CVE Vulnerability Catalog

In the Linux kernel, set_user_buf_size() in the RDMA/mlx5 driver computes the QP buffer size by left-shifting user-supplied rq.wqe_cnt and rq.wqe_shift values as signed integers. A sufficiently large rq.wqe_cnt causes signed integer overflow, yielding a small or negative buf_size, causing ib_umem_get() to map a buffer smaller than the hardware will actually write into.

In the Linux kernel, the zisofs_fill_pages() function (isofs filesystem) left the last block pointer buffer_head referenced on the success path. This causes a buffer reference leak when reading the zisofs compressed block pointer table.

In the Linux kernel, the SPI oc-tiny driver allocated the controller with the non-managed spi_alloc_host() while registering the interrupt with devm_request_irq(). During removal the controller was freed before free_irq() ran, allowing a late or latched interrupt to dereference freed memory (use-after-free).

In the Linux kernel, the sched_ext scheduler's scx_hardlockup() deferred the abort via irq_work, which does not work in NMI context and prevented recovery from self-detected hardlockups. It also returned true even when the abort was refused, suppressing the kernel's hardlockup report.

In the Linux kernel, the remoteproc subsystem lacked synchronization between rproc_crash_handler_work() and rproc_del(), allowing a driver to be removed while crash-handler work was scheduled or executing, leading to use-after-free. A "deleting" flag and cancellation/synchronization of the work before removal were introduced.

In the Linux kernel, the iommu/tegra241-cmdqv driver's tegra241_vintf_init_lvcmdq() published the vcmdq pointer into vintf->lvcmdqs[] before tegra241_vcmdq_alloc_smmu_cmdq() initialized vcmdq->cmdq. A latched LVCMDQ error in that window caused a zeroed arm_smmu_cmdq to be passed to __arm_smmu_cmdq_skip_err(), dereferencing NULL pointers.

In the Linux kernel, the iommu/tegra241-cmdqv component has a synchronization flaw between the error interrupt handler (ISR) and VINTF initialization/deinitialization. Missing memory ordering and synchronization can lead to a NULL pointer dereference or use-after-free during a concurrent error. The vulnerability is fixed by using smp_store_release/smp_load_acquire barriers and synchronize_irq().

In the Linux kernel, the iommu/tegra241-cmdqv driver's __tegra241_cmdqv_probe() requested the error IRQ before allocating the cmdqv->vintfs array and setting cmdqv->num_vintfs. A latched CMDQV error inherited across a kexec caused the ISR to walk an uninitialized array.

In the Linux kernel, the iommu/tegra241-cmdqv driver's __tegra241_cmdqv_probe() used devm_krealloc() to grow @smmu, which freed the original pointer upon relocation. A failure after that returned NULL, and the caller dereferenced the freed @smmu on its fallback path.

In the Linux kernel, the iommu/tegra241-cmdqv driver's tegra241_cmdqv_remove() tore down each VINTF first and only then called free_irq(). An error in that window caused the ISR to read a stale slot and dereference a NULL or freed pointer.

In the Linux kernel, the iommu/tegra241-cmdqv driver's tegra241_vintf_init_vsid() mapped a guest vSID to a single physical Stream ID from master->streams[0], only warning when the device did not have exactly one stream. A device with several streams had only its first mapped, and a device with none made master->streams a ZERO_SIZE_PTR, causing an out-of-bounds read.

In the Linux kernel, the iommu/tegra241-cmdqv driver leaks VINTF0 on the init-failure path. When tegra241_cmdqv_init_vintf() fails or a later VCMDQ preallocation fails, VINTF0 is not properly freed because the ownership decision relies on an incorrectly read hardware state.

In the Linux kernel, the RDMA/rxe module has a use-after-free (UAF) in the ODP init error-handling path. When rxe_odp_init_pages() fails, mr->umem is not reset to NULL, causing a later ib_umem_release() call to read already-freed fields.

In the Linux kernel, the clk: mediatek: pllfh driver leaks IO-mapped memory on the PLL registration error path. The mtk_clk_register_pllfhs function does not free the IO memory mapped on the fhctl node when PLL registration fails.

In the Linux kernel, the PCI subsystem has a use-after-free (UAF) when a probe runs concurrently with dynamic ID removal. The pointer to a dynamic ID can be freed by remove_id_store() while pci_match_device() still uses it.

In the Linux kernel, the nilfs2 filesystem has an infinite loop in nilfs_clean_segments(). When nilfs_segctor_construct() repeatedly returns -EROFS (e.g., after an I/O error and remounting the device read-only), the cleaner thread loops forever.

In the Linux kernel, the nilfs2 filesystem has an out-of-bounds read when parsing the super-root block. The super-root inode metadata size is trusted before nilfs_read_inode_common() is called, allowing a malformed filesystem image to read past the super-root block.

In the Linux kernel, the nilfs2 filesystem has a BUG in nilfs_copy_dirty_pages() triggered by a dirty state mismatch. When a dirty page unexpectedly loses its dirty status after the filesystem transitions to read-only mode, the kernel triggers a BUG.

In the Linux kernel, the RDMA/cxgb4 module has an skb leak and double free in write_tpt_entry(). When the device is in a fatal error state, write_tpt_entry() returns an error before handing off the skb, leading to a leak in c4iw_dereg_mr() or a double free in c4iw_get_dma_mr().

In the Linux kernel, the RDMA/mlx5 module has a stack out-of-bounds read in the cc_params debugfs. The get_param() function formats a u32 value as a signed number into an 11-byte buffer, causing a one-byte read past the buffer for values like 0x80000000.