CVE Vulnerability Catalog

In the Linux kernel, the amdxdna accelerator has an issue with zero-length SYNC_BO operations. A request for zero bytes leads to drm_clflush_virt_range() accessing an address before the mapping, causing a page fault and system crash.

In the Linux kernel, the ethosu accelerator has an issue with missing MMIO mapping error checks during probe. devm_platform_ioremap_resource() can return an error pointer, which is used without checking, leading to a crash.

In the Linux kernel, the ethosu accelerator has an issue with job completion fence cleanup. In some error paths, the fence is not initialized and then freed, leading to memory leaks or use of uninitialized data.

In the Linux kernel, the nvme-fabrics subsystem has a DHCHAP secret leak on parse failure. nvmf_parse_options() duplicates the secret before validation, and on error does not free the temporary string, leading to a memory leak.

In the Linux kernel's nvme-fc subsystem, a double free of fabrics options occurs when nvme_add_ctrl() fails. The bug was introduced by commit 1a9e218195a5 and can be triggered under memory pressure or fault injection, leading to use-after-free.

In the Linux kernel, nvme_tcp_handle_c2h_data() failed to check the data direction of a C2HData PDU. A malicious or misbehaving NVMe/TCP controller could respond to a write command with a C2HData frame, triggering a kernel warning (WARN_ON_ONCE) and resetting the controller. No data is copied, so this is not memory corruption.

In the Linux kernel, the nvme_alloc_ns() error path removes the namespace from the sibling list using list_del_rcu() but does not wait for SRCU readers before freeing the namespace struct. A concurrent reader in the multipath code may still hold a reference to ns when kfree(ns) runs, leading to a use-after-free.

A vulnerability exists in the Linux kernel NVMe driver's error handling. The nvme_update_ns_info_block() function only checks for negative error codes, ignoring positive NVMe status codes returned by nvme_query_zone_info(). When a device, firmware, or NVMe-oF target fails the Identify command, setup continues with zero-initialized zone info, leading to a shift-out-of-bounds with a negative exponent and continued I/O submission to a zoned queue with a zero zone size.

In the Linux kernel, nvmet_auth_sq_free() cancels auth_expired_work with cancel_delayed_work(), which does not wait for an already-started callback. As a result, during transport teardown the queue containing struct nvmet_sq can be freed or reused while nvmet_auth_expired_work() still accesses it.

In the Linux kernel, nvmet_tcp_try_recv_pdu() computes the remaining PDU payload length without bounding it against the size of the queue->pdu buffer. When a header digest is negotiated, a duplicate ICReq packet causes a 4-byte write past the end of the 128-byte buffer, overwriting queue->hdr_digest and queue->data_digest with attacker-controlled data.

A vulnerability was found in the Linux kernel's nvmet-tcp subsystem. The NVMe-over-TCP target accepts unsolicited H2CData PDUs without checking whether an R2T was sent for the command. A remote attacker can exploit this to cause a double-add of the command to the response list, leading to a system hang (soft-lockup) or kernel panic (kernel BUG).

In the Linux kernel, migrate_device_range() and migrate_device_pfns() clear entries following a compound folio without limiting them to the number of slots remaining in the npages-sized array. If a compound folio extends beyond the end of the caller-provided range, the loops cause an out-of-bounds write.

A vulnerability in the Linux kernel's hugetlb CMA allocation mechanism was found. The hugetlb_cma_alloc_frozen_folio function does not properly handle a NULL nodemask, leading to a NULL pointer dereference and kernel panic. An unprivileged user can crash the system by requesting a gigantic hugepage allocation with MPOL_PREFERRED_MANY on a system where CMA is configured only on a subset of NUMA nodes.

In the Linux kernel, the nfree field in the BTT info block is read from the medium without validation. btt_freelist_init() and btt_rtt_init() size the freelist[] and rtt[] arrays by nfree, but the I/O path indexes them by the lane bounded by num_lanes rather than nfree. An arena with nfree below the lane count causes an out-of-bounds write.

In the Linux kernel, eisa_irq_setup() prints an error message and continues without advancing the current position when an invalid value is passed via the "eisa_irq_edge=" kernel command line parameter. This causes the same invalid value to be parsed repeatedly, resulting in an infinite loop during kernel boot.

In the Linux kernel, kexec_extra_fdt_size_ppc64() can trigger a NULL pointer dereference. On platforms without any reserved memory regions, get_reserved_memory_ranges() can return 0 while leaving 'rmem' as NULL, and evaluating 'rmem->nr_ranges' then causes a kernel panic.

In the Linux kernel, the __merge_memory_ranges() function (powerpc/kexec_file) has a logic flaw when merging overlapping memory ranges. It compares the current range's start against the previous element instead of the running target index and unconditionally overwrites the range end, causing valid memory ranges to be truncated. As a result, memory fragments may be lost from kexec exclude lists, potentially allowing the crash kernel to overwrite active memory.

In the Linux kernel, vmemmap_populate_compound_pages() on powerpc manually advanced addr_pfn in a way that did not match the loop's progression through vmemmap addresses. This caused pfn_offset to be computed from the wrong PFN and led to incorrect head/tail mapping decisions for compound pages.

In the Linux kernel, vfio_ap_mdev_set_kvm() sets kvm->arch.crypto.pqap_hook before acquiring update locks and checking for a conflicting assignment. On error, it returns -EPERM without restoring the hook pointer, leaving a stale pointer that can lead to a use-after-free when a guest executes a PQAP instruction.

In the Linux kernel, vfio_ap_config_remove used bitmap_andnot to clear bits from the matrix_mdev->matrix.adm bitmap, which prevented explicitly unplugged control domains from being removed from the KVM guest. The fix replaces bitmap_andnot with bitmap_and.