CVE Vulnerability Catalog

In the Linux kernel's iommu/vt-d subsystem, the Present bit is not cleared before tearing down a scalable-mode context entry, creating a window where hardware can fetch a torn entry, leading to unpredictable behavior or spurious faults. The issue affects device_pasid_table_teardown(), which was not aligned with a previous fix.

In the Linux kernel's sun4i-ss driver, the insecure and unused RNG algorithm (sun4i_ss_rng) was removed. It had multiple vulnerabilities including missing locking, buffer overflow, and improper random byte generation. Since no users are known, the code was removed instead of fixed.

In the Linux kernel's uvcvideo driver, a deadlock occurs when uvc_status_stop is called from async_ctrl.work, causing a wait for a work item that is waiting for itself, leading to a system hang.

In the Linux kernel's rxrpc subsystem, lack of synchronization between rxrpc_kernel_charge_accept and socket teardown can lead to use-after-free. A concurrent rxrpc_discard_prealloc can free the rxrpc_backlog structure while a preallocation worker still uses it.

In the Linux kernel's rxrpc subsystem, rxrpc_verify_data does not always allocate the rx_dec_buffer, which can lead to a call to skb_copy_bits with a NULL destination and a NULL pointer dereference. The fix ensures allocation is always attempted when the buffer is NULL.

In the Linux kernel's rxrpc subsystem, when reading an OOB message with MSG_PEEK, the message is moved to the pending_oobq queue even though it should not be removed from the queue. This leads to double-free and use-after-free, potentially causing memory corruption.

In the Linux kernel's rxrpc subsystem, rxgk_issue_challenge() frees the page containing the challenge content after invoking the tracepoint, but the whdr pointer passed to the tracepoint points into the just-freed page, leading to use-after-free.

In the Linux kernel's rxrpc subsystem, rxrpc_recvmsg() does not drop the reference it holds on an already-released call when MSG_PEEK is in force, leading to a memory leak.

In the Linux kernel's rxrpc subsystem, rxrpc_recvmsg() may enter an infinite loop because the wait does not check the OOB queue. The fix adds a check for the OOB queue in the wait loop.

A vulnerability was found in the Linux kernel's rxrpc subsystem, involving improper handling of ACKALL packets. A forged ACKALL packet can be accepted for a new server call in an invalid state, leading to a NULL pointer dereference and system crash.

In the Linux kernel, the rxrpc subsystem fixed an issue with receiving a reply packet before data transmission. The function rxrpc_receiving_reply() did not check if the call had been exposed, which could lead to an oops in rxrpc_rotate_tx_window(). Additionally, the do...while loop was changed to a while loop to handle an empty transmission queue.

In the Linux kernel, the rxrpc subsystem fixed a double unlock in rxrpc_recvmsg() when handling OOB messages.

In the Linux kernel, the AFS subsystem fixed a netns teardown issue to cancel the preallocation charger. afs_charge_preallocation() skips charging when net->live is false, and afs_rx_new_call() avoids requeuing the charger.

In the Linux kernel, the AFS subsystem fixed a NULL pointer dereference in afs_get_tree(). When ctx->dyn_root is not null, as->cell and as->volume are null, and trace_afs_get_tree() dereferences them.

In the Linux kernel, the AFS subsystem fixed handling of CB.InitCallBackState3 requests without a server record. It checks whether a server record was attached, and if not, the request is ignored, matching existing behavior for other unmatched callback requests.

In the Linux kernel, the fbcon subsystem fixed a NULL pointer dereference for a console without vc_data. fbcon_new_modelist() assumed a console with a mode set has vc_data, which is not always true. The fix keeps the mode only while vc_data exists.

In the Linux kernel, the accel/amdxdna driver fixed a memory leak when pinning ubuf pages. When pin_user_pages_fast() returns fewer pages than requested, previously pinned pages are not released. The fix unpins partially pinned pages before returning failure.

In the Linux kernel, the drm/rockchip inno-hdmi driver fixed a use-after-free issue. The internal structure containing the encoder was allocated with devm_kzalloc(), and during encoder cleanup via drmm_encoder_alloc_release(), accessing the freed structure caused an error. The fix switches to drmm_kzalloc().

In the Linux kernel, the drm/rockchip dw_dp driver fixed a use-after-free issue. The internal structure containing the encoder was allocated with devm_kzalloc(), and during encoder cleanup via drmm_encoder_alloc_release(), accessing the freed structure caused an error. The fix switches to drmm_kzalloc().

In the Linux kernel, the drm/gpusvm subsystem failed to reject VMAs marked with VM_IO or VM_PFNMAP when creating SVM ranges. Such regions are not backed by struct page, causing repeated get_pages() failures and potentially leading to an infinite loop in a driver's page-fault handler.