CVE Vulnerability Catalog

In the Linux kernel, the amlogic-c3 driver has a bug where missing validation of zones_num in AE and AWB config can lead to out-of-bounds access of the zone_weight buffer.

In the Linux kernel, the cedrus driver has a bug where invalid indices in H.264 reference lists can cause out-of-bounds reads of the DPB array. The fix skips such entries.

In the Linux kernel, the chips-media wave5 driver has a bug where a buffer can be returned to userspace before being removed from the ready queue, leading to list corruption and pointer poisoning.

In the Linux kernel, a vulnerability in the msi2500 driver (MSI2500 SDR receiver) causes queued vb2 buffers to leak when start_streaming() fails. Five error paths failed to return buffers to the vb2 framework, triggering WARN_ON and memory leaks. The fix consolidates error handling, ensuring all buffers are returned and the correct error code is propagated.

In the Linux kernel, the nxp imx8-isi driver fixed potential out-of-bounds issues. The maximum downscaling factor supported by ISI can be up to 16. Added a minimum value constraint before applying the setting to hardware to prevent the process from becoming unresponsive.

In the Linux kernel, the pwc driver (USB camera) has a buffer leak during start_streaming() failure. When start_streaming() returns an error without returning buffers via vb2_buffer_done(), a WARN_ON is triggered and queued buffers leak.

In the Linux kernel, the rtl2832_sdr driver has a vulnerability causing vb2 buffer leak on start_streaming() failure. If the function returns an error without returning buffers, WARN_ON triggers and queued buffers leak. The issue affects multiple error paths, including subdev, tuner, ADC, buffer and URB allocation failures.

In the Linux kernel, the stm32 dcmi driver (camera) has a notifier leak on probe failure. If notifier registration succeeds but later steps fail, the notifier is not unregistered, leading to a leak.

In the Linux kernel, the sun4i-csi driver (camera) has a buffer leak during start_streaming() failure. When start_streaming() returns an error without returning buffers, a WARN_ON is triggered and queued buffers leak.

In the Linux kernel, in the V4L2 control mechanism (v4l2-ctrls), there is a lack of validation for active L0/L1 reference counts for HEVC slice parameters. The common validation path does not verify these values before driver-specific code consumes them, which can lead to incorrect behavior.

In the Linux kernel, in the vivid driver, there is a missing check for vb2_is_busy() when toggling capabilities. The vivid_update_format_cap/out() functions can be called when the capture/output queue is not busy, but for controls that select CROP/COMPOSE/SCALE capability, this check is not performed. This can lead to unexpected results when the format is changed between REQBUFS and STREAMON.

A vulnerability was found in the Linux kernel's ALSA sequencer subsystem. The issue is that the queue deletion function does not close a re-opened timer, leading to a use-after-free condition. An attacker with access to /dev/snd/seq can exploit this flaw to corrupt kernel memory.

In the Linux kernel, in the ALSA timer subsystem, there is an issue with draining slave callbacks before the master detaches them. When a master instance is closed, remove_slave_links() clears each slave's ->timer, and the slave's own close then skips the drain entirely, which can lead to use-after-free if the slave's callback is still running.

In the Linux kernel, in the ALSA timer subsystem, there is an issue with re-entering an instance callback that is still running. The userspace-driven timer (utimer) TRIGGER ioctl calls snd_timer_interrupt() directly with no serialization, so two threads can run snd_timer_interrupt() on the same timer concurrently. The SNDRV_TIMER_IFLG_CALLBACK bit cannot represent two concurrent callbacks, leading to use-after-free.

In the Linux kernel, in the wifi ath6kl driver, there is an out-of-bounds (OOB) access issue caused by the firmware-supplied ADDBA window size. The aggr_recv_addba_req_evt() function logs a debug message when win_sz is out of range but does not return. The out-of-range win_sz is then used to compute an allocation size, leading to zero-size or overflowed allocations and subsequent out-of-bounds access.

In the Linux kernel, in the wifi ath6kl driver, there is a use-after-free issue in the aggr_reset_state() function. The function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_destroy(). If the timer callback is executing at that time, it may access freed memory.

In the Linux kernel's wilc1000 driver, there is an out-of-bounds read vulnerability when processing association responses. The driver does not validate that the frame length is sufficient to contain the header, which can lead to reading beyond the buffer or length wrap-around.

In the Linux kernel's brcmfmac driver, there is a double-free vulnerability of DMA buffers. The function releasing scratch buffers does not null the pointers after freeing, so when called multiple times (e.g., during reset and removal) it leads to freeing the same allocation again.

A use-after-free vulnerability was found in the Linux kernel's Bluetooth subsystem (hci_sync). The issue stems from missing synchronization of the UUID list between asynchronous work and add_uuid/remove_uuid operations, potentially leading to reading freed memory.

In the Linux kernel, the NSM misc driver's nsm_dev_ioctl() can unlock a mutex that was never locked when copy_from_user fails before acquiring the lock, leading to a bad unlock balance warning. The fix returns immediately on pre-lock failure.