CVE Vulnerability Catalog

In the Linux kernel DRM/GUD subsystem, TV mode names read from the USB device are not guaranteed to be NUL-terminated. strlen() can read past the allocated buffer, leading to an out-of-bounds read.

In the Linux kernel DRM subsystem, a memory leak of drm_crtc_commit was found when PAGE_FLIP_EVENT is used. The issue occurs when the event is allocated in prepare_signaling() and set to NULL in complete_signaling(), preventing the object from being freed.

A flaw in the Linux kernel's drm/ttm subsystem occurs when ttm_pool_restore_and_alloc() successfully completes the restore process via ttm_pool_restore_commit(), but fails to drop tt->restore afterward. As a result, subsequent backup/restore flows incorrectly perceive the restore as complete while shmem handles remain installed in tt->pages, leading to a stack trace and potential memory corruption.

In the Linux kernel DRM/AMDGPU subsystem, an out-of-bounds access to the adev->isolation[] array was found for rings not assigned to a partition. The index AMDGPU_XCP_NO_PARTITION (value ~0) causes access beyond the array, triggering UBSAN warnings.

In the Linux kernel DRM/AMDGPU subsystem, KIQ ring fences are not force-completed during reset. After a MODE1 reset, the first KIQ submission may poll forever on a value that is never written back, causing a hang.

In the Linux kernel DRM/AMDGPU subsystem, MES ring fences are not force-completed during reset. After a reset, the first MES submission may poll forever, causing resume failure and system hang.

In the Linux kernel DRM/AMDKFD subsystem, a TLB flush is missing after MES queue eviction/suspension, potentially leading to a race condition and page faults during SVM memory migration.

In the Linux kernel, the drm/amdkfd driver had an error-path bug in svm_migrate_copy_to_ram. When page migration from device to system RAM fails, the driver used a DMA address instead of the page physical address (pfn) to release and unlock allocated system pages, which is incorrect with IOMMU enabled. The fix releases pages based on struct page* and performs dma_unmap on the corresponding system RAM pages.

A NULL pointer dereference vulnerability exists in the Linux kernel's drm/amdkfd driver within the pqm_debugfs_mqds function. Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue causes dereference of an uninitialized mqd_mgr pointer, because the loop calling mqd_mgr->debugfs_show_mqd() is placed outside the if (pqn->q) block. This leads to a kernel crash (oops) and denial of service.

In the Linux kernel, the drm/amdkfd driver had a bug when the migration VM range is a hole on the CPU side (MIGRATE_PFN_MIGRATE set, MIGRATE_PFN_VALID unset). The driver still allocated device pages, and an uninitialized variable r could trigger out_free_vram_pages to drop all just-set-up VRAM. The fix initializes r and only calls the final svm_migrate_copy_memory_gart if j > 0.

In the Linux kernel, the drm/amdkfd driver lacked a NULL guard for restore_mqd during CRIU queue restore. A user with CAP_CHECKPOINT_RESTORE could trigger a kernel NULL pointer dereference and panic by issuing KFD_IOC_CRIU_OP_RESTORE with a crafted queue restore object. The fix adds a NULL guard and returns -EOPNOTSUPP if the callback is not implemented.

In the Linux kernel, the drm/sysfb (ofdrm) driver had an integer overflow in the framebuffer size calculation fb_size = linebytes * height. With large values (e.g., 46341 * 46341), the int * int multiplication causes undefined behavior. The fix uses check_mul_overflow() to detect and prevent the overflow.

A bug was fixed in the Linux kernel's drm/pagemap module in the drm_pagemap_migrate_populate_ram_pfn() function. Higher-order folio allocations lacked the __GFP_NOWARN flag and a fallback path, and in the free_pages error path the folio order was computed after put_page() had already dropped the reference, leading to a use-after-free. The source page array construction was also corrected to ensure full copying after demotion to order-0 folios.

In the Linux kernel, the drm/nouveau/dmem driver had a mismatched DMA unmap size for large folios. Device-private THP migration maps buffers with page_size() and records that length, but two teardown sites passed a literal PAGE_SIZE to dma_unmap_page(), leaking part of the IOMMU/IOVA mapping for order > 0 folios. The fix uses the saved size.

In the Linux kernel, the drm/nouveau driver's nouveau_channel_del() tore down the fence context before unsubscribing the channel-kill event. A narrow window allowed nouveau_fence_context_kill() to run on an already freed fence context, causing a use-after-free. The fix unsubscribes before tearing down dependent structures.

In the Linux kernel, the drm/nouveau/uvmm driver had a NULL dereference when unwinding an OP_MAP_SPARSE op. If a later op in the same job fails, the reverse unwind loop calls drm_gpuva_ops_free() on op->ops, which remains NULL for a successfully processed sparse map, causing an oops. The fix adds an IS_ERR_OR_NULL() guard.

In the Linux kernel, the drm/nouveau/uvmm driver had a premature region free on failed OP_UNMAP_SPARSE. Two failure paths left op->reg set, causing cleanup to remove and put a region the job never created, leading to a use-after-free. The fix clears op->reg on both failure paths.

In the Linux kernel, the drm/nouveau/uvmm driver fails to clear the dirty flag when unwinding an OP_UNMAP_SPARSE operation. If a later op in the job fails, the region remains in the tree with dirty set and its completion is never signalled. Subsequent binds over that range then fail permanently with -ENOENT, -EINVAL, or an unkillable wait_for_completion() in bind_validate_region().

In the Linux kernel, the bpf_get_stackid function requires disabled preemption for the get_perf_callchain call and while accessing its returned trace entries buffer. The bpf_get_stackid_pe function already executes with preemption disabled. Failure to disable preemption in bpf_get_stackid may lead to data consistency issues.

In the Linux kernel, rpcrdma_rn_register() inserts @rn into rd_xa via xa_alloc() before storing the caller's callback in rn->rn_done. A device removal racing a fresh registration can observe @rn with rn_done still NULL and call through a NULL function pointer. The fix stores rn->rn_done before xa_alloc() and clears it on allocation failure.