CVE Vulnerability Catalog

In the Linux kernel, the RDMA/bnxt_re module's bnxt_re_mmap() rejects VM_WRITE for the DBR_PAGE and TOGGLE_PAGE mmap flags, but a read-only mapping can still retain VM_MAYWRITE and later be upgraded with mprotect(PROT_WRITE). This bypasses the write check that only runs at mmap time. The fix clears VM_MAYWRITE before vm_insert_page() in the shared DBR/toggle-page branch.

In the Linux kernel, ext4_init_orphan_info() leaks a buffer_head reference. When ext4_bread() succeeds but orphan block magic or checksum validation fails, the out_free loop starts releasing buffers from i-1, skipping the current buffer_head at index i.

In the Linux kernel, the amd_pstate_ut module does not check whether the amd-pstate driver is active, causing a NULL pointer dereference when modprobe is run on Intel platforms. The lack of state detection leads to a kernel crash.

In the Linux kernel, the cpufreq/amd-pstate driver's amd_pstate_power_supply_notifier() and amd_pstate_profile_set() do not handle cpufreq_cpu_get() returning NULL. This can lead to a NULL pointer dereference during a race with CPU hotplug or driver teardown.

In the Linux kernel, scmi_protocol_table_register() can leave earlier requests registered when a later entry in the same ID table fails. Each request retains a pointer to the driver's ID table, so a failed module load can leave a dangling pointer after the module storage is released.

In the Linux kernel, scmi_driver_register() requests protocol devices before registering the driver. If driver_register() fails, those requests remain in the global IDR and retain pointers to the module's ID table, leading to dangling pointers after the failed module load releases that storage.

In the Linux kernel, xfrm_dev_direct_output() frees the skb when local_out() returns a value other than 1, even though the skb has already been consumed or its ownership transferred. This causes a double-free when netfilter drops the packet.

In the Linux kernel, the RDMA/erdma driver's erdma_destroy_qp(), erdma_destroy_cq(), erdma_dereg_mr(), and erdma_destroy_ah() return early when erdma_post_cmd_wait() fails, leaking queue buffers, MTTs, doorbells, and STAG, QPN, CQN, and AHN identifiers.

In the Linux kernel, the exfat filesystem zeroes the page-cache gap below the new valid_size when a shared writable mapping has its valid_size extended by a buffered write or page fault. A store through the mapping can race with this zeroing and be overwritten.

In the Linux kernel, BPF subprograms use the bpf_callback_t ABI, but task work invokes the callback through a three-argument function pointer. This trips kCFI.

In the Linux kernel, a WARNING occurs in bpf_tracing_link_release because the verifier blindly sets 'tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX'. This corrupts the trampoline and causes failure to restore the prog's nop insn.

In the Linux kernel, the error path in find_pos_and_ways() releases its reference to a switch decoder before logging an error that includes the decoder name. If the released reference is the last one, the decoder can be freed before the error message accesses its name, leading to a use-after-free.

In the Linux kernel, the liveupdate (LUO) mechanism did not remember the status of a failed retrieve() attempt on an FLB, causing the FLB's retrieve() callback to be called again on a retry. The retry is problematic because the FLB may be in a very different state (e.g. some KHO pages may have already been restored and freed).

In the Linux kernel, the pinctrl: mediatek driver registered the gpio_chip with the non-managed gpiochip_add_data() even though the memory was allocated with device-managed memory. Once the drivers can be built as modules and unbound/rmmod'd, devm frees the gpio_chip's memory while it is still registered, causing a use-after-free.

In the Linux kernel, mtk_eint_do_init() creates an IRQ domain, populates it with mappings and installs a chained handler, but never releases them. Now that the drivers can be built as modules and unbound/rmmod'd, this leaves behind a dangling IRQ domain, interrupt mappings whose chip data points at freed memory, and a chained handler that keeps firing into that freed data.

In the Linux kernel, the scsi: ufs: core driver improperly validated string descriptors. It passed a byte count instead of a UTF-16 code-unit count to utf16s_to_utf8s(), which could read beyond the descriptor buffer, and copying bLength bytes could read beyond the response buffer.

In the Linux kernel, the single-doorbell completion path can call ufshcd_compl_one_cqe() with a NULL CQE. If no command is associated with the completion tag, the warning message dereferences the CQE while reporting the error.

In the Linux kernel, the scsi: ufs: core driver did not validate connected lane counts. The connected lane count is used by TX equalization code to index arrays sized by UFS_MAX_LANES, which can lead to out-of-bounds indexing.

In the Linux kernel, ufs_saved_err_write() copies user input into a zero-initialized stack buffer and passes it to kstrtoint(). A write that fills the entire buffer overwrites its only terminator.

In the Linux kernel, kmb_ocs_aes_probe() requests the device IRQ before initializing irq_completion. Once the handler is registered it can run immediately, and ocs_aes_irq_handler() unconditionally calls complete(), using an uninitialized completion.