CVE Vulnerability Catalog

In the Imagination DRM driver in the Linux kernel, a deadlock occurs during soft reset because disable_irq() is called from the IRQ handler context, causing a self-wait.

In the Linux kernel, the DRM driver for Imagination GPUs lacks interrupt synchronization before GPU suspend. The runtime PM suspend callback does not check if the IRQ handler is running on another CPU core and does not wait for it to finish. This can cause kernel crashes when trying to access GPU registers after suspension.

In the Linux kernel, in the drm/amdgpu driver, a limit of 128k entries per BO list has been introduced to prevent resource exhaustion. Userspace could pass an arbitrary number of entries, leading to excessive memory allocation and long processing times.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the i915/DMC driver during initialization. The issue occurs when intel_dmc_update_dc6_allowed_count() is called before DMC initialization, potentially causing a system crash (oops).

In the Linux kernel, in the btrfs filesystem, a bug has been found in logging new dentries when logging the parent directory of a conflicting inode. If the parent directory is later fsynced without new changes, new dentries may be lost after a power failure.

In the Linux kernel, in the soc: microchip: mpfs driver, a memory leak has been detected in the mpfs_sys_controller_probe() function. If of_get_mtd_device_by_node() fails, the function returns without freeing the allocated memory for sys_controller, leading to a memory leak.

In the qbman driver for Freescale SoCs in the Linux kernel, a race condition in qman_destroy_fq can trigger a false WARN_ON when creating a queue with QMAN_FQ_FLAG_DYNAMIC_FQID set.

In the Linux kernel, in the ROSE protocol, there is a NULL pointer dereference in rose_transmit_link on reconnect. When rose_connect() is called a second time while the first connection is in progress (TCP_SYN_SENT), it overwrites rose->neighbour, and if rose_get_neigh() returns NULL, the socket is left with rose->neighbour == NULL. Closing the socket leads to a NULL pointer dereference. A check for TCP_SYN_SENT is missing.

A race condition was found in the Linux kernel's power management runtime (PM runtime). The pm_runtime_work() function may dereference the dev->parent pointer after the parent device has been freed, leading to a use-after-free. The fix adds a flush_work() call in pm_runtime_remove().

In the Linux kernel, the aqc111 driver (net: usb) calls a power management (PM) function in its suspend callback, leading to a task hung in rpm_resume. The issue occurs when aqc111_suspend calls the PM variant of its write_cmd routine, causing a wait for a status change that never happens, blocking another task holding rtnl_lock and the entire networking stack.

In the Linux kernel, in the ACPI processor module, a previous fix for acpi_processor_errata_piix4() introduced a use-after-free issue. Device pointers may be dereferenced after dropping references to the device objects. Additionally, debug messages about enabling errata may be printed when errata flags are unset. The fix moves message printing to the points where errata flags are set.

In the Linux kernel, SRv6 IPv6 paths lack NULL checks for the idev pointer returned by __in6_dev_get(). This can lead to a NULL pointer dereference when a network device has no IPv6 configuration.

In the mlx5e driver in the Linux kernel, a race condition exists when accessing the ASO context for IPsec because the spinlock is released before WQE completion, allowing overwriting of the shared DMA context.

In the Linux kernel, the udp_sock_create6 function returns success (0) without creating a socket when CONFIG_IPV6 is disabled. This leads to a NULL pointer dereference in callers like fou_create, causing a kernel crash.

In the Linux kernel's mvpp2 driver for Marvell PP2/CP11X, a NULL pointer dereference vulnerability exists. The mvpp2_bm_switch_buffers() function unconditionally calls flow control update without checking if the CM3 SRAM resource is available, causing a kernel panic on MTU changes.

In the Linux kernel's network shaper mechanism, there is a race condition between Netlink operations and network device unregistration. This can lead to a shaper hierarchy leak if the hierarchy is created after a flush has already run.

A bug was found in the Linux kernel's PMU (Performance Monitoring Unit) handling for AMD EPYC processors. The issue is that the event pointer setup in x86_pmu_enable() occurs too late, leading to a race condition and a NULL pointer dereference in the NMI (Non-Maskable Interrupt) handler. This results in a kernel crash.

In the Linux kernel arm_mpam driver, a null pointer dereference occurs when restoring memory bandwidth counters. When an MSC is brought offline and online, mpam_restore_mbwu_state() does not set mbwu_arg.val, causing a kernel oops.

In the Amlogic SPI driver (amlogic-spisg) in the Linux kernel, a memory leak occurs in aml_spisg_probe(). After allocating a controller via spi_alloc_target() or spi_alloc_host(), several error paths fail to call spi_controller_put().

In the vmwgfx graphics driver (for VMware) in the Linux kernel, a memory leak occurs due to overwriting the surface dirty tracker in KMS mode.