CVE Vulnerability Catalog

W jądrze Linuxa rozwiązano podatność związaną z brakiem inicjalizacji struktury HUBBUB na sprzęcie DCE. Problem ten mógł prowadzić do dereferencji wskaźnika NULL podczas dostępu do pliku amdgpu_dm_capabilities w debugfs.

In the Linux kernel drm/amdkfd driver, the destruction order was changed so kfd_process_destroy_wq runs before debugfs teardown. Previously this caused a NULL pointer dereference and kernel hang.

In the Linux kernel drm/amd/display DC module, a NULL check was added before dereferencing dc->ctx->perf_trace in dc_destruct(). Previously a failed allocation led to a NULL pointer dereference and kernel crash.

In the Linux kernel, DAMON's damon_migrate_pages() attempts migration even when the target NUMA node is invalid. If users mistakenly issue DAMOS_MIGRATE_HOT or DAMOS_MIGRATE_COLD actions with an invalid node, a kernel BUG (page fault/Oops) can occur. The fix adds a target node validity check modeled after do_pages_move().

In the Linux kernel, riscv_iommu_iova_to_phys() fails to handle NULL returns from riscv_iommu_pte_fetch() for unmapped IOVA, leading to a NULL pointer dereference. The fix adds a NULL check and removes unnecessary PTE validation.

In the Linux kernel, the RDMA/rxe module has an issue where delayed SKB packets still depend on rxe resources (e.g., QP, sk) when destroyed. If these resources are released before the SKB packets are destroyed, call traces may appear. A timestamp is added when SKB packets are created to allow network devices to free them earlier if they hang too long.

In the Linux kernel, the drm/amd/display module has a potential NULL pointer dereference because drm_atomic_get_new_connector_state() and drm_atomic_get_old_connector_state() can return NULL. The fix adds checks before dereferencing.

W jądrze Linuxa rozwiązano podatność związaną z funkcją ksmbd_rdma_stop_listening(), która została wydzielona z ksmbd_rdma_destroy(). Problem polegał na tym, że nie można było wywołać destroy_workqueue(smb_direct_wq) przed stop_sessions(), co mogło prowadzić do użycia wskaźnika NULL przez istniejące połączenia.

In the Linux kernel's iio: accel: sca3300 driver, the `channels` array is not zeroed before use, potentially leaking uninitialized stack data to userspace. The fix ensures the array is zeroed.

In the Linux kernel, do_insn_ioctl() and do_insnlist_ioctl() in the comedi subsystem leak uninitialized kernel memory to user space. Some instruction handlers do not fill all requested samples, so uninitialized data is copied back.

In the Linux kernel, Hygon processors lacked the resctrl_cpu_detect() call in BSP initialization, causing a division by zero fault during boot. The issue appeared after the function was moved to vendor-specific code.

In the Linux kernel, the drm/nouveau/nvif module has a potential memory leak in nvif_vmm_ctor(). When nvif_vmm_type is invalid, the function returns an error without freeing the args, leading to a memory leak. The fix sets ret to -EINVAL and goes to done.

W jądrze Linuxa zidentyfikowano podatność, która została naprawiona. Problem dotyczy braku sprawdzenia, czy adres tabeli metryk jest różny od NULL, co może prowadzić do dereferencji wskaźnika NULL przy dostępie do metrics_bin.

In the Linux kernel qla4xxx SCSI driver, qla4xxx_get_ep_fwdb() is supposed to return NULL on error, but qla4xxx_ep_connect() returns error pointers. Propagating these error pointers leads to an Oops in the caller.

In the Linux kernel, the drm/amd/display module's mod_hdcp_hdcp1_create_session() calls get_first_active_display() without checking its return value. If the display list is empty, it returns NULL, leading to a NULL pointer dereference. The fix adds a NULL check and returns MOD_HDCP_STATUS_DISPLAY_NOT_FOUND.

In the Linux kernel's scsi: ufs: ufs-qcom driver, a regression in ESI configuration causes a NULL pointer dereference when Platform MSI allocation fails, because the __free() macro attempts to free unallocated resources. The fix restructures ESI configuration to allocate MSI first and use explicit cleanup.

In the Linux kernel, a dst refcount leak was discovered for loopback packets in the netfilter nf_reject module. The issue occurs when nf_reject_fill_skb_dst attempts to replace the dst entry in a packet that already has one (e.g., loopback traffic), triggering a WARN() and potential memory leak.

ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived.

ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK that can be easily derived.

A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /exportacao-para-o-seb. Performing a manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used.