CVE Vulnerability Catalog

In the Linux kernel, ext2_setsize() and ext2_xattr_set2() contained a construct that for IS_SYNC inodes called sync_inode_metadata() instead of marking the inode dirty. Since sync_inode_metadata() only acts if the inode is already dirty, inode updates could be lost.

A use-after-free vulnerability exists in the Linux kernel's fanotify subsystem regarding file range information. A pointer to the range position stored on the triggering task's stack is saved in a heap-allocated permission event, and when a signal interrupts the triggering task, the stack frame is unwound while the event reader still dereferences that pointer. This causes a stale stack value to be copied to userspace.

In the Linux kernel's fbdev omapfb panel-dsi-cm driver, the ddata->lock mutex is initialized after the display is registered. Once omapdss_register_display() publishes the display, another consumer can invoke a dsicm callback that takes this uninitialized mutex. This can lead to improper operation or a crash.

In the Linux kernel, the fbdev ssd1307fb driver performed synchronous I2C transfers from damage callbacks, which may run from fbcon while printk has disabled preemption. This caused a "scheduling while atomic" bug and kernel warnings on systems such as RK3566. The issue was resolved by deferring I2C transfers from the damage callbacks.

In the Linux kernel's fbdev uvesafb driver, uvesafb_init() registers the v86d connector callback before registering the platform driver. If platform_driver_register() fails, the function returns the error without unregistering the connector callback, leaving it registered. The later platform-device failure path already performs this unregistration.

In the Linux kernel forcedeth driver, the loops in nv_suspend() and nv_resume() use 'i <= register_size/sizeof(u32)', causing one extra iteration and an out-of-bounds access to the saved_config_space array. On VER3 devices the last iteration reads past the array and, on resume, performs an MMIO write one dword past the mapped register window. The bug is reported by UBSAN and, with CONFIG_UBSAN_TRAP=y, traps and aborts the running kernel code.

A race condition in the Linux kernel fsnotify subsystem was fixed, affecting event mask updates for marks. Concurrent updates to different marks on the same object could leave the object mask stale, causing events such as FAN_MODIFY or IN_MODIFY to be missed despite correct configuration. The issue affected fanotify and inotify.

In the Linux kernel's hsi omap_ssi_core driver, the OMAP SSI driver uses a synthetic HSI controller device allocated via hsi_alloc_controller(), which does not go through the normal OF/platform device initialization path. As a result, the embedded struct device does not have a DMA mask initialized by default. After recent DMA API hardening changes, dma_map_sg() and related helpers require a valid dma_mask, otherwise the driver may crash or trigger warnings.

In the Linux kernel's hugetlb subsystem, __unmap_hugepage_range can adjust reservations since commit df7a6d1f6405. When a folio is mapped in both a parent and a child, and the parent unmaps the range first, the reservation adjustment causes an underflow of the reserved count. Once the child unmaps the range, the count is restored. The fix checks the mapcount before adjusting the reservation.

In the Linux kernel's accel/rocket driver, rocket_job_push() allocates a temporary array to hold input and output GEM object pointers. Two bugs exist: a missing NULL check after a failed kvmalloc_array() causing a NULL pointer dereference, and an integer overflow when summing in_bo_count and out_bo_count (both u32) that can wrap to a smaller value, leading to an undersized allocation and subsequent out-of-bounds accesses on the temporary array.

In the Linux kernel's accel/rocket driver, rocket_ioctl_submit_job() releases rjob via rocket_job_put() on allocation error paths. rocket_job_cleanup() unconditionally calls rocket_iommu_domain_put(job->domain), but job->domain is assigned only after task copying and BO lookups. A failure before that assignment can clean up a job with a NULL domain pointer. Additionally, rjob->tasks is not cleared after freeing in rocket_copy_tasks(), potentially leading to a double free.

In the Linux kernel, the rocket_job_run() function in the accel/rocket driver has error path bugs. The fence reference held by job->done_fence is never released, and pm_runtime_get_sync() increments the usage counter even on failure, preventing the NPU from suspending. Additionally, an unsignaled fence is returned to the DRM scheduler, triggering a WARN.

A deadlock exists in the Linux kernel's CXL CPER error handling within acpi/apei/ghes. The cxl_cper_work_lock and cxl_cper_prot_err_work_lock were used as plain spinlocks, which could deadlock when a GHES interrupt arrived on the same CPU. The fix converts them to raw_spinlock_t, adds WARN_ONCE checks, and restructures the unregister functions.

In the Linux kernel, the ghes_handle_arm_hw_error() function (ACPI APEI GHES) reduces the remaining length by sizeof(err) (pointer size) instead of sizeof(*err) (structure size) after skipping the cper_sec_proc_arm header. This overestimates the bytes left for cper_arm_err_info records and can cause the parser to read past the CPER section when err_info_num is large enough.

In the Linux kernel, the query_capability() function (ACPI pfr_update) copies four ACPI buffer objects returned by firmware _DSM into fixed-size u8[16] fields in struct pfru_update_cap_info using memcpy with the firmware-supplied length. If the firmware returns buffer.length > 16, memcpy writes past the destination array, causing a stack buffer overflow.

The Linux kernel has a bug in ata_format_dsm_trim_descr(), which builds the ATA TRIM descriptor in a 2048-byte buffer. On devices with a logical sector size larger than 2048 bytes (e.g. 4Kn with 4096-byte sectors), the function can never return the expected sector size, so every TRIM is rejected with a parameter list length error and triggers WARN_ON() splats.

In the Linux kernel, in the auxdisplay charlcd driver, with CONFIG_CHARLCD_BL_FLASH enabled, charlcd_init() schedules bl_work before charlcd_register() calls misc_register(). If registration fails, the caller frees the charlcd object while delayed work still contains its address, leading to a use-after-free.

The Linux kernel did not validate user space vector alignment when building a bio from iov_iter. Bio-based block drivers did not necessarily check the alignment split, potentially causing incorrect behavior. The fix validates vectors against the device's dma_alignment and rejects misaligned ones with -EINVAL.

The Linux kernel's eir_get_service_data() function in the Bluetooth EIR module contains an out-of-bounds read. Incorrect recalculation of eir_len when skipping fields causes the pointer to walk past the le_per_adv_data[] buffer into the rest of struct hci_conn. The fix recomputes eir_len from the end of the buffer each iteration.

The Linux kernel's bnx2x driver contains a double free in the error path of bnx2x_init_firmware(). The pointers init_ops, init_data, and init_ops_offsets are not set to NULL after being freed, so a later call to bnx2x_release_firmware() frees them again. The fix sets each pointer to NULL after kfree().