CVE Vulnerability Catalog

In the Linux kernel, KVM for arm64 has an issue with incorrectly handling the end of the VA space during TLB invalidation. The range comparison does not account for address rollover, which can lead to failed TLB invalidation for the last page/block in the TTBR1 VA space.

In the Linux kernel, KVM for arm64 has a race between VNCR TLB invalidation and vcpu_put() unmapping the VNCR page. This can lead to a TOCTOU pattern and a BUG_ON(), potentially causing a system crash.

In the Linux kernel, a KVM arm64 issue exists in VNCR invalidation. When one vcpu invalidates the VNCR TLB while another vcpu is faulting in the same page, a stale TLB entry can be inserted. The fix extends invalidate_vncr_va() to update the mmu_invalidate_seq counter so the fault is replayed.

In the Linux kernel, the global VNCR mapping counter in KVM arm64 was removed. This counter was used to decide whether a TLB invalidation was needed, but it had flaws: checking it could cause missed TLB invalidations, and an L1 vcpu invalidating its own TLB would not invalidate the VNCR pseudo TLB. Since it failed to provide required guarantees, it was removed entirely.

In the Linux kernel, the decode_range_tlbi() helper used for S1 range-based TLB invalidation in KVM arm64 omitted the required sign extension of the virtual address. This could lead to incorrect invalidation range calculation. The fix adds the missing sign extension and guards against PA bit overflow when used for S2 invalidation.

In the Linux kernel, vgic_v3_save_pending_tables() in KVM arm64 iterates over dist->lpi_xa without holding a reference to the vgic_irq structures, relying only on temporary RCU coverage. A concurrent path can free the LPI, leading to a dangling pointer dereference after the RCU grace period. The fix re-fetches each LPI via vgic_get_irq() and drops it with vgic_put_irq().

In the Linux kernel, vgic_its_save_ite() in KVM arm64 unconditionally dereferences ite->collection, which can be NULL after a MAPC with V=0. A guest issuing MAPD, MAPTI, then MAPC(V=0) can cause a host kernel oops when the VMM issues KVM_DEV_ARM_ITS_SAVE_TABLES for migration. The fix saves a zeroed entry, which is read back as invalid on restore.

In the Linux kernel, range-based TLB invalidation (TLBI Range) in KVM arm64 can encode large ranges in few bits, making it easy for a guest to cause an overflow if the hypervisor naively adds the range to the base address. The fix caps the range to the limit dictated by the address bit determining the VA range, and for IPA invalidation further ignores the upper range.

In the Linux kernel, the vector[] variable declared on the stack in dmsintc_inject_irq() in KVM for LoongArch is sometimes used without initialization. The fix initializes this variable to avoid using uninitialized data.

In the Linux kernel, kvm_loongarch_init() in KVM for LoongArch calls kvm_loongarch_env_init() to allocate resources, then calls kvm_init(). If kvm_init() fails, resources are not freed because module_exit() is not run on module init failure. The fix calls kvm_loongarch_env_exit() when kvm_init() fails.

In the Linux kernel, kvm_arch_prepare_memory_region() in KVM for LoongArch computes arch flags for a memslot only for KVM_MR_CREATE and KVM_MR_MOVE, returning early for KVM_MR_FLAGS_ONLY. Since the generic code allocates a zeroed memslot, after a KVM_MR_FLAGS_ONLY update the arch flags are cleared, potentially causing guest memory to be mapped to wrong host pages. The fix carries arch flags over from the old memslot for KVM_MR_FLAGS_ONLY.

In the Linux kernel, pch_msi_set_irq() in KVM for LoongArch passes e->msi.data directly to eiointc_set_irq() as the IRQ number without checking it against EIOINTC_IRQS. The MSI data comes from userspace (KVM_SET_GSI_ROUTING or KVM_SIGNAL_MSI), and a value >= 256 causes out-of-bounds reads and writes, allowing kernel memory corruption. The fix rejects MSI data outside the EIOINTC IRQ space.

In the Linux kernel for LoongArch, the BPF subsystem had a bug in jump offset calculation for tail calls. The old macro-based method could lead to incorrect branch offsets and soft lockups under extra JIT passes. The fix calculates the offset directly on the absolute target and adds a guard for null image.

In the Linux kernel for LoongArch, the BPF subsystem had a stack layout issue with the arena register slot. When arena_vm_start is dynamically enabled, it shifts the relative offset of the tcc_ptr slot, potentially causing memory misalignment or corruption. The fix moves the arena register save/restore sequences below the tail call counter context slots and updates the epilogue.

In the Linux kernel for LoongArch, the acpi_package_ids[] array can overflow on virtual machines with many sockets. With a typical one-core-per-socket configuration, the number of sockets can reach 256, causing the array to overflow. The fix increases the array size to the maximum of MAX_PACKAGES and KVM_MAX_VCPUS.

In the Linux kernel on LoongArch, the rethook trampoline saved and restored the percpu base register ($r21) in its frame. If the task migrated to another CPU while the handler ran, the stale percpu base was restored, causing incorrect this_cpu_*() accesses and corruption of scheduler and timer state.

In the Linux kernel for LoongArch, there is a vulnerability related to break 11 handling in the context of Kprobes. A user can issue the same break instruction, causing kprobe_singlestep_handler() to be called without an active probe, leading to preempt count underflow. This may result in incorrect socket attribution to the root cgroup, bypassing BPF policies.

A vulnerability in the Linux kernel's media: airspy driver was fixed, where the wrong function was used on device disconnect. airspy_disconnect() cleared the s->udev pointer while airspy_stop_streaming() still dereferenced it without checking, leading to a NULL dereference. video_unregister_device() was replaced with vb2_video_unregister_device() and moved before clearing s->udev.

A kernel memory leak (kmemleak) exists in the Linux media CEC subsystem. A previous change removed the implicit rc_free_device() call from rc_unregister_device() but left the adap->rc = NULL assignment, so rc_free_device() is never called on an allocated rc device. The issue is triggered e.g. on dw-hdmi unbind.

In the Linux kernel's CEC subsystem, there is an issue with delayed work during an interrupted transmit. If the wait for transmission is interrupted by a signal, cancel_delayed_work_sync() may run before the CEC kthread arms the work, leading to freeing data with pending work. The fix uses disable_delayed_work_sync() to cancel and disable the work, preventing re-arming.