CVE Vulnerability Catalog

In the Linux kernel, the AMDGPU driver has a pin_count leak for the gart.bo object. The GART disable function is not called in SRIOV scenarios, leading to a leak when the driver is unloaded.

In the Linux kernel, the AMDKFD driver's svm_migrate_fini function performs redundant resource release operations, causing warnings and potential issues during driver disconnect.

In the Linux kernel, a vulnerability in the f2fs filesystem was fixed where multiple filesystem instances could race on accessing the global fsync_entry_slab pointer, leading to a use-after-free issue during recovery. The fix initializes and destroys this slab cache only once during module init/destroy to avoid the issue.

In the Linux kernel, the AMD Display Manager (DMUB) driver has a memory leak during system suspend/resume operations. The initialization function allocates memory on every resume, leading to a growing leak.

The Linux kernel has a vulnerability where the return value of __in_dev_get_rcu() is not checked for NULL in ip_route_use_hint(). This leads to a NULL pointer dereference in fib_validate_source(), which can be triggered by a local user and causes a kernel crash (general protection fault).

In the Linux kernel, the mlxsw spectrum_acl_tcam driver incorrectly used the list API by calling list_first_entry() on empty lists, causing a warning and potential issues. The fix adds a check for empty lists before processing.

In the Linux kernel, the netfilter nf_tables netdev release event path did not check the table's dormant flag. This caused an attempt to unregister an already unregistered hook, triggering a kernel WARNING in __nf_unregister_net_hook.

In the Linux kernel, the i40e driver allocated its workqueue with the WQ_MEM_RECLAIM flag, while the i40iw driver did not. This triggered a warning in check_flush_dependency during SRIOV testing when both drivers were loaded simultaneously. The issue was fixed by removing the WQ_MEM_RECLAIM flag from the i40e workqueue.

In the Linux kernel, the HID i2c-hid driver used the I2C_HID_READ_PENDING flag to serialize I2C operations, which was unnecessary (the I2C core has its own locking) and could cause a lock-up: if the flag was set and an interrupt occurred, the interrupt handler looped indefinitely, monopolizing the CPU. The fix removes this flag.

In the Linux kernel, the configuration disabling CPU mitigations by default for non-x86 architectures was incorrectly applied because SPECULATION_MITIGATIONS is x86-specific. The fix renames and forces mitigations on for all architectures except x86.

In the Linux kernel, the ACPI CPPC (Collaborative Processor Performance Control) implementation incorrectly used bit_width instead of access_width to determine the size of system memory accesses. Since bit_width can be any 8-bit value and is not always aligned to an 8-bit boundary, this caused invalid memory accesses, leading to an asynchronous SError interrupt and kernel panic on the Cobalt 100 platform during cppc_cpufreq driver initialization.

In the Linux kernel on RISC-V 64-bit NOMMU systems, the TASK_SIZE definition is incorrect if any RAM exists above 4G, causing spurious failures in userspace access routines.

A NULL function pointer dereference vulnerability exists in the Linux kernel's i2c/smbus subsystem. It occurs when using the designware controller in target-only mode, where the assumption of an always-available transfer function is broken. The fix adds a pointer check in __i2c_transfer.

In the Linux kernel, the bits_per() function rounded up to the next power of two when passed a power of two, causing miscalculations for CONFIG_NR_CPUS being a power of two. This led to crashes on some machines and configurations.

In the Linux kernel, the batman-adv module contains a flaw that can cause an infinite loop when trying to resize the local translation table (TT). This occurs when the MTU of an interface becomes too small to transmit the header and VLAN-specific part, so the resizing function never completes and repeatedly logs a message about forcing purging of TT entries.

A memory leak exists in the Linux kernel's hci_req_sync_complete() function in the Bluetooth subsystem. The function fails to free the previous sync request state before assigning a reference to a new one, leading to a gradual memory leak.

A vulnerability was found in the Linux kernel's geneve_xmit_skb function (geneve module) due to incomplete header validation. When skb->protocol contains a value other than ETH_P_IP or ETH_P_IPV6 (e.g., when using af_packet with a VLAN tag), pskb_inet_may_pull() does nothing, leading to use of an uninitialized value. The issue was reported by syzbot and fixed by adding skb_vlan_inet_prepare() to perform full MAC validation.

In the Linux kernel, the wifi rtw89 driver has a null pointer access bug when aborting a scan. During cancel scan, a vif that wasn't scanning might be used. The issue is fixed by using the actual scanning vif.

In the Linux kernel, the phy_device layer may cause null pointer exceptions in the interrupt service routine (ISR). If phydev->irq is set unconditionally, a valid interrupt handler must be checked or fall back to polling mode to prevent null pointer exceptions in the ISR.

In the Linux kernel, the VMCI (Virtual Machine Communication Interface) module has a bug in dg_dispatch_as_host() where a memcpy() call copies data larger than the destination structure, triggering a run-time warning under FORTIFY_SOURCE. The vulnerability was found by the Syzkaller fuzzer and may lead to undefined behavior or potential memory corruption.