CVE Vulnerability Catalog

In the Linux kernel, KVM x86 has a bug where the internal request to service a pending PV EOI is not ignored if the vCPU has disabled PV EOIs since the request was made. This can lead to a kernel BUG in kvm_lapic_sync_from_vapic.

In the Linux kernel, KVM x86 has a vulnerability where the irqfd->producer pointer is not nullified if updating the IRTE for bypass fails. Leaving a dangling pointer can lead to a use-after-free if the irqfd is reachable through KVM's routing, but the producer is freed separately.

In the Linux kernel, KVM's kvm_io_bus_get_dev() returns a device matched only by address, which can cause lifetime issues if the device is not of the expected type. The fix moves the srcu lock responsibility to the caller to avoid use-after-free.

In the Linux kernel, KVM arm64 has an issue with accounting long-term memory pins for protected guests (pKVM). The fix moves the charge from the current process to the kvm's mm to avoid errors during teardown.

In the Linux kernel, KVM arm64 (nested mode) has a bogus WARN when a guest writes to the ZCR_EL2 sysreg alias in a nested context. The fix removes this warning, which could cause a hypervisor panic.

In the Linux kernel, KVM arm64 (nested mode) mapping of L1 VNCR into host stage-1 did not respect read-only PFNs. The fix caches PFN writability and constrains mapping permissions, also fixing a page leak.

In the Linux kernel, KVM arm64 (nested mode) did not re-translate the VNCR address on a page fault. The fix invalidates the VNCR TLB entry and re-fetches the translation to allow write mapping on the second attempt.

In the Linux kernel, KVM arm64 (nested mode) unconditionally used cacheable memory attributes for L1 VNCR mappings, even if the underlying PFN is not memory. The fix rejects anything that isn't normal memory to avoid SError issues.

In the Linux kernel, the fbdev metronomefb driver has a potential memory leak in metronomefb_probe(). Memory allocated for pagerefs in fb_deferred_io_init() is not freed on the error path. The fix adds a call to fb_deferred_io_cleanup().

In the Linux kernel, the fbdev broadsheetfb driver has a potential memory leak in broadsheetfb_probe(). Memory allocated for pagerefs in fb_deferred_io_init() is not freed on the error path. The fix adds a call to fb_deferred_io_cleanup().

In the Linux kernel, the fbdev hecubafb driver has a potential memory leak in hecubafb_probe(). Memory allocated for pagerefs in fb_deferred_io_init() is not freed on the error path. The fix is to call fb_deferred_io_cleanup().

In the Linux kernel, the fbdev efifb driver has a memory leak in efifb_probe(). Since commit 73ce73c30ba9, the string returned from fb_get_options() is expected to be freed by the caller, but it is not freed in efifb_probe(). The fix is to free the option string after setup.

In the Linux kernel, the fbdev radeon driver has a potential memory leak in radeonfb_pci_register(). The function allocates memory for modelist (via radeon_check_modes() which calls fb_add_videomode()). The memory is appended to info->modelist, but is not freed in subsequent error paths. The fix is to call fb_destroy_modelist().

In the Linux kernel, the fbdev i740fb driver has a potential memory leak in i740fb_probe(). Memory allocated in fb_videomode_to_modelist() for modelist is not freed in error paths. The fix is to call fb_destroy_modelist().

In the Linux kernel, the fbdev s3fb driver has a potential memory leak in s3_pci_probe(). Memory allocated for modelist using fb_videomode_to_modelist() is not freed in subsequent error paths. The fix is to call fb_destroy_modelist().

In the Linux kernel, the fbdev uvesafb driver has a potential memory leak in uvesafb_probe(). Due to an incorrect goto label, memory allocated for modedb and modelist in uvesafb_vbe_init() is not freed in some error paths. The fix is to update the goto label.

In the Linux kernel, the fbdev tdfxfb driver has a potential memory leak in tdfxfb_probe(). Memory allocated for modelist using fb_videomode_to_modelist() when CONFIG_FB_3DFX_I2C is defined is not freed in subsequent error paths. The fix is to call fb_destroy_modelist().

In the Linux kernel, the fbdev carminefb driver has a potential memory leak in alloc_carmine_fb(). Memory allocated for modelist in fb_videomode_to_modelist() is not freed in the subsequent error path. The fix is to call fb_destroy_modelist().

In the Linux kernel, the fbdev vesafb driver has a memory leak in vesafb_probe(). Since commit 73ce73c30ba9, the string returned from fb_get_options() is expected to be freed by the caller. But the string is not freed in vesafb_probe(). The fix is to free the option string after setup.

In the Linux kernel, the fbdev nvidia driver has a potential memory leak in nvidiafb_probe(). Memory allocated for modelist in nvidia_set_fbinfo() is not freed in subsequent error paths. The fix is to call fb_destroy_modelist().