CVE Vulnerability Catalog

In the Linux kernel, the imx6q cpufreq driver allocates the imx6_soc_volt array fresh on every probe, but fills it through soc_opp_count, which has static storage and is never reset. A second bind after an unbind keeps indexing from where the first stopped, writing past the end of the new array.

In the Linux kernel's IB/isert subsystem, a vulnerability exists where the final Login Response is sent before the session is registered. An initiator that issues a SCSI command immediately after receiving the response can cause it to be executed against a session with a NULL se_tpg pointer, leading to a NULL dereference and system crash.

In the Linux kernel, a vulnerability in IB/isert was resolved where full-feature receive buffers were posted before session registration. An initiator that did not wait for the final Login Response could cause a SCSI command to be executed against a session with a NULL se_tpg, leading to a kernel oops at target_submit. The fix moves buffer posting into isert_get_rx_pdu() and performs it before sending the response.

In the Linux kernel, the RDMA/siw module's siw_accept() looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP. The cleanup assumes the current call installed the association, but qp->cep can point to the CEP of an existing connection, leading to freeing the incoming CEP and a use-after-free.

In the Linux kernel, the kmod dups code uses RCU to ensure a kmod_dup_req instance is freed only after it is no longer referenced. However, parallel users in kmod_dup_request_exists_wait() do not enter an RCU read-side critical section, which can result in a use-after-free.

In the Linux kernel on arm64, swsusp_arch_suspend() returns with DAIF masked when swsusp_mte_save_tags() fails, which is unexpected. The fix restores the saved DAIF state before returning from the error path.

In the Linux kernel, the drm/amd/display driver's AMDGPU_DM_MAX_DISPLAY_INDEX constant is 31, suggesting a maximum of 32 connectors, but it is used like MAX_DISPLAY_COUNT. This causes an off-by-one relative to the DRM core, which supports a maximum of 32 connectors. The fix renames the constant and increases the HDCP per-connector array size to 32.

In the Linux kernel, the Renesas R-Car Gen2 PHY driver has a double of_node_put() in the error path during PHY creation. The for_each_child_of_node_scoped() macro automatically releases the node reference, and the explicit of_node_put() drops it twice. The fix removes the redundant call, letting the scoped cleanup handle it.

In the Linux kernel, the Sunplus PHY driver has improper error handling in sp_uphy_init(). The error paths do not correctly undo operations: on clk_prepare_enable() failure it returns directly, on reset_control_deassert() failure it releases only the clock, and on update_disc_vol() failure it jumps to err_reset to release clock and reset. The fix cleans up these paths.

In the Linux kernel, the AMDGPU DRM driver for GFX6 lacks PFP (pre-fetch parser) usage on compute queues. On GFX6, compute queues use the same CP path as graphics but without draw command support. The fix adds PFP usage for register writes, pipeline sync, and after VM flush to prevent execution issues.

In the Linux kernel, the QLogic SCSI driver (qla2xxx) has a redundant VPD flash read in the sysfs read path. qla2x00_sysfs_read_vpd() calls read_optrom() a second time after releasing optrom_mutex. This repeated read is redundant and runs without the mutex, exposing flash access to concurrent operations. The fix removes the duplicate call.

In the Linux kernel, the firmware_loader has an issue with queueing completed sysfs fallback requests. fw_load_sysfs_fallback() calls device_add() before adding fw_priv to pending_fw_head. This allows a userspace helper to complete the request before it is queued, leading to queueing an already-completed request and potential fault on the next request. The fix checks if the request is already done and does not queue it.

In the Linux kernel, hugetlbfs has an issue with subpool release on fill_super failure. hugetlbfs_fill_super() allocates a hugepage subpool, and if root dentry creation fails, the error path frees the subpool with kfree(), bypassing hugepage_put_subpool() and potentially leaving min_size reservations. The fix uses hugepage_put_subpool() on the failure path.

In the Linux kernel, the qcom qmp-usb-legacy PHY driver has a flaw where the runtime suspend callback may run after pm_runtime_enable() but before pm_runtime_forbid(). This causes a dereference of the uninitialized qmp->phy pointer and a crash. It can also occur if a user re-enables runtime-pm via sysfs before the PHY is initialized.

In the Linux kernel, the qcom snps-femto-v2 PHY driver enables runtime PM before creating the PHY, while runtime PM callbacks dereference the not-yet-ready hsphy instance. This leaves a window where a suspend callback can trigger a NULL pointer dereference. The fix takes a runtime PM usage reference with pm_runtime_get_noresume() before enabling runtime PM and releases it once the PHY is created.

In the Linux kernel, the qcom qmp-usb PHY driver has a flaw where the runtime suspend callback may run after pm_runtime_enable() but before pm_runtime_forbid(). This causes a dereference of the uninitialized qmp->phy pointer and a crash. It can also occur if a user re-enables runtime-pm via sysfs before the PHY is initialized.

In the Linux kernel, the md/raid5 subsystem's raid5_bitmap_sector_map() aligns the array range to full RAID5 stripe widths before converting to component sectors. That width is not always a power of two, so the old round_down()/round_up() logic produces incorrect ranges. The fix uses sector_div()-based arithmetic so the rounded range matches the actual RAID5 stripe width.

In the Linux kernel, the md subsystem's __md_stop() destroyed the bitmap before calling mddev_detach(), causing mddev_detach() to skip bitmap_ops->wait_behind_writes(). With llbitmap, RAID1 behind-write completions could then run after llbitmap storage had been freed. The fix calls mddev_detach() before md_bitmap_destroy().

In the Linux kernel, the md/md-llbitmap subsystem's llbitmap_create() publishes mddev->bitmap before reading the bitmap superblock. If llbitmap_read_sb() fails, the old cleanup freed llbitmap before clearing mddev->bitmap, so readers such as /proc/mdstat could observe a stale pointer. The fix clears mddev->bitmap while holding bitmap_info.mutex.

In the Linux kernel, the md/md-llbitmap subsystem's llbitmap_destroy() deletes pending_timer before flushing md_llbitmap_io_wq, but daemon_work can still be queued or running and rearm pending_timer. If this happens during teardown, the timer can remain armed after llbitmap is freed and later dereference freed memory. The fix adds a BITMAP_SHUTDOWN bit and uses timer_shutdown_sync().