CVE Vulnerability Catalog

In the Linux kernel, fwnode_for_each_child_node() can enter an infinite loop when iterating over children of a fwnode that has a secondary fwnode with more than one child. This causes the same nodes to be returned repeatedly instead of terminating the iteration.

In the Linux kernel, nsm_sendrecv_msg_locked() stores the length reported by the NSM device without bounding it to the response buffer size. A malicious or buggy device can report an oversized length, leading to an out-of-bounds read and disclosure of adjacent kernel heap memory.

In the Linux kernel, dma_req_free() in RapidIO mport_cdev drops the mapping reference via kref_put() and then dereferences req->map again to unlock the mutex. If kref_put() drops the last reference, the object is freed and a use-after-free occurs.

In the Linux kernel, a previous error-handling fix in __video_register_device() was reverted because it caused a double-free. The V4L2 API requires calling video_device_release() after a failed registration, but put_device() already freed the structure.

In the Linux kernel, the serial: imx driver publishes its port in imx_uart_ports[] before uart_add_one_port(), and the entry is not cleared on add failure or after removal. This leaves a dangling pointer through which a sibling probe can register the shared console.

A use-after-free vulnerability exists in the Linux kernel USB dwc3 gadget driver. The dwc3_gadget_free_endpoints function frees the dep structure while a queued nostream_work delayed work may still be pending or running and accessing the freed memory. The issue is fixed by canceling the delayed work before freeing the memory.

In the Linux kernel's USB gadget at91_udc driver, in polled-VBUS mode, the timer and associated work item were not stopped before the udc structure was freed. This led to a use-after-free during normal driver unbind or probe failure.

In the Linux kernel, tbt_altmode_remove() drops the plug and cable references without draining tbt->work. The work function dereferences those references and can requeue itself, and VDM callbacks can queue the same work item.

In the Linux kernel, the USB gadget u_audio driver has a use-after-free in g_audio_cleanup(). snd_card_free_when_closed() returns asynchronously while the snd_uac_chip structure is freed immediately, leaving ALSA control handles (kctls) open in userspace. Accessing these handles dereferences freed memory.

In the Linux kernel, the USB gadget midi2 driver's f_midi2_alloc_inst() creates default configfs groups, but configfs_remove_default_groups() is never called during function teardown or EP cleanup. This leaks f_midi2_ep_opts and f_midi2_block_opts structures.

In the Linux kernel, the USB gadget uvc driver's uvcg_video_init() logs an error using the video->uvc pointer when kthread_run_worker() fails, but this pointer is not yet assigned. This triggers a null pointer dereference.

In the Linux kernel, the USB gadget uvc driver's uvc_function_bind() and uvc_function_unbind() leave dangling pointers uvc->control_req and uvc->control_buf after freeing. This leads to use-after-free.

In the Linux kernel, ffs_ep0_read() in the USB gadget FunctionFS interface could deadlock. The function slept while holding ffs->mutex, so when the gadget was torn down via configfs (e.g., echo "" > UDC) while a userspace daemon looped on read(), a permanent deadlock occurred. The fix drops the mutex before sleeping and uses wait_event_interruptible_exclusive().

In the Linux kernel, cxl_rch_get_aer_info() reads AER registers beyond the mapped block because sizeof(struct aer_capability_regs) exceeds the physical AER capability size. The over-read can also cause a second out-of-bounds in pcie_print_tlp_log().

In the Linux kernel, the altera-cvp FPGA driver's altera_cvp_send_block() dereferences a u32 pointer even when only 1-3 bytes remain in the buffer. This can cause an out-of-bounds read if the buffer ends at a page or scatterlist boundary.

In the Linux kernel, the HID sensor-hub driver's sensor_hub_get_feature() clamps the return value but the copy loop still copies field->report_size / 8 bytes per value. A malicious HID descriptor can cause an out-of-bounds write when an IIO caller supplies a small buffer.

In the Linux kernel, the i3c renesas driver's function computing the newly discovered devices bitmask does not account for an empty bus. When the bus is empty, the data length field contains the maximum number of devices (8), leading to an out-of-bounds access.

In the Linux kernel, KVM arm64 GICv2's vgic_v2_deactivate() passes the INTID written by the guest to GICV_DIR directly to vgic_get_vcpu_irq() and treats a failed lookup as impossible with WARN_ON_ONCE(). A guest can trigger this at will, causing a host panic with panic_on_warn.

In the Linux kernel, ucs2_strnlen() in lib/ucs2_string.c checks the current character before checking whether the caller-provided maximum length has been reached. If the input is not NUL-terminated within that bound, the loop can read one ucs2_char_t past the limit, causing an off-by-one out-of-bounds read.

In the Linux kernel, the media: cec: stm32 driver's stm32_rx_done() appends each received CEC byte to rx_msg.msg[] using rx_msg.len as the write index without checking it against the buffer size. The rx_msg.msg[] buffer is a fixed CEC_MAX_MSG_SIZE (16) byte array, and the number of bytes before RXEND is controlled by the remote CEC device, allowing an out-of-bounds write.