CVE Vulnerability Catalog

In the Linux kernel, the synaptics-rmi4 driver has a typo that incorrectly assigns the transmitter (TX) electrode count to the receiver (RX) value. This leads to incorrect diagnostic report size and potential out-of-bounds buffer access.

In the Linux kernel, in the ovpn driver, there is a security issue related to running deferred work on global system workqueues. Work may be executed after the module text is freed, leading to use-after-free. The fix adds a module-owned workqueue and flushes it before module destruction.

In the Linux kernel, the psxpad-spi driver has a NULL pointer dereference vulnerability. The psxpad_spi_suspend() function retrieves driver data, but it is not stored during probe, leading to a crash during system suspend.

In the Linux kernel, in the MediaTek pmdomain driver (mtk_mfg), the variable prev_o is uninitialized in mtk_mfg_attach_dev(). On the first loop iteration it is read before assignment, potentially dereferencing a stale or invalid pointer, causing faults or incorrectly skipping the first OPP.

In the Linux kernel's pmdomain subsystem for MediaTek, there is an issue with use of a pointer to a freed device-tree node in error paths. The function scpsys_get_bus_protection_legacy() releases the node before checking the regmap lookup result, then uses it in the error message, potentially leading to dereferencing freed memory.

In the Linux kernel's DRM driver for HDMI connectors, there is an out-of-bounds memory read issue. A helper function copies an audio infoframe into the connector's copy using the destination size (60 bytes) instead of the source size (28 bytes), causing a read beyond the allocated buffer.

In the Linux kernel's MMC driver for Loongson chips, there is an issue with scatterlist iteration in data reorder functions. The for_each_sg() macro already iterates over entries, but the code uses '&sg[i]' and 'sg_dma_len(&sg[i])', leading to access of wrong entries or out-of-bounds reads.

In the Linux kernel's drm/amdkfd driver, the CRAT parser does not validate that the advertised subtype length fits within the image. A malformed CRAT table with an oversized length field causes out-of-bounds reads during parsing.

In the Linux kernel's Qualcomm clock driver (dispcc-eliza), there is a clock reparenting issue when display is disabled, causing warnings and incorrect clock configuration on Eliza EVK.

In the Linux kernel's FP9931 regulator driver, there is an issue with the VPOS/VNEG voltage selector table. The VPOSNEG_table[] does not match the datasheet: it has an extra 7.04V entry (shifting all subsequent) and only 41 entries instead of 64, causing out-of-bounds access for selectors above 0x28.

In the Linux kernel netfilter nf_tables_offload module, the nft_flow_rule_offload_abort() function triggers WARN_ON_ONCE(err) for every error during rollback, including -ENOMEM. Memory allocation failures are expected under low-memory conditions and do not indicate a kernel bug. The fix changes the condition to WARN_ON_ONCE(err && err != -ENOMEM) so warnings are only emitted for unexpected errors.

In the Linux kernel, the ASoC Xilinx formatter_pcm driver has a NULL pointer dereference vulnerability. Interrupt handlers retrieve driver data via dev_get_drvdata(), but the data is set only after interrupt registration, which can lead to a crash.

In the Linux kernel, af_packet has a vulnerability that allows sending zero-byte packets via tpacket_snd(). This triggers a warning in __dev_queue_xmit() and potentially a system crash.

In the Linux kernel's drm_log_draw_kmsg_record() function, there is an out-of-bounds read when the message length is 0. The function accesses s[len - 1], where len is unsigned int, causing a wrap to UINT_MAX when len=0, leading to an out-of-bounds read.

In the Linux kernel, in the drm/log driver, there is an infinite loop when the scale is too large for the display, causing rows or columns to become 0. The loop in drm_log_draw_kmsg_record() never decrements len when columns is 0. A check for zero rows/columns was added in drm_log_setup_modeset() to return an error and clean up the allocated buffer to avoid a leak.

In the Linux kernel, a vulnerability in the mlx5e driver (for Mellanox/NVIDIA network cards) leads to a deadlock (AA deadlock). The issue occurs when an FDB flow addition in TC fails at lower levels, and then flow deletion (mlx5e_tc_del_flow) tries to acquire the devcom lock again, which is already held for peer flows. This causes recursive locking (lockdep: possible recursive locking detected).

In the Linux kernel's bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie functions, there is an issue with missing validation of socket state before accessing sk_protocol. These functions may receive a pointer to a mini-socket that lacks full socket fields, potentially leading to dereferencing invalid memory.

In the Linux kernel, in the amba-pl011 serial driver, there is a synchronization issue during DMA teardown. dmaengine_terminate_all() does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port lock. The fix switches to dmaengine_terminate_sync() and deletes the RX timer before freeing the buffers.

In the Linux kernel's Thunderbolt subsystem, there is an issue with indexing the bandwidth reservation array. The function tb_consumed_dp_bandwidth() uses the group ID (from 1 to MAX_GROUPS) as an index into the group_reserved[] array, which has only MAX_GROUPS entries, causing an out-of-bounds read for group MAX_GROUPS and omitting it from the sum.

In the Linux kernel, in the ovpn driver, there is a security issue with dereferencing sk_user_data. Some subsystems, like BPF SOCKMAP, set sk_user_data without setting encap_type. It is necessary to ensure the type is the one ovpn expects before dereferencing to avoid out-of-bounds reads.