CVE Vulnerability Catalog

In the Linux kernel, the hynitron_cstxxx driver improperly validated touch count and finger IDs. This can lead to corrupted touch state or out-of-bounds buffer access.

In the Linux kernel, the crypto qce driver has an error path bug in devm_qce_register_algs. On registration failure, the error path repeatedly calls the same unregister function instead of unregistering previously registered algorithms.

In the Linux kernel, the gve driver lacks an implementation of adjfine, leading to a NULL pointer dereference when triggered from userspace, e.g., via testptp.

A use-after-free vulnerability was found in the Linux kernel's gpio-sloppy-logic-analyzer driver. The 'trigger' debugfs file lacked proper protection, allowing a write to freed memory during device unbind. The issue was fixed by using debugfs_create_file() instead of debugfs_create_file_unsafe().

In the Linux kernel, the gpio ml-ioh driver used a regular spinlock for register protection, which is invalid in irq_chip callbacks on PREEMPT_RT systems. The fix converts it to raw_spinlock_t.

In the Linux kernel, the decode_locker() function in cls_lock_client.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads. Missing bounds checks before copying the name, an unchecked pointer advance, and an uncapped length value can lead to memory corruption. The fix replaces unsafe operations with safe variants and returns -EINVAL on any bounds violation.

In the Linux kernel for the OpenRISC architecture, restore_sigcontext() restored all SR bits from the signal frame, leaving privileged bits under user control. This allows an unprivileged task to disable the MMU and gain access to arbitrary physical memory.

In the Linux kernel, the sur40 driver registered the input device too early, before V4L2 and vb2_queue components were fully initialized. This can lead to data races and system crashes. The fix moves registration to the end of the probe function.

In the Linux kernel, libceph may use invalid OSD indices from primary_temp in a corrupted osdmap, leading to out-of-bounds reads. The fix adds validation of indices in get_temp_osds().

In the Linux kernel, libceph's decode_watchers() lacked a bounds check before reading a 32-bit value, leading to an out-of-bounds read when struct_len=0. The fix uses the safe variant ceph_decode_32_safe.

In the Linux kernel, the mmc: atmel-mci driver has a use-after-free (UAF) vulnerability in atmci_remove due to a race condition. The host->bh_work can be queued by interrupt, timer, or DMA completion, and after module removal the host memory is freed before the work finishes, leading to use of freed memory.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a memory leak when cp_init() fails. The current cleanup logic does not handle all channel program segments, leading to memory leakage.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is no limit on the number of channel program segments. Processing is recursive, which can lead to exceeding the global limit and potential issues.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a lack of cancellation of existing workqueues during initialization. This can lead to dispatching work after the private structure is freed.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a lack of range checking for read/write region indexes. The introduction of the capability chain clamped indexes only for capabilities, but not for existing regions.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a lack of verification that the first IDAW remains constant between reads. This can lead to an inconsistent set of IDAWs.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is an out-of-bounds check on the CCW array. The loop may check a 257th element, which is out of bounds.

In the Linux kernel, in the s390/vfio_ccw subsystem, cleanup of cp resources is performed in fsm_notoper(), which can be called asynchronously while holding other locks. This can lead to deadlocks or malfunction.

In the Linux kernel, in the s390/vfio_ccw subsystem, the scope of io_mutex has been expanded to close remaining synchronization gaps. It also takes advantage of moving cp_free() to a workqueue, allowing safe lock management.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a lack of locking mechanism for the CRW region, which relies solely on asynchronous hardware events. A lock has been added to ensure consistent reading of the payload list.