CVE Vulnerability Catalog

The ALSA aloop driver in the Linux kernel blindly trusts the devptr->id value at probe, assuming it is within the proper card index range. When a device is bound manually via sysfs, this value can be -1 ("none"), leading to out-of-bounds access to index[] and other parameters.

In the Linux kernel ALSA bcd2000 driver, the USB resource cleanup function freed URB structures without clearing the pointers. An open rawmidi substream could access freed memory (use-after-free) after device disconnect, leading to kernel memory corruption.

In the Linux kernel, the ALSA FCP driver's fcp_ioctl_init() allocated its response buffer with kmalloc() without zeroing it and copied the entire buffer back to userspace. A short or zero-length USB step-0 transfer was accepted as success, causing uninitialised kernel memory bytes to be disclosed to userspace. The fix zeroes the buffer and requires the step-0 transfer to deliver the full step0_resp_size bytes.

The ALSA mpu401 driver in the Linux kernel blindly trusts the devptr->id value at probe, assuming it is within the proper card index range. When a device is bound manually via sysfs, this value can be -1 ("none"), leading to out-of-bounds access to index[] and other parameters.

The ALSA mts64 driver in the Linux kernel checks the devptr->id value but does not validate negative values, which are often passed as "none" when a device is bound via sysfs. This may lead to out-of-bounds access to index[] and other parameters.

The pcxhr_probe() function in the Linux kernel requests pcxhr_threaded_irq() before initializing mgr->lock, even though the threaded handler takes that mutex. An early interrupt can therefore run against uninitialized mutex state during probe.

The ALSA portman2x4 driver in the Linux kernel checks the devptr->id value but does not validate negative values, which are often passed as "none" when a device is bound via sysfs. This may lead to out-of-bounds access to index[] and other parameters.

In the Linux kernel, the ALSA serial-u16550 driver blindly trusts that devptr->id is within the valid card index range at probe. When a device is bound manually via sysfs, this value can be -1 ("none"), leading to out-of-bounds access of index[] and other parameters. A sanity check was added to warn and correct out-of-range card index values.

In the Linux kernel, the ALSA virmidi driver blindly trusts that devptr->id is within the valid card index range at probe. When a device is bound manually via sysfs, this value can be -1 ("none"), leading to out-of-bounds access of index[] and other parameters. A sanity check was added to warn and correct out-of-range card index values.

In the Linux kernel, the dm-stats module has a bug where if per-CPU data allocation (dm_kvzalloc) fails, the code jumps to the "out" label and calls dm_stat_free, which dereferences s->stat_percpu[cpu] without a NULL check. This causes a NULL pointer dereference and kernel crash. The fix adds a NULL check before using the pointer.

In the Linux kernel, the dm-pcache module does not validate geometry fields (n_segs and segment id) from on-disk cache_info metadata. cache_segs_init() iterates n_segs times, indexing cache->segments[] sized to the device geometry. Since metadata is only CRC-protected with a public seed, whoever supplies the cache device (CAP_SYS_ADMIN) can provide an oversized n_segs or out-of-range id, causing out-of-bounds read and write. The fix rejects invalid values before use.

In the Linux kernel, the dm-pcache module does not bound the kset key_num field or intra-segment bounds. key_num drives cache_kset_crc() and the replay loop in cache_replay(), and since only magic and a fixed-seed CRC are checked, an invalid key_num can read past the PCACHE_KSET_KEYS_MAX buffer. Additionally, a key's offset and length in cache_key_decode() are taken verbatim, allowing reads past the segment and leaking data to user space. The fix adds validation of key_num and key bounds.

In the Linux kernel, the dm-pcache module does not validate the seg_num field from the crc32c-only superblock. seg_num sizes cache->segments[] and bounds all later segment ids, but is never checked against the device. Whoever supplies the cache device (CAP_SYS_ADMIN) can provide an oversized seg_num, causing an out-of-bounds write (12 KiB memset) into kernel memory at table load. The fix rejects seg_num that is zero, larger than the device can hold, or larger than PCACHE_CACHE_SEGS_MAX.

In the Linux kernel, the dm-pcache module does not bound the seg_off offset in cache_pos_decode(), which takes persisted key_tail and dirty_tail values from the cache device. A seg_off at or past the segment data_size, controllable by whoever supplies the device (CAP_SYS_ADMIN), reads past the segment data. The fix rejects a decoded seg_off that is not below the segment data_size.

In the Linux kernel, the dm-pcache module in cache_replay(), the writeback worker, and the GC worker bounds the tail-kset read length by PCACHE_SEG_SIZE - seg_off, the raw segment size rather than the data region. A tail near the segment end reads past the segment data into the following control area. The fix clamps the read to cache_seg_remain(), the data region.

In the Linux kernel, the dm-pcache module in cache_replay() follows the on-media last-kset chain via next_cache_seg_id without cond_resched(). A forged chain pointing back to an already visited segment causes the replay loop to run forever. The fix caps the last-kset hops at cache->n_segs, since a valid chain visits each segment at most once.

In the Linux kernel, the dm-pcache module's get_cache_segment() scans the segment map up to cache->n_segs (physical device segment count), but cache_segs_init() only initializes the first cache_info->n_segs segments. A crafted image with a smaller cache_info->n_segs leaves the remaining pcache_cache_segment structs zeroed (segment.data == NULL), and the allocator can hand one to cache_kset_close(), which writes through the data pointer without a NULL check. The fix bounds the allocator's search to cache_info->n_segs.

In the Linux kernel, kset_replay() in dm-pcache has a use-after-free and invalid segment operations. When a key's seg_gen is stale, cache_key_put(key) frees the key memory but key->cache_pos.cache_seg is then accessed as an argument to cache_seg_get(). Additionally, for expired invalid keys, setting the cache->seg_map bit and calling cache_seg_get() is unreasonable.

In the Linux kernel, i3c_device_get_supported_xfer_mode() dereferences dev->desc without holding bus->lock, which is not allowed. The function only needs the master controller associated with the device's bus, so it should use dev->bus, which is always valid for the device's lifetime.

In the Linux kernel, adi_i3c_master_probe() requests the IRQ and unmasks REG_IRQ_PENDING_CMDR before initializing the IBI state, transfer queue list, and transfer queue lock. A pending CMDR interrupt can run adi_i3c_master_irq() and take an uninitialized lock, as reported by Lockdep.