CVE Vulnerability Catalog

In the mt76 wifi driver (mt7996), after a full chip reset the reset path frees link structures without clearing bits in mvif->valid_links, so mac80211's replayed setup never re-creates dev_info/bss_info/STA records and never re-registers the link wcid, leaving the device inoperative. The reset path also leaks every allocated MLD index, exhausting the index space on repeated resets.

In the mt76 wifi driver (mt7915), mt7915_pci_init_hif2() was called unconditionally and again inside the WED-inactive branch. This double-incremented the global hif_idx, wrote the PCIe RECOG_ID register twice, and leaked a device reference, since removal only drops one reference.

In the mt76 wifi driver (mt7915), after mt7915_register_ext_phy() succeeded, a failure of the main PHY mt7915_init_debugfs() or mt7915_coredump_register() unwound through free_phy2, which called ieee80211_free_hw() on the ext PHY hw while it was still registered with mac80211, since mt76_unregister_device() only unregisters the main hw.

In the mt76 wifi driver (mt7915), the hif2 reference obtained by mt7915_pci_init_hif2() is only released on error paths that key off dev->hif2, which is not assigned until after the IRQ setup. If pci_alloc_irq_vectors() or the primary devm_request_irq() fails, the reference leaks.

In the mt76 wifi driver (mt7996), if the WED attach for the primary PCIe function fails, the probe path still attaches wed_hif2 for the secondary function, leaving the device in an inconsistent half-WED configuration that crashes later. The hif2 call also re-enabled hwrro_mode, which the failed primary attach had just turned off.

In the mt76 wifi driver, mt76_vif_link() indexes mvif->link[] without validating link_id, but callers pass mvif->deflink_id / msta->deflink_id, which hold IEEE80211_LINK_UNSPECIFIED (0xf) until the first link has been added. Since IEEE80211_MLD_MAX_NUM_LINKS is 15, that reads one element past the end of the array, aliasing mt76_vif_data.offchannel_link.

In the mt76 wifi driver (mt7996), when mac80211 leaves the link unspecified, mt7996_tx() substitutes the primary link id of the station or vif. That value is IEEE80211_LINK_UNSPECIFIED (0xf) until the first link has been added, and it is then used unchecked to index vif->link_conf[], mvif->mt76.link[] and sta->link[], all of which hold 15 entries.

In the Linux kernel's ath10k driver for SNOC (WCN3990), copying the MSA region to a crash dump uses plain memcpy() which performs unaligned accesses on a MEMREMAP_WT mapping. This causes an alignment fault and kernel crash during devcoredump collection, and zeroes the dump buffer.

In the Linux kernel for arm64, the ptrace subsystem has an issue with keeping 'orig_x0' in sync with x0 on syscall entry. A previous fix failed to update 'orig_x0' during SECCOMP_RET_TRACE, allowing a tracer to modify the syscall argument without being subjected to seccomp or audit checking.

In the Linux kernel's nl80211_color_change() function there is a memory leak when processing beacon_next data. If beacon_next parsing fails, allocated parameters (such as mbssid_ies and rnr_ies) are not freed because the function returns an error directly instead of using the out: cleanup path.

In the Linux kernel's brcmfmac driver there is an issue with handling P2P action frames when no P2P device vif exists. Some paths assume the vif is always available, which is not true for public action frames sent through the primary interface or when action-frame abort runs before P2P vif creation.

In the Linux kernel's mac80211 subsystem there is an erroneous handling of channel zero during CSA (Channel Switch Announcement) parsing. The refactor incorrectly equated channel zero with no information, so an AP advertising a switch to invalid channel 0 did not trigger a disconnect, which could lead to firmware crashes on some Intel devices.

In the Linux kernel's cfg80211 there is a missing stop of PMSR measurements before tearing down P2P and NAN interfaces. Functions cfg80211_stop_p2p_device() and cfg80211_stop_nan() do not call cfg80211_pmsr_wdev_down(), which can leave stale requests in the driver and cause inconsistencies.

In the Linux kernel's BPF arena, there is a potential deadlock on mmap_lock when arena_vm_fault() fails to take the arena spinlock. The function returns VM_FAULT_RETRY without having dropped mmap_lock, causing it to be taken twice on retry and leading to a deadlock.

In the Linux kernel's coreboot driver there is a missing validation of table bounds. coreboot_table_probe() replaces the platform resource length with values supplied by firmware, which can lead to overflow in 32-bit size addition or mapping memory beyond the resource via a malformed table.

In the Linux kernel's pinctrl (generic) subsystem there is a memory leak in the pinctrl_generic_to_map() function. If any subsequent step (mux, group, config) returns an error, the *maps pointer may contain partially allocated entries that are not freed, causing memory leaks for all drivers relying on this function.

In the Linux kernel for PowerPC, a vulnerability was found in syscall handling after enabling GENERIC_ENTRY. When seccomp or ptrace intercepts a syscall and sets a return value, system_call_exception() did not handle the -1 sentinel, overwriting the set value with -ENOSYS. The fix introduces a thread flag to track explicit return value setting and prevents overwriting.

A vulnerability exists in the Linux kernel's amba-pl011 serial console driver. The pl011_console_write_atomic() function runs in nbcon atomic context and calls clk_enable(), which under PREEMPT_RT can sleep, triggering a "sleeping function called from invalid context" bug. This affects arm32 and arm64 Device Tree SoCs where the UART uses a common-clk managed clock.

In the Linux kernel's serial core, a vulnerability exists where memory allocations for uport->tty_groups and uport->name are performed after console registration, leading to dangling pointers if allocation fails. This can cause NULL dereference (PL011 console) or use-after-free (i.MX console).

In the Linux kernel's uart_register_driver(), on failure of tty_alloc_driver(), drv->state remains pointing to freed memory, and on failure of tty_register_driver(), drv->tty_driver also retains a stale pointer. Drivers using drv->state as an 'already registered' flag may skip registration and pass freed state to uart_add_one_port().