CVE Vulnerability Catalog

In the Linux kernel, the imx8mp-blk-ctrl power domain is missing the fdcc clock in the hdmimix domain. The fdcc clock is part of the HDMI RX verification IP and should not be enabled for HDMI TX, but disabling it before HDMI/LCDIF probe causes LCDIF to not get the pixel clock from HDMI PHY and produces errors (vblank timeout, drm_atomic_helper warnings). The fix adds the fdcc clock to the LCDIF and HDMI TX power domains.

In the Linux kernel, the psz_kmsg_read function in the pstore/zone module lacked a check for the pointer returned by kasprintf(). On allocation failure the function could return NULL, leading to a bug. A pointer validity check was added.

In the Linux kernel, the btrfs_relocate_sys_chunks() function does not handle a chunk tree lookup error. This case can only occur due to corruption, as the search should not return an invalid chunk item under normal conditions.

In the Linux kernel, a fix was made to reduce excessive rtnl lock pressure in smc_pnet_create_pnetids_list() within the net/smc subsystem. This function was called during network namespace creation even when no network device existed yet, causing unnecessary acquisition of the rtnl lock and numerous syzbot reports of extreme rtnl pressure. The patch returns early from smc_pnet_net_init() if there is no netdevice yet.

In the Linux kernel, the btintel_read_version() function has a null pointer dereference. If hci_cmd_sync_complete() is triggered and skb is NULL, then hdev->req_skb is NULL, causing the issue.

In the Linux kernel, the lpfc_rcv_padisc() function has a possible memory leak. The call to lpfc_sli4_resume_rpi() may return an unsuccessful status, in which case the elsiocb is not released, leading to a resource leak.

In the Linux kernel, the blk_rq_stat_sum() function has a possible division by zero. The expression dst->nr_samples + src->nr_samples may have a zero value on overflow, requiring an added check.

In the Linux kernel, the fb_videomode_from_videomode() function has a possible division by zero. The expression htotal * vtotal can have a zero value on overflow, requiring protection against division by zero.

In the Linux kernel, a vulnerability was resolved in the SysV filesystem where sb_bread() was called with pointers_lock held, causing sleep in atomic context. The deadlock and sb_bread() with lock bugs were introduced by changes in Linux 2.5.12 and 2.6.8. The fix follows an approach similar to the Minix filesystem.

In the Linux kernel, the SELinux subsystem has a bug where it continues and dereferences an error pointer when kern_mount() fails. This can lead to invalid memory access.

In the Linux kernel, net/rds has a possible null pointer dereference because cp might be null, and calling cp->cp_conn would produce a null dereference. The cp pointer is a parameter of __rds_rdma_map and is not reassigned; some call sites pass NULL. The fix adds a check for cp before use.

In the Linux kernel, the netfilter nf_tables module has an issue where after toggling the dormant flag on a table, a new base chain can be added, leading to an inconsistent state. This triggers a warning when trying to unregister an already unregistered chain.

In the Linux kernel BPF sockmap subsystem, the map_delete_elem operation can cause a lock inversion deadlock when invoked from a hardirq context, because sockmap locks are not hardirq-safe. The fix detects invocation from a context with interrupts disabled and returns an error.

A kernel information leak was found in the Linux kernel's tcf_skbmod_dump() function (net/sched: act_skbmod). The 'struct tc_skbmod' contains a four-byte hole that was not cleared before filling fields, causing uninitialized kernel stack data to be copied to user space.

A flaw in the Linux kernel's PAT (Page Attribute Table) handling in COW (Copy-On-Write) mappings. The follow_phys() function may return incorrect page information, leading to kernel warnings (WARN_ON_ONCE) and potential memory leaks. The issue affects x86 architecture and has been fixed.

In the Linux kernel, the powerpc/imc-pmu module lacked a null pointer check on the pointer returned by kasprintf() in update_events_in_group(). On allocation failure, kasprintf() returns NULL, which can lead to a null pointer dereference.

A flaw in the Submariner project involves unnecessary RBAC permissions. A privileged attacker can run a malicious container on a node, steal service account tokens, and compromise other nodes or the entire cluster.

In the Linux kernel, the lbs_allocate_cmd_buffer() function has memory leaks. If the allocation of cmdarray[i].cmdbuf fails, both cmdarray and cmdarray[i].cmdbuf need to be freed, otherwise memory leaks occur.

In the Linux kernel, a vulnerability was fixed where the Unicode buffer was corrupted when deleting characters in the virtual terminal (vt) subsystem. The issue was caused by overlapping buffers and the use of memcpy() instead of memmove(), leading to data corruption.

In the Linux kernel, a bug in asynchronous I/O handling (fs/aio) allows the req->ki_ctx read to occur before the IOCB_AIO_RW test, potentially accessing a struct kiocb not embedded in struct aio_kiocb.