CVE Vulnerability Catalog

In the Linux kernel's zcrypt driver, there is an issue with incorrect domain value verification for EP11 CPRBs. The wrong upper limit can lead to heap memory access beyond perms->adm when an administrative CPRB is sent.

In the Linux kernel's zcrypt driver, there is an issue with missing memory scrub at clear key import in cca_clr2cipherkey(). The internal buffer may contain sensitive data that could be exposed via memory reuse.

In the Linux kernel, the CAN J1939 function j1939_session_fresh_new() did not zero the buffer before use, potentially leaving residual data. The fix zeroes the allocated buffer to prevent potential information leakage.

In the Linux kernel, the CAN softing driver's fw_parse() function did not validate that firmware records fit within the firmware image, potentially leading to out-of-bounds reads. Additionally, bounds calculations for DPRAM writes were prone to integer overflow, and the application loader's data copy was not properly bounded.

In the Linux kernel, the AMD Display driver (drm/amd/display) lacked a check for successful allocation of the phantom plane in dml21_add_phantom_plane(), which could lead to a segmentation fault later.

In the Linux kernel, the AMD Display driver (drm/amd/display) function get_ss_info_from_atombios() used an uninitialized context for logging, leading to NULL pointer dereference during DC_LOG_SYNC() calls. Similar issues exist in dce112_get_pix_clk_dividers() and dcn3_get_pix_clk_dividers(). The fix changes the logging context to use the one from the clock source base.

In the Linux kernel, the AMD KFD driver (drm/amdkfd) lacked authorization checks in KFD_IOC_DBG_TRAP_DISABLE, allowing users with /dev/kfd access to terminate another process's debug session without proper ownership or ptrace authorization.

In the Linux kernel, the VMware driver (drm/vmwgfx) had two sites in vmwgfx_resource.c that assigned boolean literals to the guest_memory_size field, which is an allocation-size field, instead of the adjacent guest_memory_dirty bitfield. This caused guest_memory_size to hold 0 or 1 instead of the actual allocation size, leading to errors in dirty page range calculations and buffer allocation.

In the Linux kernel's DRM vmwgfx driver, a vulnerability exists due to missing cursor size validation for the MOB path (SVGA_CAP2_CURSOR_MOB). An attacker with DRM master privileges can use DRM_IOCTL_MODE_CURSOR2 to set an oversized cursor, leading to a call to vmw_bo_map_and_cache(NULL) and a kernel oops.

In the Linux kernel, the VMware driver (drm/vmwgfx) function vmw_external_bo_copy() did not validate bounds for copy operations on imported dma-buf buffers. Lack of validation could lead to out-of-bounds reads or writes, especially with crafted plane state data.

In the Linux kernel, KVM for ARM64 (vgic) had an issue of double-deactivation of interrupts in the nested context. The physical interrupt was already deactivated via the HW bit in the LR, and the extra deactivation could trigger an errata on AmpereOne processors, causing loss of pending interrupt state and blocking future interrupts.

In the Linux kernel, the DMA Engine driver (idxd) had a double-free issue for wq, engine, and group structures. The release callbacks called kfree() on the enclosing struct, and additionally error paths and cleanup functions also called kfree() after put_device(), leading to double free.

In the Linux kernel, the EROFS filesystem had a bug where backing files for page cache sharing had an invalid f_path (left as NULL). This caused a kernel NULL pointer dereference during mincore, crashing the system in the erofs/028 test.

In the Linux kernel, the hwmon ltc4282 driver had a missing return statement when reading the minimum alarm voltage for the VGPIO channel, causing an out-of-bounds access.

In the Linux kernel, the hwmon sht3x driver had unaligned memory accesses when reading 16-bit temperature and humidity values. Using be16_to_cpup() on odd offsets causes alignment faults on strict-alignment architectures (e.g., ARMv5, SPARC), leading to kernel panic.

In the Linux kernel, the mtk_eth_soc network driver had a bug where the wrong pointer (net_device instead of mtk_eth) was passed to mtk_handle_irq_rx in mtk_poll_controller. This could cause a system crash when using CONFIG_NET_POLL_CONTROLLER.

In the Linux kernel, the idpf driver had a bug where idpf_get_reg_intr_vecs() fills the reg_vals[] array without bounding it to the actual number of allocated vectors. A reply from the controller (PF or hypervisor) with a sum of vectors exceeding the allocated count leads to an out-of-bounds write.

In the Linux kernel, the Bluetooth subsystem (hci_sync) had a theoretical use-after-free (UAF) vulnerability in hci_connect_acl/le_sync() callbacks. If the connection (conn) is freed while the hci_sync task is running, it could lead to use of freed memory.

In the Linux kernel, the SCSI target iblock driver had a bug in iblock_execute_pr_out() where the NULL check for PREEMPT, PREEMPT_AND_ABORT, and RELEASE operations was incorrect. This allows unimplemented hooks (ops->pr_clear) to be called, leading to NULL pointer dereference.

In the Linux kernel, the SCSI UFS core driver had a bug where the hba->rpmbs list was not initialized in ufshcd_alloc_host(). If ufs_rpmb_probe() fails, a NULL pointer dereference could occur during device teardown.