CVE Vulnerability Catalog

In the Linux kernel, the USB notifier and initial VBUS detection can schedule isp->work in the isp1704_charger driver. The remove path unregisters the notifier and power supply but does not wait for queued or running work before tearing down the power supply state.

In the Linux kernel, the sc2731_charger power supply driver does not cancel scheduled work on device removal. The USB notifier and initial charger detection can schedule info->work, but the remove path unregisters the notifier without cancelling queued or running work before the devm-allocated driver data is released. The issue was found by a static analysis tool.

In the Linux kernel, bpf_netns_link_update_prog performs checks for old_prog and prog type locklessly before acquiring netns_bpf_mutex. This creates a race condition that can lead to a use-after-free (UAF) when two threads concurrently execute BPF_LINK_UPDATE on the same netns link. The fix moves the checks inside the netns_bpf_mutex critical section.

In the Linux kernel, bpf_link_show_fdinfo and bpf_link_get_info_by_fd access link->prog without holding any locks. If the prog is concurrently replaced via bpf_link_update, the old prog can be freed, leading to a potential use-after-free (UAF). The fix accesses link->prog under RCU protection.

In the Linux kernel, lib/test_hmm's dmirror_fault() returns 0 when mmget_not_zero() fails, even though no page was faulted and no device page table entry was installed. This causes the caller to retry the same address, hit -ENOENT again, and loop forever. The fix returns -EFAULT instead.

In the Linux kernel, md/bitmap's backlog_store() suspends the array before checking whether a write-mostly device exists. If no such device exists, the error path only unlocks reconfig_mutex and leaves the array suspended, blocking subsequent I/O. The fix uses mddev_unlock_and_resume().

In the Linux kernel, the md subsystem stores a memalloc_noio_save() token in mddev->noio_flags, allowing one task to save the token and another to restore it. With concurrent suspend sysfs writes, task A can enter PF_MEMALLOC_NOIO and return to userspace still in that scope, and task B can later restore A's saved token. The fix scopes PF_MEMALLOC_NOIO to allocation critical sections only.

In the Linux kernel, the iommu/dma non-blocking, non-coherent allocation path uses dma_alloc_from_pool(), which returns the allocated page and fills cpu_addr only on success. The code relies on cpu_addr to detect allocation failure, which is incorrect. The fix checks the returned page directly before using it for IOMMU mapping.

In the Linux kernel, swiotlb_alloc_tlb() can allocate from the DMA atomic pool when a decrypted pool is needed from atomic context. With CONFIG_DMA_DIRECT_REMAP, the atomic pool uses remapped virtual addresses that differ from direct-map addresses. swiotlb_init_io_tlb_pool() reconstructs the virtual address from the physical address, storing the wrong address in pool->vaddr for atomic-pool allocations, causing swiotlb_free_tlb() to fail.

In the Linux kernel, the i3c dw driver on an empty bus has ENTDAA assign nothing, so cmd->rx_len equals master->maxdevs. The GENMASK() index master->maxdevs - cmd->rx_len - 1 becomes -1, causing a shift-out-of-bounds and tripping UBSAN. This occurs on every boot on a Gigabyte/AMD server.

In the Linux kernel, md/raid1 skips creating rdev->serial when a new rdev is added to an existing RAID1 array with serialize_policy enabled, due to a condition in mddev_create_serial_pool(). wait_for_serialization() assumes rdev->serial is initialized, leading to an Oops on access to the uninitialized structure. The fix creates the serial pool when adding the rdev.

In the Linux kernel, the iomap mechanism fails to release the folio batch during zero-range operations when errors occur in the iomap_begin and iomap_end callbacks. The fix ensures cleanup is invoked on error paths and updates the helper's behavior.

In the Linux kernel, the sgi-gru driver removes dangerous page-table walks performed in interrupt context. The GRU TLB miss handler previously walked page tables without proper locking, potentially leading to races and security issues.

In the Linux kernel, the mt76x02 driver removes a WARN_ON_ONCE for rx descriptors with invalid lengths. In monitor mode with fcsfail filter, corrupted frames could trigger a kernel panic if panic_on_warn is set.

In the Linux kernel, the mt76 driver fixes handling of channel context switches with different bands in mt76_switch_vif_chanctx. Previously, rapid switches on different radios could cause incorrect behavior.

In the Linux kernel, the mt792x driver has a use-after-free vulnerability in mt76_rx_poll_complete due to a race condition. The wcid pointer may reference an already removed STA, causing invalid memory access.

In the Linux kernel, the wifi mt76 driver for mt7921 chips lacked PCIe AER error handling. When an AER error occurs and the bus hangs, register reads return 0xFFFFFFFF, corrupting the DMA queue state and causing an invalid memory access (q->desc[] or q->entry[]) and a system crash. The fix validates the DMA index read from hardware, checks the bus_hung flag before reset, rejects MCU messages while the bus is hung, and installs no-op bus operations after an unrecoverable AER error.

In the SDIO TX path of the mt76 driver, a memory leak occurs. When tx_prepare_skb() returns an error, the skb buffer is not freed, potentially leading to memory exhaustion. This happens when zero-length frames (e.g., WNM NULL frames) are dropped to prevent hardware hangs.

In the RX data handling of RRO 3.0 in the mt76 driver, there is incorrect queuing. Frames released from the RRO data queue should be placed in the indicator queue, but they are put into the data queue, causing delays and reordering of received packets.

There is an issue with the MLD ID in TXD and HIF TXP in the mt7996 driver. When the MLD_ID field is neither the primary nor the secondary link ID, it can lead to a firmware busy loop when the third link is in power saving mode. The fix remaps frames to the primary link wcid.