CVE Vulnerability Catalog

In the Linux kernel, in the IIO chemical atlas-sensor driver, the driver requests its hardware data-ready IRQ with devm_request_threaded_irq(); its threaded handler queues an irq_work, atlas_work_handler(), that calls iio_trigger_poll(data->trig). Since the IRQ is devm-managed, free_irq() runs after atlas_remove() without flushing that irq_work, so a pending irq_work can run after the unwind has freed atlas_data/indio_dev and the trigger, causing a use-after-free when atlas_work_handler() dereferences data->trig.

In the Linux kernel, in the IIO chemical sgp30 driver, sgp_probe() stores the error pointer returned by kthread_run() and returns success, registering the device without its IAQ thread. Later, sgp_remove() passes the error pointer to kthread_stop(), which can lead to issues.

In the Linux kernel, the m62332 digital-to-analog converter driver does not track the current channel state when enabling and disabling the Vcc regulator. This causes a regulator reference count imbalance, leaving the regulator enabled indefinitely after changing a channel from one non-zero value to another.

In the Linux kernel, the apds9306_read_data() function in the apds9306 light sensor driver calls pm_runtime_resume_and_get() but several error paths return directly without releasing the runtime PM reference. This leaks the reference and prevents the device from autosuspending.

In the Linux kernel, the ltrf216a_get_lux() function in the ltrf216a light sensor driver acquires a runtime PM reference, but if ltrf216a_read_data() fails, it returns without dropping the reference. This leaves the runtime PM usage count unbalanced and prevents the device from autosuspending after a failed read.

In the Linux kernel, the dps310 pressure sensor driver crashes during ACPI probe when the device is enumerated through its ACPI HID (IFX3100). i2c_client_get_device_id() returns NULL, and dps310_probe() dereferences that NULL pointer, causing a kernel crash.

In the Linux kernel, KVM nVMX does not flush vpid02 on first use because last_vpid is not reset when vpid02 is freed on VMXOFF. This can lead to the use of stale TLB entries from a previous lifetime of the VPID, associated with a different vCPU or VM.

In the Linux kernel, KVM nVMX does not always clear the KVM_REQ_GET_NESTED_STATE_PAGES flag when emulating a nested VM-Exit, especially when KVM is built with CONFIG_KVM_HYPERV=n. This can lead to double-mapping of vmcs12 pages if KVM bails from VM-Enter without processing the request.

In the Linux kernel, KVM nVMX does not service local TLB flushes when a nested VM-Enter fails. This can lead to a missed TLB flush if L1 changes L2's VPID, then does a failed VM-Enter followed by a successful one.

In the Linux kernel, KVM nVMX may execute INVVPID on a different physical CPU than the one L2 is running on. This can lead to TLB entries not being invalidated on the correct CPU if L1 migrates between CPUs.

In the Linux kernel KVM (x86/mmu) subsystem there is a use-after-free in the rmap aging path. If a writer populates the rmap between the lock's read and the iterator's re-read, the lockless aging path walks the newly installed rmap without holding its lock. This can cause a writer to free the pte_list_desc chain via kmem_cache_free() while the walk is in progress, resulting in a slab use-after-free.

A flaw exists in the Linux kernel's KVM x86 Hyper-V synthetic timer emulation. When a guest or userspace sets the timer COUNT to a value close to U64_MAX, the deadline calculation can overflow and cause the timer to fire immediately, resulting in a CPU livelock and RCU stall reports.

In the Linux kernel, KVM for s390 has a vulnerability due to an incorrect length check in __import_wp_info(). The len field in struct kvm_hw_breakpoint is user-controlled and can be larger than int, leading to memory allocation based on an unvalidated value, which can result in failed allocation and a WARN.

In the Linux kernel, KVM for s390 has a memory leak in guest debug handling. bp_data is freed only on error, and every successful KVM_SET_GUEST_DEBUG leaks memory.

In the Linux kernel, KVM for s390 has a memory leak in the guest debug error path. __import_wp_info() allocates old_data buffers for watchpoints, but if a later watchpoint fails to import, these buffers are not freed, leading to memory leaks on repeated requests.

In the Linux kernel, KVM for s390 has a memory leak on vCPU destruction. Guest debug data (hw_bp_info, hw_wp_info, and old_data buffers) is not freed when a vCPU is destroyed, leading to unbounded memory leaks over VM lifetimes.

In the Linux kernel, KVM for s390 has an issue with not holding srcu when importing watchpoint data. __import_wp_info() reads guest memory, which requires holding kvm->srcu to avoid a race with memslot updates, potentially leading to use-after-free.

In the Linux kernel, KVM for s390 has an issue with uninitialized data in structures used for interrupt injection. __kvm_inject_pfault_token() does not zero the entire structure, which can lead to stack data leakage during migration.

In the Linux kernel, KVM for s390 has a memory corruption vulnerability due to reinjecting CK machine checks. Channel-subsystem damage machine checks should not be forwarded to the guest, and reinjecting them can lead to kfree of a stack variable.

In the Linux kernel, KVM for s390 has an issue with reading gmap->asce without holding mmu_lock in the keyop operation. Other functions read this field inside the mmu_lock read-side, but keyop does not, which can lead to using a stale value and memory corruption.