CVE Vulnerability Catalog

In the Linux kernel hp-bioscfg module (platform/x86), a missing bounds check was fixed when parsing password encodings from ACPI packages, which could cause out-of-bounds reads and passing an invalid pointer to hp_convert_hexstr_to_str().

In the Linux kernel, the hsmp_hwmon_write() function in the platform/x86/amd/hsmp driver takes a user-supplied hwmon value as a signed long and assigns the result of division by MICROWATT_PER_MILLIWATT to a __u32 field. A negative value (e.g. echo -1 > power1_cap) is first converted to a huge unsigned value and then stored into the u32, causing a nonsensical multi-gigawatt socket power limit to be sent to the SMU instead of rejecting the write.

In the Linux kernel, alloc_netdev_mqs() fails to call ref_tracker_dir_exit() on error paths when alloc_percpu() or dev_addr_init() fails. As a result, reading /sys/kernel/debug/ref_tracker/* triggers a use-after-free crash.

In the Linux kernel, several NTFS compressed I/O paths discard the address returned by kmap_local_page() and later access or unmap the page using page_address(). This is invalid for highmem pages, and local mappings must be unmapped using the address returned by kmap_local_page().

In the Linux kernel, the ntfs_ir_to_ib() function contains a heap out-of-bounds write. It copies entries from index_root into a freshly allocated index_block_size-byte buffer without verifying that the entries fit in the available space. The lack of a bounds check before memcpy allows writes past the end of the allocation.

In the Linux kernel, the NTFS filesystem did not reject setxattr of the reserved $LXUID, $LXGID, $LXMOD, and $LXDEV extended attributes from userspace. The fix requires CAP_SYS_ADMIN to modify these attributes.

In the Linux kernel NTFS module, ntfs_read_iomap_begin_resident() reads an MFT record without holding ni->mrec_lock, while other functions modify the same buffer under that lock. This causes a data race and allows reading torn attribute length and offset fields. The issue was fixed by holding mrec_lock from the resident iomap read lookup through iomap_end().

In the Linux kernel, vdpasim_create() leaves vdpasim->worker as an ERR_PTR when kthread_run_worker() fails. The error path drops the device reference, and vdpasim_free() unconditionally passes the worker pointer to kthread_destroy_worker(), dereferencing the ERR_PTR and triggering a general protection fault.

In the Linux kernel, the virtio_balloon driver has no .shutdown handler of its own, so the generic virtio bus handler resets the device during device_shutdown() while the balloon's asynchronous work is still armed. This causes virtqueue_add_inbuf() to return -EIO and trip WARN_ON_ONCE(), turning an ordinary reboot into a kernel panic when panic_on_warn is enabled.

In the Linux kernel, the vdpa/mlx5 driver's add_direct_chain() function adds newly allocated direct MR entries to the local list 'tmp', which is spliced into mr->head only on success. On the error path, the cleanup loop incorrectly iterated over mr->head instead of tmp, leading to improper resource cleanup.

In the Linux kernel, the virtio RTC driver waits without a timeout for the device to return requestq buffers, while RTC class operations run with rtc_device.ops_lock held. On surprise removal, virtio-pci marks the virtqueues broken before unregistering the device, causing viortc_remove() to block in viortc_class_stop() while trying to acquire ops_lock.

In the Linux kernel, the pcf8563 RTC driver registers the CLKOUT clock provider via of_clk_add_provider() but never unregisters it — there is no of_clk_del_provider() call and no remove callback. Each unbind or module reload leaks an of_clk_provider structure and an OF node reference.

In the Linux kernel, a request buffer leak was found in smb2_new_read_req(). The buffer is allocated but not freed or passed to the caller on two error paths, leading to memory leakage. The issue affects the asynchronous SMB2 read path and can be triggered repeatedly on memory registration failures.

In the Linux kernel, rzg2l_clear_irq_int() and rzg2l_clear_tint_int() perform a read-modify-write on the ISCR/TSCR status registers to clear the bit for the handled interrupt. Since these registers are write-0-to-clear per bit, a concurrently set status bit for another interrupt is written back as 0, clearing and losing an unserviced interrupt.

In the Linux kernel, the irq_domain_activate() callback for the ast2700-intc irqchip calls fwnode_device_is_compatible(), which allocates memory with GFP_KERNEL. This occurs with interrupts disabled and a raw spinlock held, which is not allowed and may cause allocation issues.

In the Linux kernel, visconti_clk_register_gate() fills in init.parent_data and assumes init.parent_names is NULL, but the latter is uninitialized. This may cause subtle issues or even a crash, especially with CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE enabled.

In the Linux kernel, IRS affinity setup in the gic-v5 irqchip publishes an IRS pointer and IAFFID state in per-CPU data before remaining IRS initialization can fail. The error path frees the IRS data without clearing that published state, leaving CPUs associated with freed memory.

In the Linux kernel, gic_acpi_parse_iaffid() does not check the return value of get_logical_index(), which may be an error value when a MADT GICC entry does not correspond to a recognized logical CPU. This may result in out-of-bounds indexing of a per_cpu variable array and memory corruption.

In the Linux kernel, snd_ice1712_probe() performs multiple initialization steps after snd_card_new(), but directly returns on failures from later steps without releasing the ALSA card, causing resource leaks when probing fails.

In the Linux kernel, ntfs_decompress() has an off-by-one range check where dp_addr == dp_sb_end falls through to the symbol copy, writing one byte past the destination page. A corrupted compressed $DATA attribute can produce a bounded run of out-of-bounds writes when the file is read.