CVE Vulnerability Catalog

In the Linux kernel, the UBI subsystem's ubi_detach_mtd_dev() obtains a device reference via ubi_get_device() before checking whether the device is busy. The -EBUSY return path drops ubi->ref_count but not the device reference, preventing later release.

In the Linux kernel, the ASoC xilinx formatter_pcm driver's xlnx_formatter_pcm_open() allocates stream_data and assigns the stream pointer before further validation. If a later step fails, ALSA does not call close, so stream_data leaks and the pointer dangles to a freed substream.

In the Linux kernel, the firewire subsystem's build_tree() leaves allocated node instances in a local linked list on the error path. When an invalid value is detected in the self ID sequence, these instances are not freed, causing a memory leak.

In the Linux kernel on arm64, a bug in EFI runtime services handling occurs when software PAN (CONFIG_ARM64_SW_TTBR0_PAN) is enabled. The fpsimd context management code called from __efi_fpsimd_begin() can be voluntarily preempted, causing an incorrect TTBR0_EL1 value upon return to EFI code and leading to a kernel memory access fault. The fix reorders the fpsimd switch so it occurs before the page-table change.

In the Linux kernel on s390, the fetch destination register is not cleared on a faulting arena atomic RMW operation in BPF. When an atomic operation with BPF_FETCH faults on an unmapped arena page, the program resumes with an incorrect register value instead of zero, unlike other BPF_PROBE_* accesses. The fix fills probe->reg from bpf_atomic_load_reg().

In the Linux kernel, a use-after-free exists in bpf_trampoline_multi_attach_free when a BPF trampoline update fails. When bpf_trampoline_update() fails before modify_fentry_multi()/unregister_fentry_multi() is called, cur_image remains unchanged and ftrace still calls into it, so freeing old_image causes a UAF. The fix only frees old_image when it differs from cur_image.

In the Linux kernel, a deadlock occurs during unregistering an s390dbf debug area while one of the associated debugfs files is being written to. The debugfs writing thread waits for debug_mutex held by debug_unregister(), which waits for debugfs_file_put(), causing a deadlock. The fix splits debug_unregister() into an s390dbf and debugfs part, running only the s390dbf part with debug_mutex locked.

In the Linux kernel, the samsung_pwm clock driver uses a regular spinlock, which under PREEMPT_RT on ARM is converted to a sleeping (mutex-based) lock. Such a lock must not be used in atomic context such as hard interrupt handlers. The fix switches samsung_pwm_lock to a raw_spinlock, which remains a true non-sleeping spinlock even under PREEMPT_RT.

A vulnerability in the Linux kernel's ALSA sequencer MIDI rawmidi input teardown involves a race condition during rawmidi substream closing. The snd_midi_input_event() function may run concurrently with the closing, leading to a NULL pointer dereference and kernel crash. The issue is fixed by serializing the teardown with event_input using RCU.

A race condition in the Linux kernel's nvmet subsystem between configfs modification of the max_qid limit and controller allocation can lead to out-of-bounds memory access and potential memory corruption. The fix synchronizes allocation with a semaphore and copies max_qid into the controller structure, eliminating the unsafe dependency.

In the Linux kernel, a vulnerability in the OCFS2 filesystem was found due to missing validation of the orphan slot during inode read. A corrupted dinode with OCFS2_ORPHANED_FL can carry an invalid orphan slot number, leading to out-of-bounds memory access (use-after-free) during inode wipe operations.

In the Linux kernel, the ocfs2 filesystem has a use-after-free due to missing validation of the i_dio_orphaned_slot field during inode read. A corrupted append-DIO dinode can carry an out-of-range slot value for the mounted filesystem, leading to an invalid pointer and a UAF in ocfs2_get_system_file_inode(). The fix rejects an active i_dio_orphaned_slot outside the slot range during dinode validation.

In the Linux kernel, the Squashfs filesystem fails to check whether a block offset read from disk is negative. A negative offset (e.g., into the decompressed fragment block) causes an out-of-bounds access in squashfs_copy_data(). The fix checks if the offset is negative and returns 0, matching existing behavior for offsets beyond the block.

In the Linux kernel's SCSI subsystem (mpt3sas), the _base_release_memory_pools() function incorrectly frees unallocated PCIe SGL buffers, which can lead to a "bad dma" warning on debug kernels or a NULL pointer dereference.

A Use-After-Free vulnerability exists in the Linux kernel's __page_pool_release_netmem_dma function in the page_pool subsystem. A race between page_pool_scrub() and page return via page_pool_put_netmem() on another CPU causes the cmpxchg loser to free the page before the winner finishes accessing its fields, resulting in use of freed memory.

In the Linux kernel, the ntfs_init_from_boot() function in the fs/ntfs3 driver has an integer overflow when validating MFT cluster numbers from the boot sector. The multiplication mlcn * sct_per_clst is performed in u64 and can wrap for large mlcn values, bypassing the volume size check and accepting a malformed record. In practice this causes NTFS mounts to fail in odd places.

Vulnerability in the ntfs3 filesystem driver in the Linux kernel. In the mi_enum_attr() function, insufficient validation of the end virtual cluster number (evcn) can lead to integer overflow, allowing invalid attributes to be accepted. The fix adds a range check for evcn, rejecting values outside the range, except for U64_MAX which is used as a sentinel for empty attributes.

A use-after-free vulnerability was found in the Linux kernel's snd_card_do_free() function in the ALSA subsystem. The issue occurs when a devres-managed sound card is unbound while a user-space application still holds an open file descriptor. After waking up the unbind thread, the user thread reads the 'managed' field from already freed memory, triggering a KASAN error.

In the Linux kernel's HID haptic driver, the fill_effect_buf() function writes an uninitialized value to unhandled usages, which can result in random data being written to the effect's report buffer.

In the Linux kernel's ASoC SOF subsystem, there is a lack of validation of the topology volume range before allocation. An inverted range or a maximum >= INT_MAX can lead to unsafe allocation and indexing.