CVE Vulnerability Catalog

In the Linux kernel, the md/raid1 subsystem's raid1_takeover() sets conf->array_frozen = 1 on the newly allocated r1conf and never clears it, so every I/O to the array stalls permanently once _wait_barrier() sees it stuck at 1. This used to be harmless because level_store() called mddev_resume(), but commit b39f35ebe86d removed that call. The fix simply does not set array_frozen in raid1_takeover().

In the Linux kernel, the coresight etm4x driver's use of (nrseqstate - 1) in the loop initializing or setting TRCSEQEVR<n> can cause an underflow when TRCIDR5.NUMSEQSTATE is 0b000. The fix introduces an nr_seq_ctrls field and an ETM_MAX_SEQ_TRANSITIONS macro and applies them to TRCSEQEVR<n> field setup.

In the Linux kernel, the coresight etm4x driver's perf enable path is missing calls to cscfg_csdev_disable_active_config() in two cases: when branch broadcast is selected but unsupported by hardware, and when etm4_enable_hw() fails. This leads to a leak of config_desc->active_cnt. The fix calls cscfg_csdev_disable_active_config() in these error paths.

In the Linux kernel, the BRBE driver (arm_pmuv3) does not initialize the hw_id field in the perf branch stack structure, even though it is passed to userspace. According to documentation, this field should be 0 for architectures storing raw branch records in age order.

In the Linux kernel, the arm_mpam driver causes a NULL pointer dereference when a user unbinds an MSC after mpam_disable() has run in response to an error interrupt. mpam_disable() sets drvdata to NULL, and the driver remove callback does not check this state.

In the Linux kernel, the arm_mpam driver allows unbinding an MSC via sysfs, which can lead to a use-after-free. When the unbound MSC is the last one for a component, the mpam_component structure is freed and later accessed by resctrl_arch_get_config() when reading the schemata file.

A vulnerability was found in the Linux kernel BPF verifier regarding load-acquire instructions (BPF_LOAD_ACQ). Unlike a regular BPF_LDX, load-acquire is not rewritten to BPF_PROBE_MEM, so the JIT emits a plain load with no exception table entry, causing a kernel panic on fault instead of being handled. This affects pointer types requiring fault protection, such as PTR_TO_BTF_ID and PTR_TO_MEM | MEM_RDONLY | PTR_UNTRUSTED.

In the Linux kernel, the scsi: sd driver has incorrect error handling in sd_probe() when sd_large_pool_create() fails after a successful device_add(&sdkp->disk_dev). The out_free_index path calls kfree() on an already registered device and leaks the sysfs entry.

In the Linux kernel, the scsi: sd driver leaks a special_vec mempool page when scsi_alloc_sgtables() fails in sd_setup_unmap_cmnd() or sd_setup_write_same{10,16}_cmnd(). The SCSI midlayer does not call uninit_command() because RQF_DONTPREP is not yet set, causing the page leak.

In the Linux kernel, in the btrfs filesystem on zoned devices, btrfs_delayed_refs_rsv_refill() returns -EAGAIN when over-committed metadata exceeds the usable size in a metadata block-group. If this occurs during reclaim, the transaction is aborted even though -EAGAIN is a transient condition.

A deadlock exists in the Linux kernel's btrfs filesystem during file defragmentation when autodefrag is enabled. Defrag reserves delalloc space while holding dirty and locked folios plus the extent range lock, causing kernel tasks (btrfs-cleaner, writeback, metadata reclaim) to block each other.

A vulnerability in the Linux kernel's Btrfs filesystem can lead to overlapping ordered extents, causing a kernel panic. The issue arises from an unexpected isize revert after a short direct IO, which skips waiting for existing ordered extents during buffered writes.

In the Linux kernel, in the btrfs filesystem, POSIX ACLs can be set even when the root has the read-only property set. The set_acl code path does not check the root's read-only flag because the relevant check was removed in commit 353c2ea735e4.

In the Linux kernel, in the btrfs filesystem, btrfs_read_merkle_tree_page() can find a folio that is not uptodate. After locking the folio, the code treats this as a read error and returns -EIO, making a transient read failure sticky. The fix retries the Merkle item read when a not-uptodate folio is found and unlocks the folio on read_key_bytes() failure.

In the Linux kernel, the btrfs filesystem on zoned devices has a bug that intermittently aborts transactions and forces the filesystem read-only. The issue occurs during metadata-heavy relocation when btree_writepages() encounters an active block group at a higher logical address, leading to -EAGAIN and transaction abort. The fix flushes active metadata and system block groups at the start of btree_writepages() to avoid deadlock and ensure forward progress.

In the Linux kernel, in the btrfs filesystem on zoned disks, btree_csum_one_bio() zeroed the extent buffer's folios before submission, destroying the in-memory buffer while it might still be referenced, leading to extent tree corruption. The fix writes zeros from a shared zero page, leaving the buffer content untouched.

In the Linux kernel, in the btrfs filesystem, the function qgroup_free_reserved_data() has an incorrect length calculation. Using round_up(start + len, sectorsize) gives the rounded end position instead of the length, leading to an oversized length and incorrect calculations. The fix introduces local variables aligned_start and aligned_len.

In the Linux kernel, in the pinctrl driver for Airoha chips, the .irq_request_resources hook is missing. Without it, gpiolib cannot set the GPIOD_FLAG_USED_AS_IRQ flag, breaking pin direction locking and potentially allowing reconfiguration of an active IRQ pin as an output.

In the Linux kernel, in the Bluetooth virtio_bt driver, virtbt_setup_zephyr() passes the response to Zephyr command 0xfc08 as a "%s" string without length checking, potentially causing an out-of-bounds read of adjacent memory. The fix limits printing to skb->len - 1 using "%.*s".

In the Linux kernel, in Bluetooth L2CAP, the hci_conn::l2cap_data field is accessed without locks in l2cap_disconn_ind, potentially leading to use-after-free if l2cap_conn is deleted concurrently. The fix uses proto_lock to guard l2cap_data.