CVE Vulnerability Catalog

In the Linux kernel, the tracing/mmiotrace subsystem lacked a NULL check for mmio_trace_array in __trace_mmiotrace_rw() and __trace_mmiotrace_map(). If these functions are called while mmio_trace_array is NULL (e.g., before initialization or after disabled), accessing tr->array_buffer.buffer results in a NULL pointer dereference crash.

In the Linux kernel for RISC-V, the function vec_check_unaligned_access_speed_all_cpus was marked as __init, placing its code in the .init.text section which is freed after boot. This function runs in a kernel thread that may not finish before the memory is freed, leading to a page fault when trying to execute code from the freed region.

In the Linux kernel's iommufd/viommu subsystem, in iommufd_vdevice_alloc_ioctl(), after a failed vdevice_size validation, jumping to out_put_idev skips releasing the igroup lock, causing a deadlock for subsequent vDEVICE operations on that group.

In the Linux kernel's migrate_vma_collect_pmd(), pte_pfn() and pte_dirty() may be called on non-present PTEs (e.g., device-private entries), leading to potential crashes or incorrect dirty folio accounting. The fix adds pte_present() checks.

In the Linux kernel's snapshot_page(), __page_2 is read for order-1 folios, but it should only be read when nr_pages > 2. This can cause a page fault during DLPAR memory removal on ppc64le systems.

In the Linux kernel's KVM subsystem for s390, airq_iv_create() can return NULL, but its return value is not checked. On failure, zdev->aibv will be NULL, leading to a NULL dereference in kvm_zpci_set_airq(). The fix adds a NULL check and frees previously allocated resources.

A use-after-free vulnerability was found in the Linux kernel's Bluetooth SCO subsystem. The issue stems from incorrect reference counting for the sco_conn structure, where the socket did not hold its own reference, leading to a double-free race condition between socket close and disconnection event handling.

In the Linux kernel for RISC-V, a bug was found in the calculation of vmemmap_start_pfn alignment. The issue uses alignment expressed in bytes of struct page storage instead of physical address bytes, causing a warning and potential memory initialization problems on systems like QEMU virt.

In the Linux kernel's vxlan subsystem, after calling route_shortcircuit(), the Ethernet header pointer may point to freed memory because the function can reallocate the skb buffer. This leads to a use-after-free when reading the destination address.

In the Linux kernel's i2c amd-mp2 driver, on adapter registration failure, the I2C context is freed by devres, but the PCI driver may still dereference the stale pointer in IRQ and sleep callbacks. The fix unregisters the callback before returning the error.

In the Linux kernel's s390/dasd driver, in dasd_release_space(), using the logical AND operator instead of OR leads to calling is_ese() even when the function pointer is NULL, causing a NULL pointer dereference.

In the Linux kernel's i2c imx driver, there is a race during slave registration and error handling. Assigning the slave pointer before pm_runtime_resume_and_get() can leave it non-NULL after an error, and a race with the interrupt handler can cause a NULL dereference. The fix defers the assignment until after successful resume and performs it inside the slave_lock critical section.

In the Linux kernel, dev_has_sync_state() reads dev->driver twice without holding device_lock(), which can lead to a race during concurrent unbind. The fix reads dev->driver exactly once with READ_ONCE(), pairing with WRITE_ONCE() in device_set_driver().

In the Linux kernel, the vmbus driver accesses the driver_override field without a lock during match() from __driver_attach(), potentially leading to use-after-free. The fix uses the generic driver_override infrastructure that handles locking internally.

In libbpf, the signed loader does not ensure that a map is exclusive before validating map->sha. Without exclusivity, another BPF program with map access can mutate the contents after freezing, allowing validation on stale data. The fix adds an exclusivity check.

A vulnerability was found in the Linux kernel's NTFS filesystem. Attribute lists for base inodes were not properly validated when resident, allowing out-of-bounds reads of the buffer. A validation function was added to check each entry's header and length before use.

In the Linux kernel's NTFS filesystem, ntfs_external_attr_find() improperly bounds-checks the next attribute-list entry, potentially leading to a slab out-of-bounds read with a crafted disk. The fix adds validation of the entry before dereferencing.

In the Linux kernel NTFS driver, a vulnerability was found where the restart-area length is truncated to u16, allowing the bounds check to be bypassed. A crafted NTFS image can cause an out-of-bounds read during filesystem mount.

In the perf sched tool in the Linux kernel, register_pid() has several issues when processing untrusted perf.data: integer overflow, heap buffer overflow via strcpy, BUG_ON on allocation failure, and memory leak on realloc. The fix caps pid, uses strlcpy, adds NULL checks, and uses safe realloc patterns.

In the perf tool in the Linux kernel, machine__resolve() does not validate the CPU index from untrusted perf.data before accessing env->cpu array, potentially leading to an out-of-bounds heap read. The fix uses perf_env__get_cpu_topology() and adds bounds checking.