CVE Vulnerability Catalog

In the Linux kernel, the drm/amd/display module's amdgpu_dm_plane_drm_plane_reset() freed the old state before allocating a new one. If kzalloc() failed, the state pointer was left dangling to freed memory.

In the Linux kernel, the drm/amd/display module's amdgpu_dm_crtc_reset_state() freed the old state before allocating a new one. If kzalloc() failed, the state pointer was left dangling to freed memory.

In the Linux kernel's dmaengine: xilinx_dma driver, a race condition existed in the AXIDMA and MCDMA interrupt handlers. The channel could be incorrectly marked idle and start spurious transfers while descriptors were still being processed, leading to descriptor corruption or missed completions.

In the Linux kernel, in the platform/chrome sensorhub module, max_response and sensor_num come from different EC commands. With malfunctioning EC firmware, the number of read bytes can be less than expected, causing an overread of the resp->fifo_info buffer in cros_ec_sensorhub_ring_handler(). The fix checks the return value of cros_ec_cmd_xfer_status() and aborts on length mismatch.

In the Linux kernel, the RDMA/irdma driver did not prevent userspace from deregistering the MRs backing QP/CQ/SRQ rings. The fix adds refcounting to user ring MRs by bumping the MR's refcount upon association.

A resource leak exists in the Linux kernel's nvmet-rdma module. When an NVMe target with RDMA transport is removed while I/Os are in flight, a response can be posted but its send completion is never delivered before the connection is torn down, so nvmet_rdma_send_done() and nvmet_rdma_release_rsp() are never called, leaking the allocated RDMA read/write context and request SGLs.

In the Linux kernel's BPF subsystem, there is a vulnerability allowing out-of-bounds memory access for MEM_ALLOC BTF pointers. During BTF struct walks, the size limit is not properly enforced for statically allocated objects, potentially leading to reads/writes beyond the allocated area.

In the Linux kernel's BPF subsystem for s390 architecture, there is an issue with the 'ly' instruction that does not zero the upper bits of a 64-bit register when loading a 32-bit value. The 'llgf' instruction should be used instead, as it correctly zeroes the upper bits.

In the Linux kernel's BPF subsystem, there is a vulnerability allowing writes through untrusted BTF pointers, bypassing the read-only policy for pointers created by helpers such as bpf_rdonly_cast(). Non-read accesses are not rejected at the common entry point.

In the Linux kernel, bpf_get_btf_vmlinux() has a race condition when publishing the parsed vmlinux BTF result. The result is published via a plain store and read locklessly, which on weakly ordered architectures could allow observing the pointer before initialized data is visible. The fix adds memory barriers (smp_store_release/smp_load_acquire).

In the Linux kernel, bpf_find_vma() reads task->mm and calls mmap_read_trylock() without holding a reference to mm_struct. For a foreign task, concurrent exit_mm() can free the mm_struct between the read and the trylock, leading to use-after-free. The fix pins the mm under task->alloc_lock and uses mmput_async(), rejecting irqs-disabled contexts and !CONFIG_MMU.

In the Linux kernel, the BPF verifier mishandles scalar ids when filling the stack with sign-extending narrowing loads. The shared scalar id is not dropped, so two registers can share the same id while holding different values, allowing the verifier to infer incorrect bounds and enabling an out-of-bounds access.

In the Linux kernel, the BPF subsystem fails to validate the rdonly_buf_size and rdwr_buf_size kfunc arguments. Values exceeding U32_MAX are not rejected but truncated when assigned to the u32 mem_size field, causing the verifier to record an incorrect memory size bound.

In the Linux kernel USB gadget UAC1/UAC2 module, configfs rate-list attributes did not validate the input length before storing values into fixed-size arrays of UAC_MAX_RATES (10) entries. Supplying more than ten rates caused an out-of-bounds write past p_srates[] or c_srates[], leading to memory corruption. Additionally, freeing the advanced strsep() cursor caused a memory leak or an interior pointer free.

In the Linux kernel, the error paths for endpoint-disabled (ESHUTDOWN) and request-allocation failure (ENOMEM) in ffs_dmabuf_transfer() of the USB gadget f_fs driver called dma_fence_put() on a fence that had only been kmalloc'd, without dma_fence_init() having been called. Calling dma_fence_put() on such an uninitialized object leads to undefined behavior. The fix replaces it with kfree().

In the Linux kernel, the error path labels in asus_wmi_add() of the platform/x86 asus-wmi driver are out of order relative to the subsystem registration sequence. As a result, failures in asus_wmi_custom_fan_curve_init() or asus_screenpad_init() skip cleanup calls for previously registered resources, leaking them. The fix reorders the labels to match the reverse order of allocations.

In the Linux kernel, bpf_cpumask_populate() writes to its destination with bitmap_copy(), but the destination is typed as struct cpumask *. This allows the verifier to accept borrowed cpumask pointers returned by read-only kfuncs (e.g., scx_bpf_get_online_cpumask()) as a writable destination. The fix changes the destination type to struct bpf_cpumask * so it follows the same ownership rule as other mutating cpumask kfuncs.

In the Linux kernel, the tracing_multi link does not set ftrace_managed, causing failure to release the tracing_multi link when attaching a tracing_multi link followed by an fentry link. This triggers a warning in bpf_trampoline_multi_detach and potential resource leaks. The fix sets 'ftrace_managed = true' in register_fentry_multi().

A flaw in the Linux kernel RDMA/rxe module causes the same packet to be reprocessed after a QP enters the error state. When a QP transitions to error while a packet is being completed (e.g. an rdma_cm disconnect racing with receive processing), the responder state machine loops and repeatedly posts the same IB_WC_SUCCESS completion, eventually dereferencing a NULL pointer and panicking the kernel. The duplicate completions are indistinguishable from real receives, breaking RC exactly-once delivery.

In the Linux kernel, esp_ssg_unref() releases page references held on the source scatterlist after the AEAD operation completes. It calls skb_page_unref() on every frag page for out-of-place transforms and in the error path of esp_output_tail(). This is wrong when the skb carries managed frags (SKBFL_MANAGED_FRAG_REFS), which are owned by a zerocopy ubuf and the skb does not hold a per-frag page reference. The missing guard causes a page reference count underflow and frees a page still in use.