destroy() function frees 'a6xx_gpu', and then 'adreno_gpu' points to freed memory. The fix preserves the error code before freeing the memory.

In the Linux kernel, the drm/msm driver's recover_worker function leaks a reference to the task_struct. get_pid_task() increments the reference count, but the corresponding put_task_struct() is missing in the else branch, leaking a reference on every GPU hang recovery.

In the Linux kernel, the drm/msm driver's msm_ringbuffer_new() destroys a partially initialized ring through msm_ringbuffer_destroy() when an allocation or scheduler setup step fails. If drm_sched_init() fails before finishing initialization, the failure path still calls drm_sched_fini(), which assumes initialized scheduler state. The fix tracks successful scheduler initialization and calls drm_sched_fini() only after drm_sched_init() returned 0.

In the Linux kernel, the scsi: ufs: core driver has a potential memory reclaim deadlock in the TX EQTR context. Functions ufshcd_tx_eqtr(), __ufshcd_tx_eqtr(), and ufs_qcom_get_rx_fom() allocate memory with GFP_KERNEL, which can trigger direct reclaim that depends on I/O to the UFS device, while the queue is quiesced, leading to deadlock. The fix uses memalloc_noio_save/restore() in ufshcd_tx_eqtr() to cover all allocations in the call tree.

In the Linux kernel, the usb: gadget: f_uac1_legacy driver's UAC1_STR_ATTRIBUTE macro defines show/store handlers for the fn_play, fn_cap, and fn_cntl string options. The store function contains an inverted null check on the kstrndup() return value, causing every write attempt to return -ENOMEM on success and dereference a NULL pointer on allocation failure. The attributes have been broken and unused for years. The fix removes the macro and the three attributes.

In the Linux kernel, the UDF filesystem's udf_symlink_filler() can enter udf_pc_to_char() with a partial pathComponent header. The fix adds validation that enough input remains for a complete header before accessing it, rejecting malformed symlink data that would otherwise cause an out-of-bounds read.

In the Linux kernel, the uio driver has a stale info pointer issue in the failed registration path. After device_add(), the UIO device is visible to userspace and /dev/uioX can be opened. If a later setup step fails, __uio_register_device() unwinds the device but leaves idev->info pointing at the caller-owned struct uio_info. This is unsafe when an opener races with the failed registration path, leading to use-after-free. The fix handles post-device_add() failures like unregister: removes UIO attributes, clears idev->info under info_lock, and wakes waiters before removing the device.

In the Linux kernel, the speakup: keyhelp driver's help_init() builds letter_offsets[] by using the first byte of each function name as an index via `(start & 31) - 1`. If function names are overridden from sysfs (root) with a name starting outside [a–z], the index underflows or exceeds the array, leading to OOB write. The fix checks the first letter in help_init() and returns an error if it is not in the [a–z] range.

In the Linux kernel, the misc: bcm-vk driver has an ordering issue with msgq_inited. bcm_vk_sync_msgq() fills the message queue information and then sets msgq_inited. Readers call bcm_vk_drv_access_ok() before accessing the queues. atomic_set()/atomic_read() do not order those accesses, so a reader can see msgq_inited set while still seeing stale queue information. The fix uses release when publishing the initialized queues and acquire when checking the gate.

In the Linux kernel, the ad525x_dpot driver created sysfs files manually in probe, causing issues with rolling back partial sysfs state on error and with removing files on device detach. The vulnerability was fixed by moving device attributes into driver core dev_groups and adding an is_visible() callback that exposes only attributes supported by the probed device.

In the Linux kernel, the ipack ipoctal driver had three issues when a device was removed while a tty session was active: a use-after-free of struct ipoctal, a NULL dereference in ipoctal_write_tty(), and a use-after-free in ipoctal_cleanup(). Fixes introduce kref-based lifetime management, a NULL check for xmit_buf, and a "removed" flag checked in tty operations.

In the Linux kernel, in the mtdswap module, a debugfs setup failure after successful blktrans registration could free the mbd_dev structure twice. The fix clears the local pointer after deregistration so the common cleanup path does not free the blktrans object twice.

In the Linux kernel, mtd_add_partition() did not reject the special offset value MTDPART_OFS_RETAIN (-3), leading to a WARN_ON in add_mtd_device() when called through the BLKPG ioctl on NAND devices. The RETAIN value relies on cur_offset being the end of the previous partition, but in the dynamic partition path cur_offset equals the offset argument itself, causing undefined behavior.

In the Linux kernel, in the drm/v3d driver, the BO list was only attached to the last job in a chain, so when the last job was a trailing CACHE_CLEAN job, the job actually consuming the BOs had no implicit dependencies. This could allow one context to read a BO while another was still writing it, causing data corruption. The fix attaches BOs to the consuming job and adds a has_implicit_dep flag.

In the Linux kernel, the software_node_get_reference_args() function incorrectly checked the index bounds when UINT_MAX was passed, leading to an out-of-bounds access in the property array. The fix extends the bounds check to also cover the UINT_MAX case.