CVE Vulnerability Catalog

In the Linux kernel, the s390/vfio-ap driver fails to check whether matrix_mdev->kvm is NULL before acquiring the matrix_mdev->kvm->lock mutex. If matrix_mdev->kvm has never been set, attempting to take the lock triggers a NULL pointer dereference. The fix adds checks for matrix_mdev->kvm == NULL before taking the mutex.

In the Linux kernel, vfio_ap_mdev_hot_unplug_cfg() relied on the return value of bitmap_andnot() to decide whether to update the guest APCB. When the resulting bitmap was empty, the function returned false, so the update was skipped and the KVM guest retained stale hardware access to unplugged AP devices.

A vulnerability was found in the Linux kernel's s390/vfio-ap subsystem, where the required mutex (guests_lock) was missing when accessing the list of ap_matrix_mdev objects. Two functions (vfio_ap_mdev_probe and vfio_ap_mdev_for_queue) accessed the list without proper locking, potentially leading to kernel memory corruption or use-after-free during concurrent device creation or removal.

In the Linux kernel, vfio_ap_mdev_probe_queue() created the sysfs attribute group before the queue's driver data was set. A concurrent read of the 'status' attribute could call dev_get_drvdata() and get NULL, which was then dereferenced in vfio_ap_mdev_for_queue(), causing a NULL pointer dereference.

In the Linux kernel, the AFS v2 parser uses footer[8] to locate the image information block within the erase block, then uses region_count to walk entries in a fixed local array. The footer offset and region count come from flash contents and were not validated before use.

In the Linux kernel, mtdoops_notify_add() allocates the oops_page_used bitmap when the configured MTD device is registered, but mtdoops_notify_remove() leaves it allocated. Re-registering the same MTD device leaks one vmalloc allocation per remove/add cycle.

In the Linux kernel, nand_flash_detect_ext_param_page() allocates memory based on the length declared in the ONFI parameter page, then reads the header and variable-length sections without verifying they fit within the allocation. This missing validation can lead to an out-of-bounds read. The fix rejects pages shorter than the fixed header, tracks the remaining variable area, and requires the ECC section to contain every field read from struct onfi_ext_ecc_info.

In the Linux kernel batman-adv module, fragment reassembly reuses the skb from the highest-numbered buffered fragment, and if the interface it was received on is deleted before the chain completes, the merged packet can re-enter the receive path with a stale skb->dev and skb_iif. This can lead to use of a freed net_device. The fix refreshes the receive device metadata before running packet handlers.

In the Linux kernel batman-adv module, batadv_mcast_forw_packet() and batadv_mcast_forw_scrape() can be called indirectly via batadv_mcast_forw_mcsend() without linearizing the skb, triggering SKB_LINEAR_ASSERT() and a fatal BUG(). Linearization should occur during head expansion. The fix ensures proper buffer linearization.

In the Linux kernel batman-adv module, regardless of ARP packet alignment in the SKB, either batadv_arp_ip_src or batadv_arp_ip_dst may cause an unaligned access on hardware without native unaligned read support. The fix uses get_unaligned() to handle this properly on all architectures.

In the Linux kernel batman-adv module, when the mesh interface is deleted, batadv_bla_del_backbone_claims() is not executed because batadv_bla_free() sets claim_hash to NULL before the call, preventing all claims from being freed. Additionally, batadv_handle_unclaim() may fail to find the backbone due to missing rehashing handling. The fix simplifies the claim freeing process.

A vulnerability in the Linux kernel was found, involving an out-of-bounds read in the clock driver for Amlogic GXBB platforms. The issue stems from a hard-coded number of parents for the gxbb_32k_clk_sel clock, which is inconsistent with the actual count, leading to a KASAN error during clock registration. The fix uses ARRAY_SIZE instead of a hard-coded value.

In the Linux kernel, the ASoC cs35l33 driver's cs35l33_runtime_suspend() switches the codec into regcache_cache_only(true) and powers it down without first quiescing the threaded IRQ registered by devm_request_threaded_irq(). This leaves a window where cs35l33_irq_thread() can still run after live register access is closed, reading volatile INT_STATUS_1/2 and driving the AMP_SHORT_RLS, CAL_ERR_RLS, OTE_RLS, and OTW_RLS release paths.

In the Linux kernel, the ASoC cs35l34 driver's cs35l34_runtime_suspend() switches the codec into regcache_cache_only(true), asserts reset low, and powers the device off without first quiescing the threaded IRQ registered by devm_request_threaded_irq(). This leaves a window where cs35l34_irq_thread() can still run after suspend has removed live hardware access, reading volatile INT_STATUS_1..4 and executing the PROT_RELEASE_CTL release sequence or BST fault power-down writes.

In the Linux kernel, the ASoC hdac_hda driver's hdac_hda_dev_probe() gets the HDA link with snd_hdac_ext_bus_link_get() before registering the ASoC component. If component registration fails, the function returns without dropping the link reference, causing a reference leak.

In the Linux kernel, the ASoC loongson driver's loongson_card_parse_acpi() ignores the return value of device_property_read_string() for the `codec-dai-name` property. If the property is missing or invalid, an uninitialized pointer is used later, potentially leading to undefined behavior.

In the Linux kernel, in the IIO buffer subsystem, an anonymous buffer handle holds a reference to the underlying IIO device, which is dropped in the buffer handle's release function. If the device has been removed (unbind or hot-unplug), the buffer handle might hold the last reference. The release function takes the mutex for the buffer using a guard, so the unlock happens after iio_device_put(), which might free both the IIO device and the buffer containing the mutex, leading to use-after-free when the mutex is unlocked.

In the Linux kernel, in the IIO buffer subsystem, the iio_dma_fence implementation uses kfree() to free the dma_fence object, which violates the dma_fence documentation requiring RCU-safe freeing. This might result in a use-after-free.

In the Linux kernel, in the IIO buffer subsystem, the iio_dma_fence implementation uses a lock embedded in iio_dmabuf_priv, but iio_dma_fence can outlive iio_dmabuf_priv, causing a use-after-free. The fix ties the lifetime of the lock to the lifetime of the fence by embedding them in the same struct.

In the Linux kernel, in the IIO chemical atlas-sensor driver, atlas_buffer_postenable() acquires a runtime PM reference with pm_runtime_resume_and_get() but returns the result of atlas_set_interrupt() directly. If atlas_set_interrupt() fails, the runtime PM reference is leaked and the device can never autosuspend.