CVE Vulnerability Catalog

In the Linux kernel, there is a race between a partial drm_dev_register() failure and an ioctl. If registration fails after a minor is registered, userspace may have entered a drm_dev_enter() critical section, and since the unplugged flag was never set, the ioctl proceeds while the error path tears down device resources.

In the Linux kernel DRM/AMD Display subsystem, the per-plane degamma LUT size is not validated, potentially leading to divide-by-zero or out-of-bounds read. The issue affects the AMD_PLANE_DEGAMMA_LUT property, only available when built with AMD_PRIVATE_COLOR.

In the Linux kernel DRM/AMDGPU VCN subsystem, an integer overflow was found in the buffer count check of the dec_msg message. A crafted value can bypass the bounds check and cause an out-of-bounds read.

A flaw in the Linux kernel's drm/ttm subsystem occurs when ttm_pool_restore_and_alloc() successfully completes the restore process via ttm_pool_restore_commit(), but fails to drop tt->restore afterward. As a result, subsequent backup/restore flows incorrectly perceive the restore as complete while shmem handles remain installed in tt->pages, leading to a stack trace and potential memory corruption.

In the Linux kernel DRM/AMDGPU subsystem, an out-of-bounds access to the adev->isolation[] array was found for rings not assigned to a partition. The index AMDGPU_XCP_NO_PARTITION (value ~0) causes access beyond the array, triggering UBSAN warnings.

In the Linux kernel DRM/AMDKFD subsystem, a TLB flush is missing after MES queue eviction/suspension, potentially leading to a race condition and page faults during SVM memory migration.

In the Linux kernel, the drm/amdkfd driver had an error-path bug in svm_migrate_copy_to_ram. When page migration from device to system RAM fails, the driver used a DMA address instead of the page physical address (pfn) to release and unlock allocated system pages, which is incorrect with IOMMU enabled. The fix releases pages based on struct page* and performs dma_unmap on the corresponding system RAM pages.

In the Linux kernel, the drm/amdkfd driver had a bug when the migration VM range is a hole on the CPU side (MIGRATE_PFN_MIGRATE set, MIGRATE_PFN_VALID unset). The driver still allocated device pages, and an uninitialized variable r could trigger out_free_vram_pages to drop all just-set-up VRAM. The fix initializes r and only calls the final svm_migrate_copy_memory_gart if j > 0.

In the Linux kernel, the drm/sysfb (ofdrm) driver had an integer overflow in the framebuffer size calculation fb_size = linebytes * height. With large values (e.g., 46341 * 46341), the int * int multiplication causes undefined behavior. The fix uses check_mul_overflow() to detect and prevent the overflow.

A bug was fixed in the Linux kernel's drm/pagemap module in the drm_pagemap_migrate_populate_ram_pfn() function. Higher-order folio allocations lacked the __GFP_NOWARN flag and a fallback path, and in the free_pages error path the folio order was computed after put_page() had already dropped the reference, leading to a use-after-free. The source page array construction was also corrected to ensure full copying after demotion to order-0 folios.

In the Linux kernel, the drm/nouveau/dmem driver had a mismatched DMA unmap size for large folios. Device-private THP migration maps buffers with page_size() and records that length, but two teardown sites passed a literal PAGE_SIZE to dma_unmap_page(), leaking part of the IOMMU/IOVA mapping for order > 0 folios. The fix uses the saved size.

In the Linux kernel, the drm/nouveau driver's nouveau_channel_del() tore down the fence context before unsubscribing the channel-kill event. A narrow window allowed nouveau_fence_context_kill() to run on an already freed fence context, causing a use-after-free. The fix unsubscribes before tearing down dependent structures.

In the Linux kernel, the drm/nouveau/uvmm driver had a premature region free on failed OP_UNMAP_SPARSE. Two failure paths left op->reg set, causing cleanup to remove and put a region the job never created, leading to a use-after-free. The fix clears op->reg on both failure paths.

In the Linux kernel, the bpf_get_stackid function requires disabled preemption for the get_perf_callchain call and while accessing its returned trace entries buffer. The bpf_get_stackid_pe function already executes with preemption disabled. Failure to disable preemption in bpf_get_stackid may lead to data consistency issues.

A vulnerability in the Linux kernel PCI subsystem affecting s390 systems using a machine-level hypervisor has been resolved. The shared pci_slot assignment for multifunction devices caused the hotplug driver to reset the wrong function and leak memory. A flag was added to allow per-function PCI slots for hypervisor-managed functions.

The lack of signature verification of firmware update packages in VEO and VEO-XS Wi-Fi monitors prior to version 01.48.001 allows an attacker who controls the delivery of an update to install unauthorized firmware.

Kong API Gateway Enterprise has a JWT signature verification vulnerability in MCP OAuth2 and DataKit components. Improper validation of the signing algorithm allows an unauthenticated attacker to craft a forged JWT that is incorrectly accepted as valid.

In the Linux kernel, ublk_ch_mmap() rejects mmap requests with VM_WRITE set but never clears VM_MAYWRITE on the resulting read-only mapping. This allows a userspace daemon to mmap the per-queue command buffer PROT_READ, then upgrade it to PROT_WRITE via mprotect(). The command buffer holds kernel-written struct ublksrv_io_desc entries, so a writable mapping lets an unprivileged daemon process corrupt fields such as addr, op_flags, nr_sectors, and start_sector.

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via import_string, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments with the Kafka event producer enabled build that client inside the scheduler process, so a user whose only privilege is editing Airflow connections gains arbitrary code execution in the control plane. Deployments using Google Managed Kafka are not affected because that code path overwrites any user-supplied oauth_cb.

Lack of TLS certificate validation when downloading firmware updates in VEO and VEO-XS Wi-Fi monitors (versions prior to 01.48.001) allows an attacker to perform man-in-the-middle attacks on the update channel.