CVE Vulnerability Catalog

In the Linux kernel, the media saa7164 driver's saa7164_dev_setup() adds the device to the global saa7164_devlist before requesting the PCI BAR memory regions. When get_resources() fails, the device remains on the list while the probe error path frees it, leaving a dangling entry.

In the Linux kernel, the VPE (Video Processing Engine) driver for TI platforms has a vulnerability due to missing synchronization between the FIFO overflow recovery worker and IRQ handling during stream teardown. This can lead to use-after-free of stream resources when an interrupt or worker runs after the stream is released.

In the Linux kernel, the media v4l2-ctrls module lacks validation of HEVC EXT SPS RPS counts. Decoder drivers may index beyond dynamic arrays if SPS values exceed HEVC limits (64 short-term sets, 32 long-term references) or exceed the DPB maximum.

In the Linux kernel, the media zoran driver double-frees a registered video_device. The zoran_exit_video_devices() function calls video_unregister_device() and then kfree() on the same object already freed by the zoran_vdev_release() callback.

In the Linux kernel, the scsi qla2xxx driver's qla_chk_edif_rx_sa_delete_pending() function dereferences a NULL pointer when the SCSI command has already been returned or aborted. This can lead to a kernel crash in interrupt context.

In the Linux kernel, the scsi qla2xxx driver's qla24xx_report_id_acquisition() function has a use-after-free because the virtual port is used after dropping the vport_slock without taking a reference. Concurrent qla24xx_deallocate_vp_id() can free the port, leading to memory corruption.

In the Linux kernel, the scsi qla2xxx driver's qla_nvme_fcp_abort() and qla_nvme_ls_abort() functions call INIT_WORK() before schedule_work(), which on repeated aborts of the same command can corrupt the workqueue list and lead to crashes or a looping worker.

In the Linux kernel scsi: qla2xxx driver, the queue count derived from the MSI-X vector count (msix_count - 1) is stored in a u8 field, causing truncation. With 257 MSI-X vectors the result 256 truncates to 0, and in target mode a further decrement underflows 0 to 255. When the count is 0, the allocation returns ZERO_SIZE_PTR, which is not NULL, so the check passes and the pointer is dereferenced, corrupting memory or crashing the kernel.

In the Linux kernel scsi: qla2xxx driver, qla84xx_put_chip() drops the last reference to ha->cs84xx and frees it via __qla84xx_chip_release() without clearing ha->cs84xx. During teardown it ran before scsi_remove_host(), which removes the 84xx_fw_version host sysfs attribute. A concurrent read of that attribute in the window between the two calls executes qla24xx_84xx_fw_version_show(), which dereferences the freed ha->cs84xx, resulting in a use-after-free.

In the Linux kernel, the scsi: qla2xxx driver's qla2x00_status_entry() allowed non-SCSI SRB entries into the SCSI fast path, where sp->u.scmd.cmd was dereferenced. An unexpected STATUS_TYPE IOCB for a non-SCSI handle could yield a garbage pointer and a wild pointer dereference.

In the Linux kernel, the scsi: qla2xxx driver's qla2xxx_delete_qpair() deleted the request queue before the response queue, leaving a window where the response MSI-X interrupt could dereference the freed rsp->req. This results in a use-after-free.

In the Linux kernel, the scsi: qla2xxx driver's qla24xx_report_id_acquisition() format-1 path called qla_update_host_map() without holding vport_slock, allowing races with concurrent host_map updates and btree corruption.

In the Linux kernel, the f2fs filesystem's redirty_blocks() could run an extra cleanup loop iteration when read_cache_folio() failed before pinning any folios, causing folio_put_refs(folio, 2) to drop one reference too many. This led to "BUG: Bad page state" on later drop_caches or reclaim.

In the Linux kernel, f2fs F2FS_IOC_MOVE_RANGE checks the source range but not the destination end before updating i_size. A source hole can expose this: __clone_blkaddrs() skips NULL_ADDR entries and returns success, so the caller can still extend the destination inode with unchecked pos_out + len.

In the Linux kernel, f2fs stores recovery filenames as a length plus a fixed-size i_name buffer that is not NUL-terminated, but recover_inode() and recover_dentry() print it with %s. For a 255-byte filename, recovery logging can read past i_name into the following raw inode fields.

In the Linux kernel, a race condition exists in the f2fs file system's f2fs_get_read_data_folio() function, which calls f2fs_folio_put() before folio_nr_pages() when invalidating a large folio from the page cache. This allows a concurrent truncate or folio split to shrink or free the folio before the invalidate range is computed, leading to stale xarray entries and bad page state.

In the Linux kernel, f2fs when a node block is corrupted due to checksum mismatch or inconsistent footer info, the dirty flag of the node folio needs to be cleared in order to persist inconsistent node data to storage. This operation is missing in the error path.

In the Linux kernel, f2fs_sanity_check_node_footer() is not passed the correct folio->index value, causing it to check the same nid incorrectly. This can lead to improper node consistency verification in the f2fs filesystem.

In the Linux kernel, panthor_fw_read_build_info() in the drm/panthor driver validates the metadata range using 32-bit addition (hdr.meta_start + hdr.meta_size), which can wrap and let an out-of-bounds range pass. It also reads the "git_sha: " prefix without checking metadata length, and meta_size == 0 can underflow the NULL terminator index.

In the Linux kernel, panthor_init_cs_iface() and panthor_init_csg_iface() in the drm/panthor driver validate firmware control interface offsets using 32-bit arithmetic and the size of host wrapper structures, so the arithmetic can wrap before the bounds check and the checked size does not match the actual mapped firmware control interface.