CVE Vulnerability Catalog

In the Linux kernel's MPTCP module, a remote peer can send a malformed DSS with an incorrect size, causing the first suboption to be ignored but leaving some fields written, potentially leading to inconsistency or access to uninitialized data. The fix explicitly resets fields that could have been modified in case of unexpected size.

In the Linux kernel's MPTCP module, mptcp_fastopen_subflow_synack_set_params() set the is_mptfo flag before checking for queued SYN data. This caused data-less TFO SYNs to trigger a WARN and leave stale MPTFO state, potentially leading to a state-confusion bug in check_fully_established(). The fix marks the subflow as MPTFO only after confirming that an SKB was queued.

In the Linux kernel's s390/qeth driver, qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by a user-supplied length without checking a lower bound, leading to out-of-bounds write. The fix rejects buffers smaller than udata_offset before allocation.

In the Linux kernel's ASoC lpass-tx-macro driver, tx_macro_dec_mode_get() and tx_macro_dec_mode_put() access the control value via ucontrol->value.integer.value[0] instead of ucontrol->value.enumerated.item[0], leading to out-of-bounds access for enum types. The fix uses the correct field.

In the Linux kernel's drm/shmem_helper driver, the ->huge_fault handler did not check if the PMD mapping exceeds VMA boundaries, potentially leading to VM_BUG_ON_VMA() in copy_pmd_range(). The fix adds VMA boundary checks before installing the mapping.

In the Linux kernel's ASoC SOF ipc4-pcm driver, IPC errors for pipeline state change are ignored if the firmware is crashed or IPC timed out. The fix allows continuing with state changes to reset the kernel's internal state.

In the Linux kernel's fbdev driver, mode_string() uses snprintf() which can return a value larger than the remaining buffer space, causing the offset to advance past the sysfs buffer. The fix adds a size parameter and uses scnprintf(), plus an early return when offset exceeds the buffer.

In the Linux kernel's fbdev driver, fb_set_var() can delete a mode from the modelist, but does not check if fb_info->mode points to the deleted entry, leading to a stale pointer dereference on sysfs read. The fix clears fb_info->mode before deleting the mode.

In the Linux kernel's fbdev driver in fb_io_read(), a partial copy_to_user() causes desynchronization of the hardware pointer, leading to out-of-bounds reads. The fix breaks out of the loop immediately upon a partial copy.

In the Linux kernel's drm/panthor driver, panthor_fw_load_section_entry() skips BO creation for zero-sized firmware sections but adds them to the section list, leading to NULL pointer dereference in later paths. The fix skips adding such sections to the list.

In the Linux kernel amdgpu driver, there was no limit on the IB buffer size for GFX rings, which could corrupt adjacent control bits and destabilize command submission. A per-ring IB packet size limit was added and oversized submissions are now rejected.

In the Linux kernel, a vulnerability was found in the cs40l50-vibra input driver. The driver copies custom data of an FF_PERIODIC/FF_CUSTOM effect from user space without validating its length, which can lead to out-of-bounds reads and improper indexing of the bank array. Missing length checks (custom_len) and incorrect masking of the bank value (stored as s16) allow an attacker to trigger undesirable behavior.

In the Linux kernel FocalTech touchscreen driver, an array out-of-bounds bug in focaltech_process_rel_packet was fixed by making finger indices unsigned, preventing writes to state->fingers[-1].

In the Linux kernel Iforce driver, input packet lengths were not validated, allowing out-of-bounds reads from short packets. The fix rejects zero-length USB transfers and requires proper packet prefixes.

In the Linux kernel BYD touchscreen driver, a race condition during disconnect was fixed by using timer_shutdown_sync() instead of timer_delete(), preventing use-after-free.

In the Linux kernel powerpc/pseries papr-phy-attest, missing validation of cmd.length could lead to buffer overflow. The fix adds length checks and fixes memory leaks on error paths.

In the Linux kernel Synaptics RMI4 driver (F54), a bug could lead to heap buffer overflow because report_size was not zeroed on error, causing stale larger payload to be copied into a smaller V4L2 buffer.

In the Linux kernel Synaptics RMI4 driver (F54), a bug allowed report size to exceed allocated buffer, leading to out-of-bounds write. The fix records allocation size and rejects reports that do not fit.

In the Linux kernel Synaptics RMI4 driver (F54), a bug allowed changing input type during streaming, which could change report size and lead to heap buffer overflow. The fix blocks VIDIOC_S_INPUT with -EBUSY when streaming.

In the Linux kernel Synaptics RMI4 driver (F54), worker errors were not propagated to the V4L2 queue, causing stale or uninitialized data to be delivered to userspace. The fix adds error checking and marks buffers as error state.