CVE Vulnerability Catalog

In the Linux kernel, the legacy I/O and memory sysfs handlers did not check security_locked_down(LOCKDOWN_PCI_ACCESS). As a result, root could write arbitrary I/O ports and map legacy I/O and memory spaces even when the kernel was locked down.

In the Linux kernel, rsc_table_for_each_entry() stored a firmware-supplied u32 offset into a signed int. A crafted offset such as 0xFFFFFFF0 became -16, bypassing the availability check and allowing an out-of-bounds read of hdr->type.

In the Linux kernel, after a failed cgroup BPF program replacement (BPF_F_REPLACE in multi-attach mode), __cgroup_bpf_attach overwrote pl->storage with new storage but failed to restore the old one on the error path. The still-active prog1 holds dangling storage pointers, causing invalid access in bpf_get_local_storage.

A vulnerability was found in the Linux kernel's BPF verifier. When handling load-acquire operations where source and destination registers are the same, the verifier does not properly check the pointer type, allowing access to unconverted kernel objects, potentially leading to data leaks or type confusion.

A vulnerability was found in the Linux kernel thermal/hwmon subsystem. The issue is that a hwmon class device is registered only for the first thermal zone of a given type, and sysfs attributes from other zones are attached to it. Removing the thermal zone that holds the hwmon device can block the removal process due to attributes belonging to other zones.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

In the Linux kernel, the RDMA/erdma driver's EQ handlers look up CQs from dev->cq_xa and invoke callbacks outside the xarray lock. erdma_destroy_cq() can erase the CQ and free its queue buffer and doorbell record while a previously scheduled EQ handler is still using it, causing a use-after-free.

A use-after-free vulnerability exists in the Linux kernel RDMA/erdma driver. The AE QP fatal event and iWARP CM paths load QP pointers from dev->qp_xa and use them outside the xarray lock, so erdma_destroy_qp() can free QP resources while such a lookup is in flight. The fix adds erdma_qp_get_by_qpn() to acquire a kref under the xarray lock and removes the QP from the xarray before dropping the destroy-path reference.

A heap information leak exists in the Linux kernel RDMA/srp subsystem. srp_recv_done() does not pass the received buffer length to srp_process_cred_req() or srp_process_aer_req(), which read fixed-size fields without verifying they were actually received. A malicious SRP target can send a truncated SRP_CRED_REQ or SRP_AER_REQ, causing out-of-bounds reads that are echoed back to the attacker.

In the Linux kernel on ARM, the stub hw_breakpoint_cfi_handler() was removed so it no longer steals breakpoint type 0x03 (ARM_ENTRY_CFI_BREAKPOINT) unless CFI is actively used. When CFI is not instrumented or a breakpoint is issued from userspace, hw_breakpoint_pending() now returns 1 (unhandled fault), allowing userspace to use the breakpoint.

In the Linux kernel on ARM, PREEMPT_RT was enabled without selecting HAVE_POSIX_CPU_TIMERS_TASK_WORK, leaving CONFIG_POSIX_CPU_TIMERS_TASK_WORK disabled so CPU timers expired in hard IRQ context. On PREEMPT_RT this made run_posix_cpu_timers() take the sleeping sighand->siglock, triggering a "sleeping function called from invalid context" bug. The fix selects the option to defer POSIX CPU timer expiry to task context.

In the Linux kernel on ARM, do_DataAbort()/do_PrefetchAbort() called force_sig_fault() with interrupts disabled when the unhandled user fault hook returned non-zero. PREEMPT_RT requires interrupts enabled when sending signals, and this could be triggered by user programs executing the bkpt instruction with CONFIG_PERF_EVENTS=n. The fix enables interrupts in these paths.

In the Linux kernel on ARM, with CONFIG_DEBUG_USER=y and cmdline "user_debug=31", a user fault may trigger show_pte() without any lock. A concurrent munmap() in the same process can free page table pages while show_pte() traverses them, causing use-after-free, and with CONFIG_ARM_LPAE=y even a kernel panic. The fix acquires mmap_write_lock() around show_pte() for user faults and restricts it to user-space addresses (addr < TASK_SIZE).

In the Linux kernel, a race condition in the OCFS2 filesystem during o2net teardown was found. Heartbeat callbacks may remain registered while the teardown destroys the o2net_wq workqueue, leading to a use-after-free in __queue_work(). The issue was detected by KASAN.

In the Linux kernel, the ocfs2 (o2hb) subsystem has a use-after-free bug in the heartbeat region lifecycle. The region is published to the o2net handler table before its delayed works are initialized, and teardown does not fully drain in-flight o2net callbacks. This causes a race and use of freed memory (KASAN slab-use-after-free in __run_timers).

In the Linux kernel, the bpf_get_task_stack and bpf_get_task_stack_sleepable helpers using __bpf_get_task_stack declare buf as ARG_PTR_TO_UNINIT_MEM, which should be initialized on every return path. A missing memset on error paths left the buffer with uninitialized data. The fix adds buffer zeroing to provide deterministic contents.

In the Linux kernel, when CONFIG_FUNCTION_ERROR_INJECTION is disabled, the BPF verifier does not check whether the target symbol is a kernel function or a BPF program, so a sleepable tracing program can attach to a target whose name has an '__x64_'-like prefix. For example, a sleepable fentry program attached to a '__x64_sys_nop' XDP program and using bpf_copy_from_user() can trigger a "sleeping function called from invalid context" bug. The fix disallows sleepable programs when the target BTF is not the kernel's BTF.

In the Linux kernel, the drm/sun4i driver's of_find_device_by_node() takes a device reference for the TCON TOP device that is not dropped after mux configuration completes. This results in a device reference leak.

In the Linux kernel, the drm/sun4i driver's sun4i_crtc_init() returns plain NULL on layer initialization failure, while other error paths return an error pointer. The caller sun4i_tcon_bind() checks with IS_ERR(), so it continues with tcon->crtc set to NULL, leading to a NULL dereference in drm_crtc_mask() and an oops.

In the Linux kernel, the imx6q cpufreq driver allocates the imx6_soc_volt array via devm_kcalloc() against cpu_dev, which is never unbound, so its devres list is never released and the remove function does not free the array. Every probe adds an allocation that persists for the system lifetime.