CVE Vulnerability Catalog

In the Linux kernel, f2fs find_in_level() gets a dentry folio with f2fs_find_data_folio() before calling find_in_block(). If find_in_block() returns an error, the function stores the error in res_folio and breaks out of the loop without dropping the dentry folio, leaking the folio reference.

In the Linux kernel, a race condition exists in the f2fs file system's f2fs_get_read_data_folio() function, which calls f2fs_folio_put() before folio_nr_pages() when invalidating a large folio from the page cache. This allows a concurrent truncate or folio split to shrink or free the folio before the invalidate range is computed, leading to stale xarray entries and bad page state.

In the Linux kernel, f2fs checkpoint_merge can be enabled even when no checkpoint merge thread is running, e.g. on a read-only mount. The ckpt_thread_ioprio sysfs store path calls set_task_ioprio() for the checkpoint thread, dereferencing a NULL task pointer when cprc->f2fs_issue_ckpt is NULL.

In the Linux kernel, f2fs free_segment_range() curseg evacuation loop only iterates up to NR_CURSEG_PERSIST_TYPE (0..5), missing non-persistent in-memory curseg types such as CURSEG_COLD_DATA_PINNED and CURSEG_ALL_DATA_ATGC. An active in-memory curseg within the truncated segment range will not be evacuated.

In the Linux kernel, f2fs has a potential deadloop in a race condition between f2fs_fsync_node_pages() and f2fs_setattr(). Thread A gets a folio via folio_get() while Thread B invalidates the folio mapping, causing is_node_folio to always return false and the retry loop to never terminate.

In the Linux kernel, f2fs when a node block is corrupted due to checksum mismatch or inconsistent footer info, the dirty flag of the node folio needs to be cleared in order to persist inconsistent node data to storage. This operation is missing in the error path.

In the Linux kernel, f2fs the sysfs store path for critical_task_priority updates checkpoint or GC kthread scheduling state but is not protected by s_umount, unlike other control entries. This can race with remount or teardown paths that are stopping those threads.

In the Linux kernel, __allocate_data_block() in the f2fs filesystem increments the valid block count via inc_valid_block_count() when allocating a new data block, but if the subsequent f2fs_allocate_data_block() fails, the function returns the error without rolling back that increment. This causes a permanent valid block count leak.

In the Linux kernel, f2fs_sanity_check_node_footer() is not passed the correct folio->index value, causing it to check the same nid incorrectly. This can lead to improper node consistency verification in the f2fs filesystem.

In the Linux kernel, amdgpu_vram_mgr_init() in the drm/amdgpu driver calls drmm_cgroup_register_region() before initializing lists and the buddy allocator. On failure, an early return bypasses those initializations, and the teardown path then dereferences NULL pointers, causing a kernel panic on the module load error path.

In the Linux kernel, uvd_v7_0_sw_init() does not initialize the UVD decode ring for an SR-IOV VF, yet amdgpu_uvd_resume() unconditionally force-completes that ring when restoring its fence sequence. This operates on an uninitialized ring.

In the Linux kernel, panthor_fw_read_build_info() in the drm/panthor driver validates the metadata range using 32-bit addition (hdr.meta_start + hdr.meta_size), which can wrap and let an out-of-bounds range pass. It also reads the "git_sha: " prefix without checking metadata length, and meta_size == 0 can underflow the NULL terminator index.

In the Linux kernel, panthor_init_cs_iface() and panthor_init_csg_iface() in the drm/panthor driver validate firmware control interface offsets using 32-bit arithmetic and the size of host wrapper structures, so the arithmetic can wrap before the bounds check and the checked size does not match the actual mapped firmware control interface.

In the Linux kernel, the drm/panel-edp driver fails to drop the i2c adapter reference on probe failure (e.g. probe deferral) and on driver unbind when a devicetree redundantly uses the 'ddc-i2c-bus' property pointing to the aux ddc bus.

In the Linux kernel, there is a race between a partial drm_dev_register() failure and an ioctl. If registration fails after a minor is registered, userspace may have entered a drm_dev_enter() critical section, and since the unplugged flag was never set, the ioctl proceeds while the error path tears down device resources.

In the Linux kernel, i915_pci_probe() unconditionally casts driver_data to struct intel_device_info * and dereferences intel_info->require_force_probe. When a device is force-bound via sysfs driver_override, pci_match_device() can return the dummy pci_device_id_any entry with unset (NULL) ->driver_data, causing a NULL pointer dereference.

In the Linux kernel, __is_lut_linear() in the drm/amd/display driver computes the expected value of each entry as i * MAX_DRM_LUT_VALUE / (size - 1). With a single-entry LUT, size - 1 is zero, causing a divide error (#DE) in the kernel.

In the Linux kernel DRM/AMD Display subsystem, a dc_lock leak was found on GPU reset error paths. dm_suspend() acquires the lock, but if helper operations fail, it returns without releasing it, causing deadlock on subsequent lock attempts.

In the Linux kernel DRM/AMD Display subsystem, the per-plane degamma LUT size is not validated, potentially leading to divide-by-zero or out-of-bounds read. The issue affects the AMD_PLANE_DEGAMMA_LUT property, only available when built with AMD_PRIVATE_COLOR.

In the Linux kernel DRM/AMDGPU VCN subsystem, an integer overflow was found in the buffer count check of the dec_msg message. A crafted value can bypass the bounds check and cause an out-of-bounds read.