CVE Vulnerability Catalog

In the tridentfb driver in the Linux kernel, a potential memory leak was detected in trident_pci_probe(). Memory allocated for the modelist using fb_videomode_to_modelist() is not freed in error paths. The issue is fixed by calling fb_destroy_modelist().

In the Linux kernel, a memory leak was found in ASoC SOF topology in snd_sof_load_topology. When the topology filename contains "dummy" and tplg_cnt is 0, the function returns -EINVAL without freeing the memory allocated by kcalloc() for tplg_files. The fix sets ret = -EINVAL and jumps to the out label, which handles kfree(tplg_files).

In the Linux kernel, a heap overflow was found in ASoC SOF ipc3-control in bytes_ext put/get. The ipc_control_data buffer is allocated as kzalloc(max_size), but bounds checks compared user data lengths directly against max_size, ignoring the offset of cdata->data. This allowed writing up to sizeof(struct sof_ipc_ctrl_data) bytes past the end of the heap buffer from unprivileged userspace via the ALSA TLV kcontrol interface, and similarly allowed over-reading adjacent heap data. The fix subtracts sizeof(*cdata) from max_size in all bounds checks.

In the Linux kernel, a missing size validation was found in ASoC SOF ipc3-control in snd_sof_update_control. The firmware-provided cdata->num_elems is checked against local_cdata->data->size but never against the actual allocation size. If local_cdata->data->size was previously set to an inconsistent value, the memcpy could write past the allocated buffer. The fix adds a bounds check to ensure num_elems fits within the available space in the ipc_control_data allocation.

In the Linux kernel, a missing check of pm_runtime_get_sync() return value was found in ASoC mediatek mt8192 during probe. If runtime resume fails, probe continues without the device necessarily being accessible, and the PM usage count may remain incremented. The regmap_reinit_cache() error path also returns before dropping the temporary PM reference and clearing pm_runtime_bypass_reg_ctl. The fix uses pm_runtime_resume_and_get() and clears the flag after dropping the PM reference.

In the Linux kernel, a missing release of reserved memory was found in ASoC mediatek mt8192 during cleanup. The probe calls of_reserved_mem_device_init() and falls back to preallocated buffers when no reserved memory region is available. When the reserved memory assignment succeeds, however, the driver never releases it. The fix registers a devm cleanup action after a successful assignment so the assignment is released on probe failure and driver unbind.

In the Linux kernel, a missing release of reserved memory was found in ASoC mediatek mt8183 during cleanup. The probe can assign reserved memory with of_reserved_mem_device_init(), but the assignment is never released on driver removal or later probe failures. The fix registers a devm cleanup action so the reserved memory assignment is released consistently, matching newer Mediatek AFE drivers.

In the Linux kernel, a NULL pointer dereference was found in ASoC qcom q6apm in graph_callback. When q6apm_free_fragments() is called, it frees rx_data.buf/tx_data.buf and sets them to NULL under graph->lock. A late DSP buffer-done response can race with this: graph_callback() passes the !graph->ar_graph guard (not yet NULL), acquires the lock, but then dereferences a now-NULL buf pointer, crashing. The fix adds a NULL check for buf inside the mutex-protected section in both write-done and read-done handlers.

In the Linux kernel, a bug was found in netfilter xt_cluster where template conntracks are treated as fully initialized in hash match. xt_cluster_mt() treats any non-NULL nf_ct_get() result as a fully initialized conntrack and passes it to xt_cluster_hash(). Templates carry IPS_TEMPLATE status but do not have a valid tuple for hashing yet, so xt_cluster_hash() can hit its WARN_ON() path on the zeroed l3num field. The fix rejects template conntracks before hashing them.

In the Linux kernel, an issue was found in netfilter nf_queue regarding pinning the bridge device while NFQUEUE holds a fake dst. The br_netfilter fake rtable is embedded in struct net_bridge and attached to bridged packets with skb_dst_set_noref(). If such a packet is queued to NFQUEUE, __nf_queue() upgrades that fake dst with skb_dst_force(). The fix keeps the bridge fake dst model unchanged and pins the bridge master device only while the packet sits in NFQUEUE, recording the bridge device in nf_queue_entry and taking a device reference for the queue lifetime.

In the Linux kernel, the nft_fib netfilter module has a NULL pointer dereference vulnerability when a fib expression is used in a netdev egress base chain. Validation incorrectly accepts the egress hook, leading to a system crash.

In the Linux kernel, the nf_conntrack_sip netfilter module lacks validation of skb_dst() before accessing it. When routing information is unavailable (e.g., in tc ingress or openvswitch), a crash may occur.

In the Linux kernel, the nft_set_pipapo netfilter module has a vulnerability that leaks a bad clone into a future transaction. Memory allocation failure can lead to out-of-bounds writes during subsequent operations.

In the Linux kernel, the nf_nat_sip netfilter module has a vulnerability due to a stale data pointer after buffer reallocation. This can lead to packet header corruption.

In the Linux kernel, the nf_conntrack_reasm netfilter module has a vulnerability due to an incorrect mac_header adjustment after IPv6 defragmentation. This can lead to incorrect reporting of a MAC header presence.

In the Linux kernel, the netfilter flowtable module has a vulnerability due to using the route from the opposite direction when pushing the IPIP header. This can lead to incorrect headroom calculation and field settings.

In the Linux kernel, the netfilter flowtable module has a vulnerability that causes a crash during IPIP tunnel transmission with direct xmit. The lack of dst_entry leads to invalid dst usage and can trigger a crash.

In the Linux kernel, the netfilter nf_conncount module has a vulnerability in the tuple deduplication logic due to incorrect zone comparison. Passing the zone direction bitmask as the direction argument causes different zones to be treated as equal, leading to incorrect connection counting and bypass of connlimit limits.

This CVE has been rejected or withdrawn by its CVE Numbering Authority.

In the Linux kernel, the gpu: host1x module has a device reference leak in the error path of host1x_device_parse_dt(). The object is freed directly with kfree instead of put_device(), leading to a leak.