CVE Vulnerability Catalog

In the Linux kernel, the media s2255 driver's s2255_probe() reads a 4-byte marker and version from the last 8 bytes of the firmware blob. If the firmware file is shorter than 8 bytes, fw_size - 8 underflows and the access reads out of bounds.

In the Linux kernel, the media saa7164 driver's saa7164_dev_setup() adds the device to the global saa7164_devlist before requesting the PCI BAR memory regions. When get_resources() fails, the device remains on the list while the probe error path frees it, leaving a dangling entry.

In the Linux kernel, the media tda18250 driver has a possible integer overflow when the variable exp equals zero. The shift operation 1 << (exp - 1) may then lead to undefined behavior.

In the Linux kernel, the VPE (Video Processing Engine) driver for TI platforms has a vulnerability due to missing synchronization between the FIFO overflow recovery worker and IRQ handling during stream teardown. This can lead to use-after-free of stream resources when an interrupt or worker runs after the stream is released.

In the Linux kernel, the media v4l2-async module incorrectly deletes an unlinked ASC entry on link creation error. Calling list_del() on an entry that was never inserted can dereference NULL instead of returning the original link creation error.

In the Linux kernel, the media v4l2-ctrls module lacks validation of HEVC EXT SPS RPS counts. Decoder drivers may index beyond dynamic arrays if SPS values exceed HEVC limits (64 short-term sets, 32 long-term references) or exceed the DPB maximum.

In the Linux kernel, the v4l2_fwnode_parse_link() function in the media v4l2-fwnode module leaks an fwnode reference. The remote endpoint reference acquired via fwnode_graph_get_remote_endpoint() is not released on the success path.

In the Linux kernel, the media video-i2c driver leaves a kthread error pointer in kthread_vid_cap on failure. This causes a subsequent start_streaming() call to return success without starting the thread, and stop_streaming() to call kthread_stop() on the error pointer, leading to a kernel crash.

In the Linux kernel, the media zoran driver double-frees a registered video_device. The zoran_exit_video_devices() function calls video_unregister_device() and then kfree() on the same object already freed by the zoran_vdev_release() callback.

In the Linux kernel, the media qcom iris driver uses disable_irq_nosync() during power-off, which does not wait for an in-flight threaded IRQ handler to complete. The handler may still run after the VPU is powered down and access hardware registers.

In the Linux kernel, the media chips-media wave5 driver's stop_streaming function may enter an infinite loop in some cases. A bounded poll of the queue status with a VPU_DEC_STOP_TIMEOUT limit was added.

In the Linux kernel, the media chips-media wave5 driver's device_run() defers job_finish() even when no DEC_PIC was queued, leaking the shared v4l2_m2m job slot. This stalls all decoder instances at EOS, e.g. in GStreamer.

In the Linux kernel, the media chips-media wave5 driver sets the EOS flag by communicating with firmware via send_firmware_command(), which accesses VPU registers. The STREAMOFF and V4L2_DEC_CMD_STOP paths can run while the device is runtime suspended, causing register accesses to powered-down hardware and an asynchronous SError that panics the kernel.

In the Linux kernel, the scsi qla2xxx driver's FRU/I2C bsg handlers use a 256-byte DMA buffer that is not zeroed and initialize only a few leading bytes. qla2x00_write_sfp() can override the transfer length with a user-supplied value (up to 255 bytes), causing reads of uninitialized heap memory and writes to device flash.

In the Linux kernel, the scsi qla2xxx driver's I2C bsg handlers use the i2c->length field (16-bit) without bounds checking, while the buffer is a fixed 64 bytes. This can lead to stack and heap overflows and memory leaks when the length exceeds the buffer size.

In the Linux kernel, the scsi qla2xxx driver's qla_chk_edif_rx_sa_delete_pending() function dereferences a NULL pointer when the SCSI command has already been returned or aborted. This can lead to a kernel crash in interrupt context.

In the Linux kernel, the scsi qla2xxx driver's qla28xx_validate_flash_image() function returns QLA_SUCCESS unconditionally, causing the FC BSG transport to not complete the job on error. This leads to block layer resource leaks and the request dangling until timeout.

In the Linux kernel, the scsi qla2xxx driver's qla24xx_report_id_acquisition() function has a use-after-free because the virtual port is used after dropping the vport_slock without taking a reference. Concurrent qla24xx_deallocate_vp_id() can free the port, leading to memory corruption.

In the Linux kernel, the scsi qla2xxx driver's qla_nvme_fcp_abort() and qla_nvme_ls_abort() functions call INIT_WORK() before schedule_work(), which on repeated aborts of the same command can corrupt the workqueue list and lead to crashes or a looping worker.

In the Linux kernel, the scsi qla2xxx driver's qla2x00_do_dport_diagnostics() function allocates the response buffer without zeroing and copies the full structure size back to user space, exposing uninitialized fields and leaking kernel heap contents.