CVE Vulnerability Catalog

In the Linux kernel, range-based TLB invalidation (TLBI Range) in KVM arm64 can encode large ranges in few bits, making it easy for a guest to cause an overflow if the hypervisor naively adds the range to the base address. The fix caps the range to the limit dictated by the address bit determining the VA range, and for IPA invalidation further ignores the upper range.

In the Linux kernel, the vector[] variable declared on the stack in dmsintc_inject_irq() in KVM for LoongArch is sometimes used without initialization. The fix initializes this variable to avoid using uninitialized data.

In the Linux kernel, kvm_arch_prepare_memory_region() in KVM for LoongArch computes arch flags for a memslot only for KVM_MR_CREATE and KVM_MR_MOVE, returning early for KVM_MR_FLAGS_ONLY. Since the generic code allocates a zeroed memslot, after a KVM_MR_FLAGS_ONLY update the arch flags are cleared, potentially causing guest memory to be mapped to wrong host pages. The fix carries arch flags over from the old memslot for KVM_MR_FLAGS_ONLY.

In the Linux kernel, pch_msi_set_irq() in KVM for LoongArch passes e->msi.data directly to eiointc_set_irq() as the IRQ number without checking it against EIOINTC_IRQS. The MSI data comes from userspace (KVM_SET_GSI_ROUTING or KVM_SIGNAL_MSI), and a value >= 256 causes out-of-bounds reads and writes, allowing kernel memory corruption. The fix rejects MSI data outside the EIOINTC IRQ space.

In the Linux kernel for LoongArch, the BPF subsystem had a bug in jump offset calculation for tail calls. The old macro-based method could lead to incorrect branch offsets and soft lockups under extra JIT passes. The fix calculates the offset directly on the absolute target and adds a guard for null image.

In the Linux kernel for LoongArch, the acpi_package_ids[] array can overflow on virtual machines with many sockets. With a typical one-core-per-socket configuration, the number of sockets can reach 256, causing the array to overflow. The fix increases the array size to the maximum of MAX_PACKAGES and KVM_MAX_VCPUS.

In the Linux kernel on LoongArch, the rethook trampoline saved and restored the percpu base register ($r21) in its frame. If the task migrated to another CPU while the handler ran, the stale percpu base was restored, causing incorrect this_cpu_*() accesses and corruption of scheduler and timer state.

In the Linux kernel for LoongArch, there is a vulnerability related to break 11 handling in the context of Kprobes. A user can issue the same break instruction, causing kprobe_singlestep_handler() to be called without an active probe, leading to preempt count underflow. This may result in incorrect socket attribution to the root cgroup, bypassing BPF policies.

In the Linux kernel's CEC subsystem, there is an issue with delayed work during an interrupted transmit. If the wait for transmission is interrupted by a signal, cancel_delayed_work_sync() may run before the CEC kthread arms the work, leading to freeing data with pending work. The fix uses disable_delayed_work_sync() to cancel and disable the work, preventing re-arming.

In the Linux kernel's CEC subsystem for the Extron DA HD 4K Plus device, there is a lack of input validation that could lead to overflowing the msg.msg[] buffer when malformed data is received. The fix adds a sanity check.

In the Linux kernel's CEC subsystem, there is a serialization issue with delivering messages to the exclusive follower. cec_receive_notify() reads the follower pointer without the adapter lock, which can lead to a race with mode changes or release. The fix serializes the no-follower check and message delivery.

A vulnerability was found in the Linux kernel cx231xx media driver where format or standard changes (vidioc_s_fmt_vid_cap, vidioc_s_std) were rejected only when the video queue was busy, not the VBI queue. Since the VBI queue shares the same geometry (dev->width, dev->norm), an application could enlarge the width or switch to PAL while the VBI stream was running, causing a heap out-of-bounds write in cx231xx_do_vbi_copy().

In the Linux kernel media cx23885 driver, netup_ci_exit() frees a netup_ci_state while its work item netup_read_ci_status() may still be pending or running on the system workqueue. The worker obtains the state via container_of() and dereferences it, so it must not outlive the state.

In the Linux kernel media go7007 driver, go7007_snd_init() takes a v4l2_device reference for the ALSA side, but go7007_snd_remove() drops it immediately after calling snd_card_free_when_closed(). This is too early when a userspace process still has the capture PCM open, potentially leading to a use-after-free.

In the Linux kernel media i2c ov02a10 driver, ov02a10_check_hwcfg() calls fwnode_handle_put(ep) immediately after allocating and parsing the endpoint, but subsequently uses the same 'ep' handle in fwnode_property_read_u32(), leading to a use-after-free. Additionally, reading the optional 'ovti,mipi-clock-voltage' property overwrote the 'ret' variable, causing probe to fail entirely.

In the Linux kernel media i2c ov7740 driver, ov7740_remove() had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler that relies on that mutex, leading to a use-after-destroy kernel panic. Additionally, the driver called v4l2_ctrl_handler_free() and mutex_destroy() sequentially, then called ov7740_free_controls() which invokes both again, resulting in a double-free.

In the Linux kernel, the media platform mtk-mdp3 driver's mdp_probe() mishandles SCP device reference counting. The fallback path drops the reference obtained via __get_pdev_by_id() too early, and scp_put() later drops it again, resulting in a double reference release.

In the Linux kernel, the media rc sunxi-cir driver does not unregister the rc device on probe failures after rc_register_device() succeeds. Only rc_free_device() is called, leaving the registered rc device and its resources behind.

In the Linux kernel, the media rkvdec HEVC decoder's st_ref_pic_set_prediction() computes the reference RPS index as st_rps_idx - (delta_idx_minus1 + 1) using u8 operands. When delta_idx_minus1 + 1 exceeds the current index, the subtraction wraps and the array access at calculated_rps_st_sets[ref_rps_idx] reads far out of bounds.

In the Linux kernel, the rtl2832_sdr driver's rtl2832_sdr_start_streaming() function failed to release previously allocated DMA buffers and URB structures when allocation or submission of URBs failed. This led to a DMA memory leak and an out-of-bounds read of urb_list[] on the next streaming attempt, potentially passing garbage pointers to usb_free_urb().