CVE Vulnerability Catalog

In the Linux kernel, the virtio-gpu driver accesses uninitialized data during driver removal or unbinding when KMS is disabled, causing a kernel crash.

A bug in the Rust compiler causes the -Cforce-unwind-tables=y flag to emit the uwtable annotation only for functions, not for the module. This leads to incorrect DWARF information for KASAN constructors, resulting in boot failures when CONFIG_UNWIND_PATCH_PAC_INTO_SCS is enabled.

A vulnerability in the Linux kernel's KVM caused false positive WARN messages when marking a page as dirty while the VM is dying. This primarily affects SEV-ES guests where KVM keeps a writable mapping of a guest page across an exit to userspace and attempts to unmap it upon vCPU destruction, triggering the warning.

In the Linux kernel pinctrl mcp23s08 driver, a NULL pointer dereference vulnerability occurs during probe due to uninitialized mcp->dev and mcp->addr fields before regmap initialization. This leads to a system crash.

In the Linux kernel, a vulnerability was found in the KASAN VMAP stack shadow handling on ARM architecture. Using ldr instead of ldrb for dummy shadow read causes an alignment fault on ARMv5, leading to a system crash before init.

In the Linux kernel for ARM64, the pagetable_dtor() call was missing when freeing hot-removed page table pages. This caused bad page states, PTL allocation leaks, and incorrect NR_PAGETABLE statistics.

A use-after-free (UAF) vulnerability was found in the Linux kernel's may_decode_fh() function in the fhandle mechanism. It occurs due to an unlocked read of mount::mnt_ns, allowing concurrent unmounting and freeing of the mount namespace, leading to access to freed memory.

In the Linux kernel i2c-imx driver, a clock and pinctrl state inconsistency was found in runtime PM. If pinctrl sleep state transition fails, the clock remains disabled, causing a system crash on subsequent hardware access.

In the Linux kernel i2c-qcom-cci driver, a NULL pointer dereference occurs during driver removal when the CCI controller has two I2C masters but only one is initialized. Calling cci_halt() on the uninitialized master causes a kernel crash.

In the Linux kernel, the airoha network driver lacks a NULL check for of_reserved_mem_lookup(). If the 'memory-region' node in the device tree (DTS) is misconfigured or removed, the function returns NULL and its result is directly dereferenced, causing a NULL pointer dereference and kernel panic.

In the Linux kernel bonding driver, a NULL pointer dereference vulnerability exists in bond_do_ioctl(). The slave_dbg() call before the NULL check for slave_dev causes a kernel panic when a non-existent slave interface is used via ioctl.

A vulnerability in the Linux kernel's nvmem driver for ONIE-TLV layouts causes an infinite loop hang when encountering an unknown entry type (e.g., 0x41). The fix ensures offset incrementation for unknown types to break the loop.

In the Linux kernel, the DAMON_LRU_SORT module has a vulnerability due to missing error handling for damon_ctx allocation. The damon_lru_sort_enabled_store() function assumes allocation always succeeds, leading to a NULL pointer dereference when allocation fails.

In the Linux kernel, a vulnerability in DAMON_RECLAIM causes a NULL pointer dereference when damon_ctx allocation fails, as damon_reclaim_enabled_store() assumes the allocation always succeeds. This can lead to system crashes.

In the Linux kernel, mincore_swap() incorrectly checked the !CONFIG_SWAP guard before handling non-swap entries (migration, hwpoison, shmem errors). This caused spurious WARN messages and incorrect reporting of pages as non-resident on !CONFIG_SWAP builds with CONFIG_MIGRATION or CONFIG_MEMORY_FAILURE enabled.

In the Linux kernel's slimbus qcom-ngd-ctrl driver, callbacks are registered before the NGD structure is fully initialized. When remoteproc starts in parallel with NGD driver probing, these callbacks may operate on uninitialized data, causing system crashes.

In the Qualcomm slimbus driver (qcom-ngd-ctrl), a potential deadlock was found due to an ABBA locking order between tx_lock and ctrl->lock. During SSR/PDR down notification, tx_lock is acquired before ctrl->lock, while other code paths take them in reverse order, leading to a possible system hang.

In the Linux kernel, an out-of-bounds read vulnerability was found in the AMD/Display driver in the dp_get_eq_aux_rd_interval() function. The aux_rd_interval array in struct dc_lttpr_caps has 7 elements, but the offset parameter can be 8 when a sink reports 8 LTTPR repeaters, causing a read beyond allocated memory.

In the Linux kernel, the AMD/Display driver has a vulnerability in the dal_vector_reserve() function where uint32_t arithmetic can overflow, causing a small buffer allocation and subsequent heap overflow. The fix replaces krealloc() with krealloc_array() which includes overflow detection.

A WARN warning was triggered in the Linux kernel's scx_cgroup_move_task() function during task migration by the sched_ext scheduler. The issue occurs when systemd modifies subtree_control and cgrp_moving_from is NULL, which is a legitimate scenario, not a bug. The patch removes this warning while preserving the correct pairing of ops.cgroup_prep_move() and ops.cgroup_move() calls.