CVE Vulnerability Catalog

In the Linux kernel's HID haptic driver, the fill_effect_buf() function writes an uninitialized value to unhandled usages, which can result in random data being written to the effect's report buffer.

In the Linux kernel's ASoC SOF subsystem, there is a lack of validation of the topology volume range before allocation. An inverted range or a maximum >= INT_MAX can lead to unsafe allocation and indexing.

In the Linux kernel for RISC-V (RV64), the JIT does not perform sign-extension for 1-byte and 2-byte kfunc arguments, violating the ABI. After a change in liveness analysis, these issues are exposed.

In the Linux kernel's ACPI scan subsystem, when device_add() fails after allocating an instance ID, the rollback does not clean up bus-ID entries, leaving an unavailable instance number.

In the Linux kernel's qcom-cpucp mailbox driver, the IRQ handler calls mbox_chan_received_data() while holding chan->lock. With PREEMPT_RT, this leads to a self-deadlock.

In the Linux kernel, the qcom-cpucp mailbox driver (qcom_cpucp_mbox_send_data) blindly dereferenced the data pointer, which can be NULL. mailbox_clear_channel() calls mbox_send_message() with NULL to notify the remote side, causing a NULL pointer dereference kernel panic, particularly under PREEMPT_RT.

In the Linux kernel, the riscv-sbi-mpxy driver did not validate the RPMI notification length returned by SBI before copying data from shared memory into the notification buffer. Additionally, the event walker used a reversed loop condition and could inspect a short event record.

In the Linux kernel, the null_blk module initialized its mutex (mutex_init(&lock)) after registering the configfs subsystem, so a racing mkdir() into /sys/kernel/config/nullb/ could call mutex_lock() before the mutex was initialized. This triggered DEBUG_LOCKS_WARN_ON and a WARNING in kernel/locking/mutex.c.

In the Linux kernel, a flaw exists in the null_blk module where the configfs subsystem is registered before default devices are created. A race condition from userspace (mkdir + poweron) can trigger a WARN_ON in __add_disk and, in the error path, a use-after-free (UAF).

In the Linux kernel, the null_blk module with shared_tags enabled allocates a global tag_set via null_init_global_tag_set(). If device creation later fails, the err_dev path never frees the global tag_set, and since module init failed, null_exit() is never invoked — the tag_set's tags and maps are permanently leaked.

In the Linux kernel, the null_blk module allocates the dev->zones array when a zoned device is powered on (null_init_zoned_dev()), but null_del_dev() never frees it on power-off — it is only freed later in null_free_dev() when the configfs directory is removed. Powering the device off and on again overwrites the dev->zones pointer, leaking the previous allocation on each power cycle.

In the Linux kernel, the null_blk module is vulnerable when shared_tags is enabled: resizing submit_queues or poll_queues via configfs on a single device calls blk_mq_update_nr_hw_queues() on the shared tag set. This shrinks set->nr_hw_queues while mq_map[] still points to NULLed hctx slots, causing a NULL pointer dereference and kernel crash (KASAN: null-ptr-deref).

In the Linux kernel's null_blk module, configfs attributes (submit_queues, poll_queues) are stored without proper synchronization. Concurrent stores via separate file descriptors can cause device state inconsistencies, such as a mismatch between submit_queues and the live queue count or an out-of-bounds access to dev->zones[].

In the Linux kernel, a vulnerability in the null_blk driver allows concurrent writes to configfs attributes during device setup, leading to inconsistent device configuration. This can trigger WARN_ON_ONCE warnings, cause device setup failures with -EIO, and in worst cases lead to NULL pointer dereference on write operations.

In the Linux kernel's blk-iolatency mechanism, delay state is not cleared when freeing policy data. A blk-cgroup can remain permanently marked as congested, causing readahead to be cut and throttling to be scheduled on anonymous folio allocation.

In the Linux kernel's blk-iocost mechanism, delay state is not cleared when freeing policy data. A blk-cgroup can remain permanently marked as congested, causing readahead to be cut and throttling to be scheduled on anonymous folio allocation.

A bug was fixed in the Linux kernel's ublk module where __ublk_shmem_remove_ranges() used a temporary xarray allocation with GFP_ATOMIC while removing maple tree ranges. If the allocation failed, the outer loop immediately retried the same range, causing a teardown retry loop with no forward progress. The issue only occurred under allocation fault injection (failslab).

In the Linux kernel's mtip32xx driver, ioctl handlers are not synchronized with device removal. The REMOVE_PENDING bit is checked before entering mtip_hw_ioctl(), but removal can set it immediately afterwards and free dd->port while an ioctl still dereferences it, leading to a use-after-free.

A deadlock exists in the Linux kernel AppArmor subsystem when change_hat is used in complain mode and the target hat does not exist, causing a new learning profile to be created. change_hat() holds a lock while searching the hat list, and creating the new learning profile tries to acquire the same lock, resulting in a hang. The issue affects kernels 6.18.44 and 7.2-rc7 (and 7.0.0 on Ubuntu 26.04 LTS), and is fixed in e.g. 6.12.95 with Debian patches.

In the Linux kernel, the hwmon coretemp driver has a memory leak of the pdata->core_data array on CPUs that do not support X86_FEATURE_PTS. The array is allocated in init_temp_data() but only freed in destroy_temp_data(), which is never called for package data when pkg_data remains NULL. The fix releases the array in coretemp_device_remove().