CVE Vulnerability Catalog

In the Linux kernel, the dm-verity module's error counter was not atomic, which could lead to race conditions. As a result, the call to dm_audit_log_target("max-corrupted-errors") may be skipped. The fix makes the counter atomic.

In the Linux kernel, the dma_fence_dedup_array() function returns 1 when called with a count of 0, which contradicts the documentation and may lead to dereferencing an uninitialized pointer in amdgpu_userq_wait_*(). The fix makes the function return 0 for an empty array.

In the Linux kernel, the dma-buf/dma-fence module has a potential NULL pointer dereference due to incorrect ordering of operations on weakly ordered platforms. The fix replaces the signaled-bit check with synchronization on the ops pointer.

In the Linux kernel, the accel/amdxdna module has a use-after-free bug in amdxdna_gem_dmabuf_mmap(). When vm_insert_pages() fails, the error path calls close, which releases the GEM object, and then the code releases it again, leading to access to freed memory. The fix returns directly from close_vma.

In the Linux kernel accel/amdxdna driver, amdxdna_cmd_submit() calls the cmd_submit pointer without checking if it is defined. For AIE4 devices (aie4_vf_ops) this pointer is NULL, leading to a NULL function-pointer call via the AMDXDNA_EXEC_CMD ioctl and a kernel oops. The fix rejects the submission with -EOPNOTSUPP when the device provides no cmd_submit op.

In the Linux kernel accel/amdxdna driver, amdxdna_drm_submit_execbuf() passes the user-supplied command BO handle without validating it. When the handle is AMDXDNA_INVALID_BO_HANDLE (0), the command is submitted with a NULL cmd_bo, leading to a NULL pointer dereference in the DRM scheduler worker and a kernel oops. The fix rejects the invalid handle for user submissions.

In the Linux kernel accel/amdxdna driver, amdxdna_drm_sync_bo_ioctl() for SYNC_DIRECT_FROM_DEVICE passes the BO's client pointer to amdxdna_hwctx_sync_debug_bo() instead of the ioctl file's client. This causes the wrong client to be used as the handle namespace and hardware context owner, potentially leading to synchronization errors. The fix passes filp->driver_priv instead.

In the Linux kernel accel/ivpu driver, fw_log_from_bo() does not check that the log size is at least the header size. When the log is smaller, fw_log_print_buffer() computes data_size with an underflow, leading to reads far past the small real data region of the BO. A size of 0 also causes infinite looping. The fix rejects logs whose size is smaller than the header.

In the Linux kernel scsi: hpsa driver, on the IOACCEL2 reset path there is a DMA mapping leak. When phys_disk->in_reset is set, the function returns without undoing the resources acquired for the command. The fix adds the missing cleanup: unmapping the SG chain, unmapping the SCSI command, and dropping the outstanding IOACCEL command count.

In the Linux kernel scsi: lpfc driver, in lpfc_sli4_driver_resource_setup() there is a memory leak. The memory allocated for mboxq using mempool_alloc() is not freed in some early exit error paths. The fix moves the mempool_free() call earlier, after last use.

In the Linux kernel scsi: xen: scsiback driver, on the TMR submit-failure path there is a command tag leak. When target_submit_tmr() returns an error, the jump to the err label sends a response but frees nothing. The fix uses a helper that returns just the tag.

In the Linux kernel scsi: xen: scsiback driver, on error paths before command submission, there is a double-put of se_cmd with refcount 0, leading to refcount underflow and tag leak. The fix adds a helper that just returns the tag and sends the error response.

A vulnerability in the Linux kernel SCSI target subsystem affects parsing of PERSISTENT RESERVE OUT buffers. The TransportID parser was not given the buffer length, allowing out-of-bounds reads via a malformed iSCSI identifier. It is reachable through any fabric delivering PR OUT to an iSCSI TPG, including vhost-scsi.

A use-after-free vulnerability was found in the Linux kernel's SCSI target subsystem, affecting the REGISTER AND MOVE operation in Persistent Reserve Out. The issue arises from using a pointer to a mapped buffer after it has been unmapped, potentially leading to reads from freed memory.

In the Linux kernel, in the SCSI elx efct driver, a reference leak was detected in efct_hw_io_abort(). When request tag allocation fails, the error path returns -ENOSPC without releasing the reference obtained earlier via kref_get_unless_zero(), causing a permanent reference leak on the io_to_abort object. Additionally, the abort_in_progress flag remains set to true, blocking future abort attempts for the same I/O.

In the Linux kernel, in the SCSI elx efct driver, an I/O leak was detected in efct_dispatch_fcp_cmd(). The function allocates an efct_io before dispatching an unsolicited FCP command, but if the command has an unsupported additional CDB, it returns -EIO without freeing the allocated I/O.

In the Linux kernel, a use-after-free vulnerability was found in the resctrl subsystem during unmount. A concurrent reader of a monitoring event file may access already freed memory because the RDT_DELETED flag is not set for the default resource group. The fix sets this flag unconditionally and prevents remounting when there are pending readers.

In the Linux kernel, in the Input ims-pcu driver, a use-after-free and double-free vulnerability was detected in ims_pcu_disconnect(). The function relies on the interface class to distinguish between control and data interfaces, which could be exploited by a malicious device to cause premature cleanup and potential use-after-free or double-free.

In the Linux kernel, in the Input ims-pcu driver, there is a lack of validation of the control endpoint type. The driver assumes that the first endpoint is an interrupt IN endpoint without verification. A malicious device could provide a different endpoint type, potentially leading to kernel warnings or undefined behavior.

In the Linux kernel, in the Input ims-pcu driver, a memory leak was detected in the async update function. The firmware object was not being released if validation failed. The fix uses __free(firmware) to ensure the firmware is always released.