CVE Vulnerability Catalog

In the Linux kernel, the Microchip SPI FPGA driver's mpf_ops_parse_header() reads one byte before the buffer start when header_size is zero. This can lead to out-of-bounds memory read.

In the Linux kernel, the SPI-NOR (mtd) driver has an issue with unlocking the first blocks of flash memory. When a user tries to unlock only the locked blocks, the operation fails due to incorrect lock_len calculation.

In the Linux kernel for the OpenRISC architecture, there is a jump_label SMP syncing issue. Incorrect icache invalidation on remote cores can cause static keys to remain stale after updates.

In the Linux kernel, the irqchip/crossbar driver's crossbar_domain_free() uses a nulled hwirq as index, failing to free the correct entry and keeping the crossbar register connection active. This can lead to interrupt mapping errors.

In the Linux kernel, the TPM SPI driver (tpm_tis_spi) uses wait_event_interruptible_timeout() in wait_for_tmp_stat(), which can trigger a warning with CONFIG_DEBUG_ATOMIC_SLEEP. The fix uses wait_woken() and checks the condition only while the task is running.

In the Linux kernel, the TPM driver (tpm2-sessions) function tpm_buf_append_salt() calls asynchronous KPP operations without setting a completion callback and immediately frees the request, leading to use-after-free. The issue occurs automatically during entropy polling.

In the Linux kernel, the function rpc_sysfs_xprt_switch_add_xprt_store() allocates the xprt_create_args structure on the stack without initialization, which can lead to kernel panic, information leak, or unpredictable behavior due to uninitialized fields.

In the Linux kernel, the Tegra DMA driver (dmaengine) incorrectly calculates burst size, which can cause DMA transfers to hang when the transfer length is not a multiple of the max burst size. The fix reduces burst size to the largest power-of-2 that evenly divides the transfer length.

In the Linux kernel dw-edma driver, the DONE_INT_MASK and ABORT_INT_MASK registers are shared by all DMA channels, and modifying them requires a non-atomic read-modify-write sequence. This can lead to race conditions when two channels call dw_edma_v0_core_start() concurrently. A spinlock has been added to serialize access to these registers.

In the Linux kernel dw-edma-pcie driver, dw_edma_pcie_probe() treats the PCI device ID driver_data as the template for the controller layout and copies it unconditionally. A device bound dynamically via sysfs can match the driver without that data, leading to a NULL pointer dereference.

In the Linux kernel rz-dmac driver, the interrupt is requested before full initialization, which can lead to invalid memory access because the interrupt handler may access uninitialized data. The fix moves interrupt requests after setup is complete and uses dmam_alloc_coherent().

In the Linux kernel intel/tpmi driver, the mem_write() function did not release the temporary array returned by parse_int_array_user() on all exit paths. The fix uses cleanup.h scope-based cleanup to free it automatically.

In the Linux kernel dell-laptop driver, dell_init() does not clean up all resources if LED or backlight registration fails. The fix adds missing cleanup calls before returning an error.

In the Linux kernel ISST driver, after resume, SST-PP control is only restored to power domain 0, even though values are stored for all domains. The fix uses pd_info->sst_base instead of power_domain_info->sst_base.

In the Linux kernel i2c-imx driver, the atomic (polling) path rejects an SMBus block read with a byte count of 0 as -EPROTO, but does not send NACK+STOP, causing the I2C bus to lock up. The fix handles count 0 as a valid empty block read and releases the bus.

In the Linux kernel i2c-imx driver, the interrupt-driven path rejects an SMBus block read with a byte count of 0 as -EPROTO, but does not send NACK+STOP, causing the I2C bus to lock up. The fix accepts count=0 and sends NACK and STOP.

In the Linux kernel i2c-mlxbf driver, mlxbf_i2c_init_resource() frees tmp_res before reading tmp_res->io, leading to a use-after-free. The fix saves the error code before freeing.

A vulnerability was found in the Linux kernel's tcp_connect() function related to TCP and MD5 authentication. In one code branch, the tcp_md5sig_info structure and tcp_md5sig_key entries are freed without respecting the RCU grace period, causing a race condition with softirq readers. This leads to a use-after-free of MD5 key memory.

In the Linux kernel, the xen/gntdev driver has an error handling issue in the ioctl function. When copying the result to userspace fails, the reference to the mapping is not released, causing a memory leak and a dangling list entry. Additionally, the mapping index may be modified, so it must be retrieved after gntdev_add_map() completes.

In the Linux kernel, the xfrm module has a double-free issue in nat_keepalive_send(). When the IPv4 or IPv6 helper reports an error, the keepalive packet is freed, but if the packet has already been handed to the network stack, it may be freed again, leading to unsafe operation.