CVE Vulnerability Catalog

In the Linux kernel, vfio_ap_mdev_set_kvm() sets kvm->arch.crypto.pqap_hook before acquiring update locks and checking for a conflicting assignment. On error, it returns -EPERM without restoring the hook pointer, leaving a stale pointer that can lead to a use-after-free when a guest executes a PQAP instruction.

In the Linux kernel, vfio_ap_config_remove used bitmap_andnot to clear bits from the matrix_mdev->matrix.adm bitmap, which prevented explicitly unplugged control domains from being removed from the KVM guest. The fix replaces bitmap_andnot with bitmap_and.

In the Linux kernel, vfio_ap_mdev_hot_unplug_cfg() relied on the return value of bitmap_andnot() to decide whether to update the guest APCB. When the resulting bitmap was empty, the function returned false, so the update was skipped and the KVM guest retained stale hardware access to unplugged AP devices.

In the Linux kernel, the AFS v2 parser uses footer[8] to locate the image information block within the erase block, then uses region_count to walk entries in a fixed local array. The footer offset and region count come from flash contents and were not validated before use.

In the Linux kernel batman-adv module, fragment reassembly reuses the skb from the highest-numbered buffered fragment, and if the interface it was received on is deleted before the chain completes, the merged packet can re-enter the receive path with a stale skb->dev and skb_iif. This can lead to use of a freed net_device. The fix refreshes the receive device metadata before running packet handlers.

A vulnerability in the Linux kernel was found, involving an out-of-bounds read in the clock driver for Amlogic GXBB platforms. The issue stems from a hard-coded number of parents for the gxbb_32k_clk_sel clock, which is inconsistent with the actual count, leading to a KASAN error during clock registration. The fix uses ARRAY_SIZE instead of a hard-coded value.

In the Linux kernel, the ASoC loongson driver's loongson_card_parse_acpi() ignores the return value of device_property_read_string() for the `codec-dai-name` property. If the property is missing or invalid, an uninitialized pointer is used later, potentially leading to undefined behavior.

In the Linux kernel, in the IIO buffer subsystem, an anonymous buffer handle holds a reference to the underlying IIO device, which is dropped in the buffer handle's release function. If the device has been removed (unbind or hot-unplug), the buffer handle might hold the last reference. The release function takes the mutex for the buffer using a guard, so the unlock happens after iio_device_put(), which might free both the IIO device and the buffer containing the mutex, leading to use-after-free when the mutex is unlocked.

In the Linux kernel, in the IIO buffer subsystem, the iio_dma_fence implementation uses kfree() to free the dma_fence object, which violates the dma_fence documentation requiring RCU-safe freeing. This might result in a use-after-free.

In the Linux kernel, in the IIO buffer subsystem, the iio_dma_fence implementation uses a lock embedded in iio_dmabuf_priv, but iio_dma_fence can outlive iio_dmabuf_priv, causing a use-after-free. The fix ties the lifetime of the lock to the lifetime of the fence by embedding them in the same struct.

In the Linux kernel, in the IIO chemical atlas-sensor driver, the driver requests its hardware data-ready IRQ with devm_request_threaded_irq(); its threaded handler queues an irq_work, atlas_work_handler(), that calls iio_trigger_poll(data->trig). Since the IRQ is devm-managed, free_irq() runs after atlas_remove() without flushing that irq_work, so a pending irq_work can run after the unwind has freed atlas_data/indio_dev and the trigger, causing a use-after-free when atlas_work_handler() dereferences data->trig.

In the Linux kernel, KVM nVMX does not flush vpid02 on first use because last_vpid is not reset when vpid02 is freed on VMXOFF. This can lead to the use of stale TLB entries from a previous lifetime of the VPID, associated with a different vCPU or VM.

In the Linux kernel, KVM nVMX may execute INVVPID on a different physical CPU than the one L2 is running on. This can lead to TLB entries not being invalidated on the correct CPU if L1 migrates between CPUs.

In the Linux kernel KVM (x86/mmu) subsystem there is a use-after-free in the rmap aging path. If a writer populates the rmap between the lock's read and the iterator's re-read, the lockless aging path walks the newly installed rmap without holding its lock. This can cause a writer to free the pte_list_desc chain via kmem_cache_free() while the walk is in progress, resulting in a slab use-after-free.

A flaw exists in the Linux kernel's KVM x86 Hyper-V synthetic timer emulation. When a guest or userspace sets the timer COUNT to a value close to U64_MAX, the deadline calculation can overflow and cause the timer to fire immediately, resulting in a CPU livelock and RCU stall reports.

In the Linux kernel, KVM for s390 has an issue with not holding srcu when importing watchpoint data. __import_wp_info() reads guest memory, which requires holding kvm->srcu to avoid a race with memslot updates, potentially leading to use-after-free.

In the Linux kernel, KVM for s390 has a memory corruption vulnerability due to reinjecting CK machine checks. Channel-subsystem damage machine checks should not be forwarded to the guest, and reinjecting them can lead to kfree of a stack variable.

In the Linux kernel, KVM for s390 has an issue with reading gmap->asce without holding mmu_lock in the keyop operation. Other functions read this field inside the mmu_lock read-side, but keyop does not, which can lead to using a stale value and memory corruption.

In the Linux kernel, vgic_v3_save_pending_tables() in KVM arm64 iterates over dist->lpi_xa without holding a reference to the vgic_irq structures, relying only on temporary RCU coverage. A concurrent path can free the LPI, leading to a dangling pointer dereference after the RCU grace period. The fix re-fetches each LPI via vgic_get_irq() and drops it with vgic_put_irq().

In the Linux kernel, vgic_its_save_ite() in KVM arm64 unconditionally dereferences ite->collection, which can be NULL after a MAPC with V=0. A guest issuing MAPD, MAPTI, then MAPC(V=0) can cause a host kernel oops when the VMM issues KVM_DEV_ARM_ITS_SAVE_TABLES for migration. The fix saves a zeroed entry, which is read back as invalid on restore.