CVE Vulnerability Catalog

In the Linux kernel, in the openvswitch module, a skb leak was found on flow key update failure during connection tracking. ovs_ct_execute() always steals or frees the skb on failure, but ovs_flow_key_update() does not, leading to a memory leak. The fix breaks out of the loop and lets the common error handling code free the skb properly.

A severe AB/BA deadlock between the Common Clock Framework (CCF) and the I2C adapter lock in the Linux kernel's jz4780 driver has been fixed. The issue occurred when an I2C-controlled clock generator client (e.g., Si5351) changed frequency while a parallel transfer on the same bus called clk_get_rate() in the active transfer path, causing a system freeze. The fix caches the static host clock rate during probe and uses it in jz4780_i2c_set_speed(), removing the dependency on CCF internal locks during transfers.

In the Linux kernel, in the i2c: imx driver, a problem was found where the I2C adapter was not marked as suspended when hardware is powered down. During the time window between suspend_noirq and system entering suspend, and between resume start and resume_noirq, I2C controller resources (clock, pinctrl) may be unavailable. If a workqueue triggers an I2C transfer in this period, it may lead to system hang. The fix marks the adapter as suspended during noirq suspend and blocks new transfers until resume.

In the Linux kernel, in the i2c: imx driver, a problem was found where the hrtimer was not canceled before clearing the slave pointer. In i2c_imx_unreg_slave(), the slave pointer is set to NULL after disabling interrupts, but a pending interrupt might have already started the hrtimer. If the hrtimer fires after slave is set to NULL, it can lead to use-after-free or NULL pointer dereference. The fix cancels the hrtimer and waits for it to complete before clearing the slave pointer.

In the Linux kernel, the ems_usb driver for CAN bus added validation of CPC message lengths. The ems_usb_read_bulk_callback() function processes CPC messages in a USB buffer and now checks that each message fits in the URB payload and that its type-specific part covers the fields used by the CAN, state, error, and overrun handlers.

In the Linux kernel, the etas_es58x driver for CAN bus fixed an RX buffer leak in es58x_read_bulk_callback() on URB resubmit failure. When usb_submit_urb() fails, the callback unanchors the URB and returns without freeing the buffer allocated by usb_alloc_coherent(), causing a memory leak.

In the Linux kernel, the kvaser_usb_leaf driver for CAN bus added validation of received command lengths in kvaser_usb_leaf_wait_cmd(). Commands with non-zero length that do not contain the fixed header or extend beyond the current USB buffer item are rejected, and in the wait path also commands exceeding the destination structure size.

In the Linux kernel, the peak_usb driver for CAN bus added bounds checking for the USB channel index. The ctrl_idx index comes from USB data and can take values 0-15, but the usb_if->dev[] array has only 2 elements, leading to heap out-of-bounds read and kernel panic in IRQ context.

In the Linux kernel, the peak_usb driver for CAN bus fixed a double free of the transfer buffer in peak_usb_start() on URB submit error. The buffer is freed explicitly by kfree(buf) and then again by usb_free_urb() due to the URB_FREE_BUFFER flag, leading to a double free.

In the Linux kernel, the peak_usb driver for CAN bus added validation of uCAN receive record lengths in pcan_usb_fd_decode_buf(). Each record must contain the fixed header for its type, and CAN payload bytes are verified before copying them into the skb.

In the Linux kernel, the drm/vc4 graphics driver fixed a bug where BPOS was set to the whole binner BO size instead of the overflow slot size. This allows the PTB to write tile lists outside the intended area, leading to memory corruption by GPU DMA, GPU hangs, and system crashes.

In the Linux kernel, the drm/vc4 graphics driver added zeroing of the Tile State Data Array (TSDA) before each BIN job. Previously, binner slots were reused without clearing, which could cause the PTB to act on stale data and lead to GPU hangs.

In the Linux kernel, the drm/panthor graphics driver added rejection of firmware sections with oversized data. Previously, the data size to copy was not validated against the allocated section size, which could lead to heap buffer overflow and massive out-of-bounds zeroing of kernel memory.

In the Linux kernel, the drm/panthor graphics driver added validation of firmware interface structure sizes. The iface_fw_to_cpu_addr() function only checked that the MCU virtual address points inside the shared section, but did not check that the entire structure fits, which could lead to out-of-bounds accesses.

In the Linux kernel, the amdgpu driver has a use-after-free vulnerability in amdgpu_dpm_get_pp_table(). The function returns a pointer to the power table after dropping the mutex, and a concurrent pp_table write can free the memory during the copy, leading to use-after-free. The fix copies data into caller-provided storage while holding the mutex.

In the Linux kernel, the amdgpu display driver has a divide-by-zero vulnerability in calculate_mcache_setting when the viewport has zero area. This causes a kernel panic and potential underflow on num_mcaches. The fix changes the function to return bool and adds guards to reject the mode when values are zero.

In the Linux kernel, the amdkfd driver has a QID bit leak in pqm_create_queue(). When kernel memory allocation fails during the first queue creation, the function returns early without clearing the QID bit, causing a permanent leak of queue slots. The fix changes the error path to goto err_allocate_pqn to always call clear_bit.

In the Linux kernel, the amdkfd driver has a uint32_t overflow vulnerability in EOP ring buffer size alignment. A user-supplied size of 0xFFFFF001 wraps to 0, bypassing the size check and allowing acceptance of any BO. This can lead to out-of-bounds writes and GPU faults.

In the Linux kernel, the amdkfd driver has a race condition in kfd_criu_checkpoint_events(). The counting and walking of events are not protected by event_mutex, which can lead to out-of-bounds writes or use-after-free. The fix holds the mutex during both operations.

In the Linux kernel, the vmwgfx driver has a vulnerability where DX_BIND_QUERY is processed without checking for a DX context. A user can trigger a NULL pointer dereference, causing a kernel panic. The fix adds an early rejection when no DX context is present.