CVE Vulnerability Catalog

In the Linux kernel, the dm-pcache module in cache_replay(), the writeback worker, and the GC worker bounds the tail-kset read length by PCACHE_SEG_SIZE - seg_off, the raw segment size rather than the data region. A tail near the segment end reads past the segment data into the following control area. The fix clamps the read to cache_seg_remain(), the data region.

In the Linux kernel, the dm-pcache module in cache_replay() follows the on-media last-kset chain via next_cache_seg_id without cond_resched(). A forged chain pointing back to an already visited segment causes the replay loop to run forever. The fix caps the last-kset hops at cache->n_segs, since a valid chain visits each segment at most once.

In the Linux kernel, the dm-pcache module's get_cache_segment() scans the segment map up to cache->n_segs (physical device segment count), but cache_segs_init() only initializes the first cache_info->n_segs segments. A crafted image with a smaller cache_info->n_segs leaves the remaining pcache_cache_segment structs zeroed (segment.data == NULL), and the allocator can hand one to cache_kset_close(), which writes through the data pointer without a NULL check. The fix bounds the allocator's search to cache_info->n_segs.

In the Linux kernel, kset_replay() in dm-pcache has a use-after-free and invalid segment operations. When a key's seg_gen is stale, cache_key_put(key) frees the key memory but key->cache_pos.cache_seg is then accessed as an argument to cache_seg_get(). Additionally, for expired invalid keys, setting the cache->seg_map bit and calling cache_seg_get() is unreasonable.

In the Linux kernel, i3c_device_get_supported_xfer_mode() dereferences dev->desc without holding bus->lock, which is not allowed. The function only needs the master controller associated with the device's bus, so it should use dev->bus, which is always valid for the device's lifetime.

In the Linux kernel, adi_i3c_master_probe() requests the IRQ and unmasks REG_IRQ_PENDING_CMDR before initializing the IBI state, transfer queue list, and transfer queue lock. A pending CMDR interrupt can run adi_i3c_master_irq() and take an uninitialized lock, as reported by Lockdep.

In the Linux kernel, i3c_master_unregister_i3c_devs() clears i3cdev->dev->desc before calling device_unregister(). During unregister, i3c_device_uevent() and a racing modalias_show() can observe a NULL desc and fall back to an uninitialized stack struct, leaking kernel stack contents. A use-after-free may also occur from writing desc after the device is released.

In the Linux kernel, svc_i3c_master_handle_ibi() reads the IBI payload from the RX FIFO into the slot, bounding the loop by the hardware FIFO size (SVC_I3C_FIFO_SIZE) rather than the slot size. A driver can request a smaller max_payload_len (e.g., mctp-i3c requests 1), so a device sending more bytes writes past slot->data, an out-of-bounds write into the IBI pool.

In the Linux kernel, the Renesas I3C driver uses an asynchronous model: it prepares a struct renesas_i3c_xfer, enqueues it, and waits for completion. If completion times out, the waiting thread dequeues and frees the transfer; a later interrupt may access freed memory, causing crashes.

In the Linux kernel, brcmf_sdio_read_control() does not free the memory allocated for buf in some error paths. The fix adds vfree() calls in those paths.

In the Linux kernel, iwl_op_mode_dvm_start() in the iwlwifi dvm driver: jumping to out_free_eeprom bypasses the out_free_eeprom_blob label. Consequently, error paths after successfully parsing the EEPROM free priv->nvm_data but leak priv->eeprom_blob. The fix reorders the error handling labels.

In the Linux kernel, the rtl8xxxu wifi driver has a use-after-free bug involving the rx_urb_wq workqueue. rtl8xxxu_stop() does not cancel rx_urb_wq, so a worker can run after rtl8xxxu_disconnect() frees the priv structure, causing a use-after-free. The issue occurs under active RX traffic followed by a disconnect.

In the Linux kernel, the fuse-io-uring transport copies req->in.h and req->out.h directly to/from userspace in fuse_uring_copy_to_ring() and fuse_uring_commit(). The headers live in the fuse_request slab object, whose cache lacks a usercopy whitelist, tripping CONFIG_HARDENED_USERCOPY and causing a kernel panic.

In the Linux kernel, the iaa crypto driver has a bug during hardware decompression. On a hardware analytics error, the decompress path retries through the software fallback, which writes req->dst while it is still mapped as DMA_FROM_DEVICE. With SWIOTLB active, the later dma_unmap_sg() copies the stale bounce buffer over req->dst, corrupting the result.

In the Linux kernel, the mwifiex Wi-Fi driver fails to detach the caller-provided data buffer from a still-current synchronous command when the wait is interrupted. A late firmware response can then write through a stale stack pointer, causing kernel stack corruption and a panic.

In the Linux kernel, the rtlwifi driver (rtl8192du) uses the QoS TID from the 802.11 header as an index into sta_entry->tids[] in rtl92du_tx_fill_desc(). Since ieee80211_get_tid() returns a value in the range 0..15 while the array only has MAX_TID_COUNT (9) entries, a TID greater than 8 indexes past the aggregation state array.

In the Linux kernel, the rtlwifi driver (rtl8192du) does not free memory allocated inside rtl92du_init_shared_data() in any of the subsequent error paths in rtl92du_init_sw_vars(). This leads to a memory leak.

In the Linux kernel, the rtw88 wifi driver's rtw_txq_push_skb() does not free the skb before returning on the error path, even though rtw_hci_tx_write() expects the skb to be freed on failure. This leads to a memory leak in rtw_txq_push().

In the Linux kernel, the rtw88 wifi driver (PCI) allocates PCI resources via rtw_pci_setup_resource() before setting up NAPI in rtw_pci_probe(). If rtw_pci_napi_init() fails, the error path skips rtw_pci_destroy(), leaving the allocated PCI resources behind.

In the Linux kernel, the rtw89 WiFi PCI driver lacked a .shutdown callback to stop rfkill polling during reboot. As a result, arm64 platforms could panic with an asynchronous SError when the driver performed an MMIO read after the PCIe link was torn down. A new rtw89_pci_shutdown() function sets the RTW89_FLAG_SHUTDOWN flag, causing rtw89_ops_rfkill_poll() to return early.