CVE Vulnerability Catalog

In the Linux kernel, the scmi_power_name_get() function in firmware: arm_scmi lacked validation of the domain number, which could lead to out-of-bounds access. Fixed by returning "unknown" for invalid domains, like scmi_reset_name_get() does.

In the Linux kernel, the pinctrl: spacemit driver had a NULL check error in spacemit_pin_set_config. It checked the pin variable instead of the spin pointer, causing valid pin 0 to be rejected and PAD configuration skipped. Fixed by checking spin, restoring configuration and preventing NULL deref.

In the Linux kernel, the RDMA/hns driver has an issue in direct mode poll CQ. CQs allocated by ib_alloc_cq() always have a comp_handler, which although not expected to be called in direct mode, is called during driver reset, triggering a WARN_ONCE().

In the Linux kernel, there is a possible NULL pointer dereference in __in6_dev_stats_get(). The dev_get_by_index_rcu() function can return NULL if the original physical device is unregistered.

In the Linux kernel, the rapidio/tsi721 driver has an issue in tsi721_db_dpc(). In a list_for_each() loop, the 'found' variable is not reset at the start of each iteration, which can lead to incorrectly marking all items as found after the first correct doorbell, and if the item is not found, it may dereference invalid memory.

A vulnerability in the Linux kernel's OCFS2 filesystem causes a BUG_ON crash when mounting a corrupted filesystem image. A specially crafted image can trigger a kernel panic instead of a clean mount failure. The issue is in ocfs2_journal_toggle_dirty, which should return an error instead of crashing.

In the Linux kernel, the EDAC/igen6 driver has an issue due to missing release() function for memory controller devices. When unloading the driver, a call trace appears with a warning that the device does not have a release() function.

In the Linux kernel, the liveupdate mechanism has an issue with proper reference counting for incoming FLB data. The liveupdate_flb_get_incoming() function does not increment the reference count, which can lead to use-after-free when a subsystem holds the data.

In the Linux kernel, the wlcore driver has an issue with the cipher set that causes the number of ciphers to decrease on every boot of too old firmware. On some wl128x chips, this leads to key setting errors and endless hardware recovery attempts.

In the Linux kernel, the cxlctl_get_supported_features() function has a false positive buffer overflow detection by Fortify, leading to a kernel panic. The issue is due to an uninitialized num_entries variable.

In the Linux kernel, the setup_xor_mapping() function has a false positive buffer overflow detection by Fortify, leading to a kernel panic. The issue is due to an uninitialized nr_maps variable.

In the Linux kernel, the OCFS2 filesystem has an out-of-bounds write in ocfs2_remove_refcount_extent, which can lead to a kernel panic. The issue occurs when unlinking a refcounted file and the last leaf block is removed.

In the Linux kernel, the netfilter synproxy module has an unaligned memory access issue when adjusting the timestamp. Using unsafe operations can cause performance degradation or crashes on strict alignment architectures.

In the Linux kernel, the netfilter conntrack module reverts the ct extension genid infrastructure because it is no longer used. The previous change could disable all ct extensions for unconfirmed connections, potentially leading to crashes.

In the Linux kernel, the wcn36xx driver has an out-of-bounds read due to a short trigger BA firmware response. Lack of length validation can lead to reading stale heap data and corrupting the BA session state.

In the Linux kernel, the netfilter flowtable module has an underflow of num_encaps when untagging VLAN on a bridge, which can lead to an out-of-bounds stack read. This only happens with a malformed bridge path stack.

In the Linux kernel, the iommufd module lacks the dma_resv lock before calling dma_buf_unpin() in the release path, causing a kernel warning. This occurs when destroying or unmapping IOAS.

In the Linux kernel, the mt76 (mt7996) driver has a NULL pointer dereference in mt7996_init_tx_queues() when MT76_NPU and CONFIG_NET_MEDIATEK_SOC_WED are enabled. The issue occurs when an NPU is detected.

In the Linux kernel, in the Btrfs filesystem's LZO decompression function, there is an out-of-bounds read vulnerability. The segment length validation does not account for the compressed data size, which can lead to a null-ptr-deref and system crash.

In the Linux kernel, the net/sched/sch_fq_codel module has a vulnerability where qdisc_tree_reduce_backlog is called during peek before restoring the qlen counter. This can lead to incorrect deactivation of the parent class and, consequently, to a wild memory access in the qfq scheduler, manifesting as a general protection fault.