CVE Vulnerability Catalog

In the Linux kernel, the spi: atcspi200 driver initializes DMA resources after SPI controller registration. During driver unbind, a use-after-free can occur when DMA is torn down while the controller is still alive and triggers DMA transfers.

In the Linux kernel, the hfsplus filesystem has a duplicate dirty marking of the attribute inode, leading to a null-ptr-deref during setxattr when the attributes file is not loaded during mount.

In the Linux kernel, the wifi: rtw89 driver's AER handlers (io_error_detected and io_resume) retrieved the pointer stored by pci_set_drvdata() as a net_device, while it was actually an ieee80211_hw pointer. This caused operations on wrong offsets of the structure.

In the Linux kernel, the wifi: rtw88 driver's AER handlers (io_error_detected and io_resume) retrieved the pointer stored by pci_set_drvdata() as a net_device, while it was actually an ieee80211_hw pointer. This caused operations on wrong offsets of the structure.

A vulnerability in the Linux kernel's rtw89 WiFi driver causes an infinite loop during 6 GHz band scanning. A data type error for the scan index leads to CPU soft lockup and system panic.

In the Linux kernel, the rtw88 driver (PCIe) lacks validation of the data size received from firmware, which can lead to an out-of-bounds read from the DMA buffer. An attacker could exploit this to disclose kernel memory.

In the Linux kernel, the rtw89 driver lacks a bounds check on the mac_id field from firmware, which can lead to an out-of-bounds array access. An attacker could exploit this to leak kernel memory.

In the Linux kernel, the ath9k driver lacks a bounds check on the qid field from firmware, which can lead to an out-of-bounds array access. An attacker could exploit this to leak kernel memory.

A vulnerability in the Linux kernel's ath11k Wi-Fi driver can cause a kernel crash during reboot if it overlaps with firmware crash recovery (SSR). The issue is a NULL pointer dereference in the MHI teardown path while freeing DMA contexts. It affects PCI/MHI-based devices only.

In the Linux kernel, vxlan_gro_prepare_receive() has a potential null pointer dereference when sk_user_data is set to NULL during execution. This could lead to a system crash.

In the Linux kernel, the OPP subsystem has a race between adding and looking up entries, which can lead to refcount corruption and premature free. An attacker could exploit this to crash the system.

In the Linux kernel, snp_filter_reserved_mem_regions() has an off-by-one error that can lead to a heap buffer overflow. An attacker could exploit this to execute code in the kernel.

In the Linux kernel, __snp_alloc_firmware_pages() lacks proper error checking for page allocation, which can lead to dereferencing an invalid pointer. An attacker could exploit this to crash the system.

In the Linux kernel, the atmel-sha204a driver has a bug in the blocking and non-blocking RNG logic, causing it to fail to provide valid entropy. This can weaken cryptographic security.

In the Linux kernel, the DLM module has an issue with the ordering of message handles in the send_queue, which can lead to refcounting issues and use-after-free. An attacker could exploit this to crash the system.

In the Linux kernel, BPF functions bpf_set_dentry_xattr and bpf_remove_dentry_xattr did not check if inode is NULL, leading to NULL pointer dereference with negative dentries. Added NULL check and return -EINVAL. Also removed WARN_ON warnings that could cause DoS with panic_on_warn enabled.

In the Linux kernel, evm_read_xattrs() did not initialize the buffer, leading to out-of-bounds read by strlen() when no xattrs are configured. The fix explicitly terminates the buffer, uses snprintf(), and passes the actual length to simple_read_from_buffer().

In the Linux kernel, addrconf_dad_failure() in IPv6 could overwrite DEAD state with ERRDAD, leading to use-after-free and system crash. The fix checks the state before transitioning to ERRDAD and performs operations in a single critical section.

In the Linux kernel, in the mlx5_ib driver, mlx5_ib_alloc_transport_domain() leaked the allocated transport domain when mlx5_ib_enable_lb() returned an error. The fix adds deallocation of TD on error, explicit return 0 in the no-loopback-capability branch, and moves lb mutex initialization to mlx5_ib_stage_init_init().

In the Linux kernel, in the RDMA/mlx5 driver, mlx5r_umr_update_xlt() leaked the XLT buffer and DMA mapping when mlx5_odp_populate_xlt() returned an error, and also left the emergency mutex locked. The fix breaks out of the loop to execute the common cleanup path.