CVE Vulnerability Catalog

In the Linux kernel, the RDMA/cxgb4 module leaks a STAG index when a TPT entry write fails. The write_tpt_entry() function allocates a STAG index but on write_adapter_mem() failure does not release it or reverse the statistics, leading to a leak until device teardown.

In the Linux kernel, the IB/isert function isert_recv_done() passed received PDUs to opcode handlers without checking wc->byte_len, the number of bytes actually placed in the receive descriptor. An initiator could declare a larger data segment in the BHS header than it actually sent, leading to an out-of-bounds read, and in the imm_data_len path also to writing excess heap contents through the backend to the backing store.

A vulnerability in the Linux kernel's IB/isert (iSER) module allows an unauthenticated initiator to declare more data in a login PDU than was actually sent. This leads to an out-of-bounds read before authentication, potentially causing information disclosure or a system crash.

In the Linux kernel, nvmet_execute_get_log_page_rmi() leaves the 'status' variable holding NVME_SC_SUCCESS when kzalloc() for the log buffer fails. The request is then completed with a success status even though no data was transferred. The fix initializes 'status' to NVME_SC_INTERNAL so allocation failures are reported as internal errors.

In the Linux kernel, __nvme_fc_init_request() maps cmd_iu and then rsp_iu for DMA. If the rsp_iu mapping fails, the original code leaves the already-mapped cmd_iu unmapped and marks the op as FCPOP_STATE_IDLE, leaking the cmd_iu mapping for every failed op. The fix jumps to an error path that unmaps cmd_iu and leaves the op in FCPOP_STATE_UNINIT.

In the Linux kernel, the spi-davinci driver allocates the controller with spi_alloc_host() but registers the interrupt with devm_request_threaded_irq(). During removal, the controller is freed before the IRQ handler is drained, allowing a late interrupt to dereference freed memory. The fix switches to devm_spi_alloc_host() and explicitly drains the interrupt with devm_free_irq().

In the Linux kernel, the drm/panthor driver does not verify that vm_bind mappings of user-exposed BOs avoid the region reserved for kernel BO mappings. This missing check can cause address space conflicts. The fix adds an overlap check and guards against 64-bit range overflow.

In the Linux kernel, the ath12k Wi-Fi driver does not enforce a minimum length for the WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT structure, and the firmware-supplied num_vdevs field is used as a loop bound without validation. This can cause an out-of-bounds read. The fix adds a TLV policy entry and a helper to bound num_vdevs.

In the Linux kernel, the ath11k Wi-Fi driver does not enforce a minimum length for the WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT structure, and the firmware-supplied num_vdevs field is used as a loop bound without validation. This can cause an out-of-bounds read. The fix adds a TLV policy entry and a helper to bound num_vdevs.

In the Linux kernel, the qcom iris media driver does not check the return value of pm_runtime_resume_and_get() in iris_core_deinit(). On resume failure, the driver proceeds with hardware power-off, causing unbalanced PM references. The fix skips hardware operations and the corresponding pm_runtime_put_sync() on error.

In the Linux kernel, the stm32 dcmi media driver has several error handling bugs in probe(): the first error path returns directly without cleanup, it checks dcmi->mdma_chan instead of the local mdma_chan variable, and it calls dma_release_channel() on an unassigned dcmi->dma_chan instead of the chan variable. This leads to memory leaks and NULL pointer dereferences.

In the Linux kernel, cros_ec_debugfs_probe() registers notifier_panic with the EC panic notifier chain, but the remove path does not unregister it. A later panic notification can call back into the removed instance and queue work that accesses released data.

In the Linux kernel, the last error path in rtl_pci_probe() skips cleanup functions due to a wrong goto label. Additionally, successful calls to rtl_init_rfkill(), ieee80211_register_hw(), and rtl_debug_add_one() are not reverted.

In the Linux kernel, mhi_register_controller() adds the controller device before creating the optional trigger_edl sysfs file. If sysfs_create_file() fails, the error path only drops the device reference and leaves the device registered.

In the Linux kernel, REQ_NOWAIT support in md personalities that can block internally is fundamentally incomplete. For writes, one mirror may succeed while another returns -EAGAIN, so md cannot distinguish queue pressure from a real device failure, potentially leaving mirrors with divergent data.

In the Linux kernel's md (RAID) subsystem, a race condition exists between the raid10d thread and normal I/O operations. Spare device configuration changes can occur without suspending the array, leading to a NULL pointer dereference and kernel crash.

In the Linux kernel, ath12k_wmi_mac_phy_caps_parse() allocates the mac_phy_caps buffer as tot_phy_id * len, where len is clamped, but memcpy() advances the destination by the full struct size per slot. When firmware sends short TLVs, the second and later slots are written past the end of the allocation.

In the Linux kernel, ath11k_wmi_tlv_mac_phy_caps_parse() allocates the mac_phy_caps buffer as tot_phy_id * len, where len is clamped, but memcpy() advances the destination by the full struct size per slot. When firmware sends short TLVs, the second and later slots are written past the end of the allocation.

In the Linux kernel, qcom_scm_probe() calls devm_request_threaded_irq() before smp_store_release(&__scm, scm). Two paths can dereference __scm before it is published, both causing a NULL pointer dereference.

In the Linux kernel, a failed integrity mapping holds a dio reference, causing a leak. The full bio ending must be performed in case there were previously submitted bios in the sequence.