CVE Vulnerability Catalog

In the Linux kernel's CEC subsystem for the Extron DA HD 4K Plus device, there is a lack of input validation that could lead to overflowing the msg.msg[] buffer when malformed data is received. The fix adds a sanity check.

In the Linux kernel's CEC subsystem, there is a serialization issue with delivering messages to the exclusive follower. cec_receive_notify() reads the follower pointer without the adapter lock, which can lead to a race with mode changes or release. The fix serializes the no-follower check and message delivery.

In the cedrus_init_ctrls() function of the Linux kernel media cedrus driver, the V4L2 control handler is initialized before allocating memory for ctx->ctrls. If this allocation fails, the function returns -ENOMEM without freeing the previously allocated handler resources, leading to a memory leak.

In the Linux kernel media cobalt driver, snd_cobalt_card_create() stores cobsc in sc->private_data and installs snd_cobalt_card_private_free() as sc->private_free. If cobalt_alsa_init() fails, the err_exit_free path calls snd_card_free(sc) and then kfree(cobsc), causing a double free of the same object.

A vulnerability was found in the Linux kernel cx231xx media driver where format or standard changes (vidioc_s_fmt_vid_cap, vidioc_s_std) were rejected only when the video queue was busy, not the VBI queue. Since the VBI queue shares the same geometry (dev->width, dev->norm), an application could enlarge the width or switch to PAL while the VBI stream was running, causing a heap out-of-bounds write in cx231xx_do_vbi_copy().

In the Linux kernel media cx23885 driver, netup_ci_exit() frees a netup_ci_state while its work item netup_read_ci_status() may still be pending or running on the system workqueue. The worker obtains the state via container_of() and dereferences it, so it must not outlive the state.

In the Linux kernel media em28xx driver, the audio-only path registers extensions while probing the primary device, which for a dual-TS board happens before dev_next is created. The duplicate device inherits is_audio_only and is independently inserted into em28xx_devlist, potentially leading to a use-after-free during disconnect.

In the Linux kernel media em28xx driver, when a device with has_dual_ts=1 takes the is_audio_only path, both dev and dev->dev_next are added to the global em28xx_devlist. During disconnect, em28xx_close_extension(dev) only removes dev->devlist, leaving dev->dev_next->devlist linked in the global list, which after dev_next is freed leads to a dangling pointer and list corruption.

In the Linux kernel media go7007 driver, go7007_snd_init() takes a v4l2_device reference for the ALSA side, but go7007_snd_remove() drops it immediately after calling snd_card_free_when_closed(). This is too early when a userspace process still has the capture PCM open, potentially leading to a use-after-free.

In the Linux kernel media i2c imx415 driver, the VBLANK path returned immediately when programming VMAX failed after pm_runtime_get_if_in_use() had taken a runtime PM reference. This leads to a runtime PM reference leak.

In the Linux kernel media i2c ov02a10 driver, ov02a10_check_hwcfg() calls fwnode_handle_put(ep) immediately after allocating and parsing the endpoint, but subsequently uses the same 'ep' handle in fwnode_property_read_u32(), leading to a use-after-free. Additionally, reading the optional 'ovti,mipi-clock-voltage' property overwrote the 'ret' variable, causing probe to fail entirely.

In the Linux kernel media i2c ov7740 driver, ov7740_remove() had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler that relies on that mutex, leading to a use-after-destroy kernel panic. Additionally, the driver called v4l2_ctrl_handler_free() and mutex_destroy() sequentially, then called ov7740_free_controls() which invokes both again, resulting in a double-free.

In the Linux kernel, isys_notifier_init() in the media intel/ipu6 driver leaks resources. When endpoint parsing or adding fails partway through the loop, the function returns without calling v4l2_async_nf_cleanup(), leaving previously added v4l2_async_connection entries on the notifier's waiting list.

In the Linux kernel, the media platform mtk-mdp3 driver's mdp_probe() mishandles SCP device reference counting. The fallback path drops the reference obtained via __get_pdev_by_id() too early, and scp_put() later drops it again, resulting in a double reference release.

In the Linux kernel, the media platform mtk-mdp3 driver lacks a sanity check after looking up the SCP device. If the SCP driver has not yet been bound, a NULL-pointer dereference can occur.

In the Linux kernel, the media rc sunxi-cir driver does not unregister the rc device on probe failures after rc_register_device() succeeds. Only rc_free_device() is called, leaving the registered rc device and its resources behind.

In the Linux kernel, the media rkvdec HEVC decoder's st_ref_pic_set_prediction() computes the reference RPS index as st_rps_idx - (delta_idx_minus1 + 1) using u8 operands. When delta_idx_minus1 + 1 exceeds the current index, the subtraction wraps and the array access at calculated_rps_st_sets[ref_rps_idx] reads far out of bounds.

In the Linux kernel, the rtl2832_sdr media driver has a DMA memory leak. On USB disconnect, rtl2832_sdr_remove() sets dev->udev to NULL before streaming teardown completes, so usb_free_coherent() fails to release DMA buffers and allocated URBs outlive the device. The fix replaces video_unregister_device() with vb2_video_unregister_device() called before clearing dev->udev.

In the Linux kernel, the rtl2832_sdr driver's rtl2832_sdr_start_streaming() function failed to release previously allocated DMA buffers and URB structures when allocation or submission of URBs failed. This led to a DMA memory leak and an out-of-bounds read of urb_list[] on the next streaming attempt, potentially passing garbage pointers to usb_free_urb().

In the Linux kernel, the media s2255 driver's s2255_fillbuff() memcpy()s vc->jpg_size bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc->jpg_size is taken verbatim from the S2255_MARKER_FRAME header sent by the device and is never bounded, allowing an out-of-bounds write.