CVE Vulnerability Catalog

In the Linux kernel, in the OcteonTX2 AF driver for the NPC, there is an out-of-bounds write (slab-out-of-bounds) vulnerability. The issue arises from an incorrect size of the entry2cntr_map array, which can lead to memory corruption.

A vulnerability in the Linux kernel's ALSA SEQ OSS subsystem involves a race condition in the read queue reset path. The snd_seq_oss_readq_clear() function modifies queue state without holding q->lock, which can race with concurrent read/free operations, leading to stale records, dropped events, or incorrect readiness reporting.

In the Linux kernel for the MIPS architecture, in the maar_res_walk() function, there is an out-of-bounds write vulnerability. The function does not check if the array is full before writing, which can lead to memory corruption when there are many memory ranges.

In the Linux kernel, in the powerpc/perf driver for FSL EMB, there is a preempt count underflow vulnerability. The fsl_emb_pmu_del() function calls put_cpu_var() without a preceding get_cpu_var() under certain conditions, which can lead to a 'scheduling while atomic' bug.

In the Linux kernel, in the RDMA HNS driver, there is a memory leak vulnerability related to bonding resources. During concurrent driver removal and reset, resources may be allocated after they have been released, leading to memory leak and potential kernel panic.

In the Linux kernel, in the mfd cs42l43 driver, there is an out-of-bounds read vulnerability. The code does not check if the firmware size is larger than the header, which can lead to invalid memory access.

In the Linux kernel, in the coresight ete driver, there is a vulnerability due to not saving state on CPU power down. This can lead to operational errors and warnings when using Coresight with ACPI.

In the Linux kernel, in the tlclk driver, there is a use-after-free vulnerability in the tlclk_cleanup() function. The issue involves freeing memory before device operations are complete, which can lead to crashes or incorrect behavior.

In the Linux kernel's PCI dwc driver, dwc_pcie_rasdes_debugfs_deinit() can dereference a NULL pointer when the controller lacks RAS DES capability. Initialization succeeds but does not allocate rasdes_info, and the cleanup function tries to access it.

A vulnerability was found in the Linux kernel's PCI/MSI subsystem. A previous fix (commit 1a8d4c6ecb4c) caused a double iounmap() on a NULL pointer during an error path in msix_capability_init(), triggering a WARNING in iounmap. The issue was fixed by reverting that change and leaving the unmap to the existing __free(free_msi_irqs) cleanup.

In the Linux kernel's AppArmor module, the function aa_replace_profiles accessed udata->size after calling aa_put_loaddata(udata), potentially causing a use-after-free (UAF). The fix saves the size to a local variable before dropping the reference.

In the Linux kernel's amdkfd driver, there is a double-unpin of DOORBELL and MMIO BOs during GPU memory free. The function amdgpu_amdkfd_gpuvm_free_memory_of_gpu() unpins these objects before checking if they are still mapped, leading to a double unpin and a warning in ttm_bo_unpin.

In the Linux kernel's airoha network driver, there is a heap buffer overflow in the foe_check_time function. The array is declared as a u16 pointer but allocated with only ppe_num_entries bytes instead of ppe_num_entries * sizeof(u16), leading to out-of-bounds writes.

In the Linux kernel's ieee802154 subsystem, cfg802154_switch_netns() calls WARN_ON() on memory allocation failure in dev_change_net_namespace() and device_rename(). This leads to unnecessary warnings during deliberate fault injections.

In the Linux kernel's tun_dst_unclone function, there is a false-positive memcpy overflow warning. The compiler with clang and source fortification estimates that options cannot fit into the structure, even though memory is actually allocated, causing a warning.

In the Linux kernel's emac driver, there is a NULL pointer dereference in emac_probe. The function devm_request_irq() is called before devm_platform_ioremap_resource(), which can cause an interrupt to hit emac_irq() before dev->emacp is mapped, leading to a crash.

In the Linux kernel's veth driver, there is a NAPI leak in the XDP enable error path. The rollback loop skips calling netif_napi_del() for the failed index, leaving a dangling napi_struct in the device's NAPI list, leading to use-after-free (UAF) during device destruction.

In the Linux kernel, a vulnerability was found in the LWT (Lightweight Tunnels) mechanism. During LWT encapsulation, skb metadata (passed between XDP and TC) located in the packet headroom is overwritten or cleared, leading to warnings and errors, especially for forwarded packets carrying XDP metadata. The issue affects all LWT encapsulation types (mpls, seg6, ioam6, BPF) and all LWT redirect modes.

In the Linux kernel, ACPI LPI entry functions were not marked as __cpuidle, causing RCU warnings when function tracing or Kprobes were enabled during idle entry. The fix annotates these functions with __cpuidle, disabling ftrace instrumentation on this sensitive path.

In the Linux kernel, the enetc driver had a potential divide-by-zero when num_vsi was zero, which occurs on i.MX94 platforms without SR-IOV support. The fix adds an explicit check and early return when num_vsi is zero.