CVE Vulnerability Catalog

In the Linux kernel function bpf_task_from_vpid(), there is a NULL pointer dereference when the current task is in do_exit() and its PID namespace is already cleared. cgroup_skb programs running in softirq can call this function and cause a kernel error.

In the Linux kernel, the RDMA/nldev subsystem has a locking issue when accessing the mr->pd pointer, which can change during rereg_mr. The fix uses mr->device instead of mr->pd->device and adds an rdma_restrack_sync() operation to safely access the PD restrack ID.

In the Linux kernel, the ASoC driver for AMD (acp-sdw-legacy) has an out-of-bounds read in create_sdw_dailinks(). The loop iterates over the soc_dais array, which has exactly num_ends entries, but if all are initialized, the read goes past the end of the array, as reported by KASAN.

In the Linux kernel, the ASoC driver for AMD (acp-sdw-sof) has an out-of-bounds read in create_sdw_dailinks(). The loop iterates over the sof_dais array, which has exactly num_ends entries, but if all are initialized, the read goes past the end of the array.

In the Linux kernel, the firmware_loader module has a deadlock caused by recursive locking in device_cache_fw_images(). During suspend or hibernation preparation, fw_pm_notify() calls this function, which holds fw_lock while iterating over devices. If memory allocation for the async work fails, the work is executed synchronously, leading to a recursive acquisition of fw_lock and a deadlock.

In the Linux kernel, the configfs filesystem has an issue with lockless traversals of ->s_children. Having the parent directory locked protects entries from removal by another thread, but it does not protect cursors from being moved around by lseek() or freed.

In the Linux kernel, the watchdog subsystem has an issue with PM notifier registration. watchdog_register_device() registers wdd->pm_nb, but watchdog_unregister_device() does not remove it, leaving an embedded notifier block on the PM notifier chain. Later suspend/resume notifications can call watchdog_pm_notifier() with a stale watchdog_device pointer.

In the Linux kernel, the iommufd subsystem has an ordering issue when detaching from dmabuf. The mutex could still be in use through the dmabuf invalidation callbacks, so the pages content should not be destroyed until the dmabuf is fully detached.

In the Linux kernel, the is_vm_area_hugepages() function has a bug where it does not check the return value of find_vm_area(), which can return NULL for an invalid address. This leads to a NULL pointer dereference and kernel crash.

In the Linux kernel, the mt76 WiFi driver (model mt7921) has a resource leak in the probe error path. When pcim_iomap_region() or devm_kmemdup() fails, the code returns directly without cleaning up previously allocated resources, such as mt76_device and PCI IRQ vectors.

In the Linux kernel, the mt76 WiFi driver has a use-after-free issue in mt76_put_vif_phy_link(). The function frees the offchannel mlink with kfree(), but rcu_assign_pointer does not wait for existing RCU readers who may still hold the pointer. The TX path can dereference freed memory.

In the Linux kernel, the mt7925 driver's mt7925_tm_query() function copies data from the firmware response without checking its length. If the response is shorter than the expected 520 bytes, an out-of-bounds read occurs, and the extra data is returned to userspace. A length check was added before the copy.

In the Linux kernel, the mt7996 driver's mt7996_tx_prepare_skb() function may leak transmission tokens if the link_conf or link_sta lookup fails. The token is allocated before the check and is not released on error. The fix releases the token in case of error.

In the Linux kernel, the mt7996 driver's mt7996_mac_write_txwi_80211() function may dereference a NULL pointer when a frame is injected (e.g., via radiotap), because mac80211 can pass info->control.vif = NULL. A check for the vif pointer was added before calling ieee80211_vif_is_mld().

In the Linux kernel, the __btrfs_run_delayed_refs() function of the Btrfs filesystem has an invalid pointer dereference. When btrfs_select_ref_head() returns -EAGAIN, the locked_ref variable remains an error pointer and is then used in spin_lock(), leading to dereferencing an invalid address. The fix resets locked_ref to NULL and increments the counter to avoid looping.

In the Linux kernel, the sm501fb driver has errors in the OF binding code: use-after-free, buffer overrun, and memory leaks. EDID data is not freed on error, and when both CRT and PANEL are enabled, data is used after being freed and freed twice. Additionally, the string from of_get_property is copied without length checking. The fix uses kstrdup() and frees memory before freeing info.

In the Linux kernel, the Btrfs filesystem on zoned disks has a deadlock during data relocation. The relocation process waits on a space reservation ticket that can never be fulfilled because the relocation itself is responsible for freeing that space. The fix introduces a new flush state that uses priority_reclaim_data_space() instead of the normal path to avoid the deadlock.

A vulnerability in the Linux kernel's Btrfs filesystem causes a deadlock when cloning inline extents while the filesystem is mounted with the flushoncommit option. The previous fix only covered the case where the destination offset is 0, missing offsets greater than zero. The issue was reported by syzbot and manifests as processes blocked for over 143 seconds.

In the Linux kernel, the ixgbe driver vulnerability involves calling netif_set_xps_queue() for XDP Tx queues that are not netdev-exposed. On systems with >=64 CPUs and E610 adapter, XDP configuration results in 64 XDP queues while max queue pairs is 63, causing a warning and KASAN report (slab-out-of-bounds). The fix skips XPS configuration for XDP Tx queues.

In the Linux kernel, the NFSD server's nfsd4_drop_revoked_stid() function does not handle the SC_TYPE_LAYOUT case, causing that when a client sends FREE_STATEID for an admin-revoked layout stid, the stid is not removed from the list or freed. The fix removes the layout stid from the list and calls nfs4_put_stid() to drop the reference.