CVE Vulnerability Catalog

In the Linux kernel, the platform/x86/amd/pmc driver's amd_pmc_probe() registered the LPS0 s2idle handler and created the debugfs directory before calling amd_stb_s2d_init(). When the latter failed, the error path did not unregister the handler or remove the debugfs directory, leading to list corruption and a kernel BUG on module reload.

In the Linux kernel, the platform/x86 hp-bioscfg driver's sk_store() and kek_store() stripped a trailing newline before allocating the key buffer, but passed the original count instead of length to hp_wmi_perform_query(). This caused a one-byte read past the allocated buffer.

In the Linux kernel, the platform/x86 hp-bioscfg driver's validate_password_input() computed length = strlen(buf) and checked buf[length - 1] without first ensuring length is nonzero. Writing an empty string (a bare '\n') to current_password or new_password caused a read of buf[-1], one byte before the heap allocation.

In the Linux kernel, the platform/x86 hp-bioscfg driver's hp_get_string_from_buffer() clamped the converted string length against the destination buffer size using "size > dst_size". When the length equaled dst_size, the unconditional NUL terminator write landed one byte past the destination buffer.

In the Linux kernel's platform/x86 hp-bioscfg module, the per-type ACPI package parsers were handed the wrong element count — instead of the validated obj->package.count they derived it from the NAME field (an ACPI_TYPE_STRING), effectively reading string.length through the acpi_object union. This is safe today because hp_init_bios_package_attribute() rejects packages with fewer elements than the type requires, but an upcoming relaxation of that check would cause an out-of-bounds heap read. The fix forwards the validated obj->package.count to every parser.

This CVE record has been rejected or withdrawn by its CVE Numbering Authority. It does not contain a confirmed vulnerability or technical details.

This CVE record has been rejected or withdrawn by its CVE Numbering Authority. It does not contain a confirmed vulnerability or technical details.

A use-after-free vulnerability exists in the Linux kernel's icc_get() and of_icc_get_by_index() functions. When memory allocation for path->name fails, the error path calls kfree(path) without removing the path's requests from the req_list, leaving dangling pointers that can be dereferenced later. The fix replaces kfree(path) with icc_put(path) and ensures the icc_lock mutex is released before calling icc_put().

In the Linux kernel, ipmb_write() in the IPMI driver read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes, and a length smaller than the SMBus header underflows the block write length.

In the Linux kernel, ipmi_add_smi() creates the nr_users and nr_msgs files before trying to create the maintenance_mode file. If that last creation fails, the error path removes only nr_users before dropping the final reference to the interface, leaving the nr_msgs sysfs attribute registered in the freed interface.

A NULL pointer dereference vulnerability exists in the Linux kernel ipmi_si driver. When IPMI interface registration fails (e.g., BMC does not respond correctly to the Get Device ID command), shutdown_smi() frees si_sm and sets the pointer to NULL, but the in_shutdown flag is not set. The asynchronous redo_bmc_reg work item can then retry communication with the already-cleaned interface, causing start_kcs_transaction() to be called with a NULL pointer and resulting in a kernel crash.

In the Linux kernel, if an error occurs during startup of an IPMI interface, it may have scheduled work to run. The work needs to be canceled before the interface can be freed, which was missing in the ipmi:msghandler module.

In the Linux kernel, afiucv_hs_rcv() (net/iucv) selected an AF_IUCV socket based solely on four 8-byte name fields in the transport header, without checking the ingress net_device. This allowed a frame arriving on any netdev, including one in another network namespace, to be delivered to an AF_IUCV socket. The fix skips any socket whose hs_dev does not match the ingress device.

In the Linux kernel, xdp_convert_zc_to_xdp_frame() clones an XSK packet into an order-0 page and advertises PAGE_SIZE as its frame size, allowing the copied frame to occupy the page tail needed by skb_shared_info. This causes the skb to overlap skb_shared_info or be placed beyond the allocated page, resulting in a KASAN slab-out-of-bounds in skb_gro_receive.

A use-after-free vulnerability exists in the Linux kernel's SLIP driver within the sl_sync() function. The slip_devs[] array stores bare net_device pointers without taking references, and entries are freed outside rtnl_lock() protection, allowing access to freed memory during slip_open().

In the Linux kernel, tun_get_user() in the TUN/TAP driver uses tun->align both as skb headroom and to decide how much packet data to keep linear. When align exceeds the usable space in a one-page skb head, SKB_MAX_HEAD(align) underflows, the result becomes negative, and after assignment to a size_t it causes skb->data to be placed outside the allocated head. OVS can propagate an oversized headroom request from another port to TUN or TAP.

In the Linux kernel, the DSA driver for Realtek switches used gpiod_set_value() instead of gpiod_set_value_cansleep() in rtl83xx_reset_assert() and rtl83xx_reset_deassert() to control the reset GPIO. When the reset GPIO is provided by a sleeping controller such as an I2C I/O expander, gpiod_set_value() triggers a kernel warning. The issue affects kernels v6.9+ that contain these helper functions.

In the Linux kernel, the bnxt driver's SW USO path can return early with NETDEV_TX_BUSY even though txr->kick_pending was previously set to 1. In that case the driver writes some BDs but never writes the doorbell, causing the TX queue to stall because the device does not know it should perform the TX and generate the completion that would wake the queue.

A bug in the Linux kernel's IPA driver (net: ipa) caused the modem TX queue to stall permanently after runtime resume. ipa_start_xmit() unconditionally stopped the TX queue before calling pm_runtime_get(), relying on a wake scheduled by runtime resume to restart it. However, that wake work ran too early — before the device power state reached RPM_ACTIVE — so the queue was never restarted and transmit stalled permanently.

In the Linux kernel, the L2TP netlink handlers for tunnel create/modify and session create/modify send multicast notifications after the live operation has completed. A failure to allocate, encode, or multicast the notification is returned as the command result even though the operation already committed, which can cause callers to retry and accumulate live objects.