CVE Vulnerability Catalog

In the Linux kernel, the last error path in rtl_pci_probe() skips cleanup functions due to a wrong goto label. Additionally, successful calls to rtl_init_rfkill(), ieee80211_register_hw(), and rtl_debug_add_one() are not reverted.

In the Linux kernel, mhi_register_controller() adds the controller device before creating the optional trigger_edl sysfs file. If sysfs_create_file() fails, the error path only drops the device reference and leaves the device registered.

In the Linux kernel, REQ_NOWAIT support in md personalities that can block internally is fundamentally incomplete. For writes, one mirror may succeed while another returns -EAGAIN, so md cannot distinguish queue pressure from a real device failure, potentially leaving mirrors with divergent data.

In the Linux kernel, ath12k_wmi_mac_phy_caps_parse() allocates the mac_phy_caps buffer as tot_phy_id * len, where len is clamped, but memcpy() advances the destination by the full struct size per slot. When firmware sends short TLVs, the second and later slots are written past the end of the allocation.

In the Linux kernel, ath11k_wmi_tlv_mac_phy_caps_parse() allocates the mac_phy_caps buffer as tot_phy_id * len, where len is clamped, but memcpy() advances the destination by the full struct size per slot. When firmware sends short TLVs, the second and later slots are written past the end of the allocation.

In the Linux kernel, bpf_link_show_fdinfo and bpf_link_get_info_by_fd access link->prog without holding any locks. If the prog is concurrently replaced via bpf_link_update, the old prog can be freed, leading to a potential use-after-free (UAF). The fix accesses link->prog under RCU protection.

In the Linux kernel, the iommu/dma non-blocking, non-coherent allocation path uses dma_alloc_from_pool(), which returns the allocated page and fills cpu_addr only on success. The code relies on cpu_addr to detect allocation failure, which is incorrect. The fix checks the returned page directly before using it for IOMMU mapping.

In the Linux kernel, swiotlb_alloc_tlb() can allocate from the DMA atomic pool when a decrypted pool is needed from atomic context. With CONFIG_DMA_DIRECT_REMAP, the atomic pool uses remapped virtual addresses that differ from direct-map addresses. swiotlb_init_io_tlb_pool() reconstructs the virtual address from the physical address, storing the wrong address in pool->vaddr for atomic-pool allocations, causing swiotlb_free_tlb() to fail.

In the Linux kernel, the sgi-gru driver removes dangerous page-table walks performed in interrupt context. The GRU TLB miss handler previously walked page tables without proper locking, potentially leading to races and security issues.

In the Linux kernel, the mt76 driver fixes handling of channel context switches with different bands in mt76_switch_vif_chanctx. Previously, rapid switches on different radios could cause incorrect behavior.

In the Linux kernel, the mt792x driver has a use-after-free vulnerability in mt76_rx_poll_complete due to a race condition. The wcid pointer may reference an already removed STA, causing invalid memory access.

In the Linux kernel, the wifi mt76 driver for mt7921 chips lacked PCIe AER error handling. When an AER error occurs and the bus hangs, register reads return 0xFFFFFFFF, corrupting the DMA queue state and causing an invalid memory access (q->desc[] or q->entry[]) and a system crash. The fix validates the DMA index read from hardware, checks the bus_hung flag before reset, rejects MCU messages while the bus is hung, and installs no-op bus operations after an unrecoverable AER error.

In the mt7915 driver, there is an underflow when calculating the number of spatial streams. If the MCS map has no supported streams, the function returns 255, which is written into the firmware's beamforming fields.

In the mt76 driver, there is a race in RXDMAD_C buffer recycling. These buffers come from page pools tied to a different NAPI, so direct recycling can race with the owning NAPI, leading to errors.

In the Linux kernel, mt7996_mac_reset_work() in the mt76 wifi driver (mt7996) parked the tx worker and disabled the RX/TX NAPIs before taking dev->mt76.mutex. Since mt76_worker_disable()/_enable() are plain kthread park/unpark, not refcounted, and __mt76_set_channel() toggles the same worker and the MT76_RESET bit under the mutex, an L1 SER racing a channel switch could leave the worker unparked and MT76_RESET cleared while the reset path resets the DMA rings, corrupting descriptors or tokens.

In the Linux kernel, btf_distill_func_proto() accepts function arguments up to 16 bytes, so a 128-bit scalar such as __int128 reaches the x86 trampoline with arg_size == 16. The current implementation assumes an __int128 argument only needs one register, so the register save area is under-allocated and save_args() overwrites adjacent stack slots.

In the mt76 wifi driver (mt7915), the TWT flow is added to dev->twt_list before sending the agreement to the firmware, but the error path leaves it linked while flowid_mask is never set. The flow slot can then be reused and memset while still on the list, corrupting twt_list, and station removal leaves a dangling entry behind.

In the mt76 wifi driver (mt7915), after mt7915_register_ext_phy() succeeded, a failure of the main PHY mt7915_init_debugfs() or mt7915_coredump_register() unwound through free_phy2, which called ieee80211_free_hw() on the ext PHY hw while it was still registered with mac80211, since mt76_unregister_device() only unregisters the main hw.

In the Linux kernel for arm64, the ptrace subsystem has an issue with keeping 'orig_x0' in sync with x0 on syscall entry. A previous fix failed to update 'orig_x0' during SECCOMP_RET_TRACE, allowing a tracer to modify the syscall argument without being subjected to seccomp or audit checking.

In the Linux kernel's cfg80211 there is a missing stop of PMSR measurements before tearing down P2P and NAN interfaces. Functions cfg80211_stop_p2p_device() and cfg80211_stop_nan() do not call cfg80211_pmsr_wdev_down(), which can leave stale requests in the driver and cause inconsistencies.