CVE Vulnerability Catalog

In the Linux kernel lpass-wsa-macro codec driver, enum controls (such as 'EAR SPKR PA Gain' and 'WSA RX* Mux') are incorrectly handled; get/put callbacks access the value via integer field instead of enumerated, causing -EINVAL on every read on 64-bit kernels with CONFIG_SND_CTL_DEBUG enabled.

In the Linux kernel drm/amdgpu driver, there is a lack of validation for the number of H.265 references in UVD messages, which could lead to overflow when calculating the minimum DPB buffer size.

In the Linux kernel drm/amdgpu driver, there is a lack of validation for dimensions above 4096 in UVD messages, which could lead to overflow in DPB size calculations.

In the Linux kernel drm/amdgpu driver, the minimum DPB size calculation for H.264 uses the maximum number of references derived from the level instead of the actual number from the decode message, potentially leading to incorrect memory allocation.

A vulnerability in the Linux kernel's packet_parse_headers() function affects sending VLAN-tagged frames. Incorrect call order leaves transport_header uninitialized, potentially causing incorrect network stack behavior.

In the Linux kernel net: tap driver's tap_get_user_xdp() function, when processing a VLAN-tagged frame, the transport header is not set correctly, leaving transport_header uninitialized, which could lead to errors in further packet processing.

In the Linux kernel net/tls subsystem, tls_sw_splice_read() does not check for errors after a failed async decrypt. Unlike other read functions, splice may continue delivering data on a connection that should be closed due to authentication failure.

In the Linux kernel drm/xe/oa driver, xe_oa_emit_oa_config() does not release sync entries on failure before the point of no return, leading to memory leaks and fence references that become unreachable.

In the Linux kernel, in the sun6i-dma DMA driver, active descriptors are not properly reclaimed when terminating DMA transfers. Only cyclic descriptors were handled, causing non-cyclic descriptors and their LLI chains to be permanently leaked. The fix uses vchan_terminate_vdesc() and adds a check to prevent double-adding completed descriptors.

In the Linux kernel, IPVS lacks checksum validation for ICMPv6 packets from clients and for ICMPv6 responses from real servers (missing pseudo-header calculation). The fix introduces a helper ip_vs_checksum_common_check() and uses nf_checksum() for validating ICMP, TCP, and UDP, with correct IP offset for debugging. Checksum validation is performed only on LOCAL_IN, not on LOCAL_OUT or FORWARD.

In the Linux kernel, in ASoC SDCA, the UMP message size check may pass incorrectly if the message offset is larger than the buffer length. The fix refactors the check to be more robust against invalid sizes.

In the Linux kernel, the fscache backend for the EROFS filesystem has been entirely removed. This feature was deprecated for almost two years, and equivalent functionality is now provided by EROFS file-backed mounts and fanotify pre-content hooks. The removal also eliminates implementation issues that were not worth further investigation.

In the Linux kernel, in netfs, when a copy-to-cache append operation fails, the PG_private_2 flag on the folio is not cleared, leading to a held reference. The fix clears the flag and releases the reference immediately upon append failure.

In the Linux kernel, in netfs, when I/O iterator preparation fails, readahead folios that have already been batched are not released, causing held references. The fix releases the batch before returning the error.

In the Linux kernel, in mshv, there is a race in mshv_irqfd_deassign due to missing pt->pt_irqfds_lock during list traversal and deactivation. Additionally, using hlist_del() instead of hlist_del_init() leaves the node not marked as unhashed after removal, potentially leading to double deletion. The fix adds the lock and uses hlist_del_init().

In the Linux kernel's mshv module, a race condition exists between publishing a VP pointer in pt_vp_array and the irqfd fast assertion path. On weakly-ordered architectures, a reader may observe a non-NULL pointer before the VP struct is fully initialized, leading to use of partially initialized fields.

In the Linux kernel, in iommufd, during device replacement, the new hwpt is passed to iommufd_auto_response_faults instead of the old one, causing incorrect fault group processing. The fix passes the old hwpt, as originally implemented.

A vulnerability in the Linux kernel's hugetlb mechanism causes corruption of swap entries during fork(). The copy_hugetlb_page_range() function incorrectly clears the uffd-wp bit at the present-PTE bit position, which for migration or hwpoison entries modifies the encoded PFN by two pages. The issue occurs even without userfaultfd, requiring only a plain fork() with an in-flight migration entry or a poisoned hugetlb page.

In the Linux kernel, the EROFS filesystem LZMA stream pool size is now capped by a new configuration option. By default, the pool is limited to 16 streams, preventing small EROFS images from pinning excessive vmalloc memory on high-CPU systems.

In the Linux kernel for KVM on s390, validation of AIBV and AISB addresses is added before pinning guest pages. Requests with AIBV crossing a page boundary or with unaligned AISB address are rejected.