CVE Vulnerability Catalog

In the mcp2221 HID driver, mcp_i2c_smbus_read() stored a buffer pointer in mcp->rxbuf but never cleared it after the transfer completed. A delayed or spurious MCP2221_I2C_GET_DATA report could write data into freed memory.

In the Linux kernel, the intel-quickspi HID driver does not validate the report size before copying it into the report_buf heap buffer. The buffer is sized from the device descriptor (max_report_len), but the report length coming from a hidraw ioctl is unbounded, allowing a buffer overflow with attacker-controlled data.

In the Linux kernel, quickspi_get_report() in the intel-quickspi HID driver copies the entire device response into the caller's buffer without checking its length. A response larger than the caller's buffer overflows it with device-controlled content.

In the Linux kernel, the fs/ntfs3 driver does not validate the dirty page table during log replay. A crafted DIR_PAGE_ENTRY with an invalid lcns_follow field lets the v0->v1 conversion and later replay passes run off the entry.

In the Linux kernel, ni_read_frame() in fs/ntfs3 trusts decompress_lznt()'s return value, which may be smaller than the frame size. Unwritten bytes remain in the vmapped pages and are returned to userspace, disclosing uninitialized kernel memory.

In the Linux kernel, the copy_lcns and redo shorten loops in fs/ntfs3 index page_lcns[] based on the log record's lcns_follow, which is not checked against the target entry. A crafted record can overflow page_lcns[] of an otherwise valid entry.

In the Linux kernel, ecryptfs_exorcise_daemon() dropped queued messages from a dying daemon without holding ecryptfs_msg_ctx_lists_mux, but ecryptfs_msg_ctx_alloc_to_free() requires that lock. This created a race with other users of the global message context list.

In the Linux kernel, ecryptfs_parse_packet_set() calculated the remaining packet buffer size as PAGE_SIZE - 8, even though for version 1 headers the packet set starts later in the header. This could overstate the available buffer and lead to parsing errors.

In the Linux kernel, parse_tag_3_packet() fails to bound encrypted_key_size against ECRYPTFS_MAX_KEY_BYTES (64). When encrypted_key_size exceeds 64, decrypt_passphrase_encrypted_session_key() performs two out-of-bounds writes, corrupting the ecryptfs_auth_tok and ecryptfs_crypt_stat structures. Only AES-192 (cipher code 0x08) triggers this because it sets crypt_stat->key_size = 24 independently of encrypted_key_size.

In the Linux kernel, ecryptfs_parse_tag_70_packet() subtracted fixed metadata fields from the parsed packet body size to derive the encrypted filename size. A malformed packet with a body smaller than those fixed fields could underflow that size calculation.

In the Linux kernel, ecryptfs_send_message_locked() moved a message context from the free list to the allocated list before sending the request to the userspace daemon. If ecryptfs_send_miscdev() failed, the context was left on the allocated list and could not be reused.

In the Linux kernel, in the erofs filesystem, z_erofs_gbuf_nrpages is advanced only after every global buffer has been grown. If a resize fails after some buffers were enlarged, a retry revisits those enlarged buffers, which can lead to allocation errors or pointer array overflow.

In the Linux kernel, ext2_setsize() and ext2_xattr_set2() contained a construct that for IS_SYNC inodes called sync_inode_metadata() instead of marking the inode dirty. Since sync_inode_metadata() only acts if the inode is already dirty, inode updates could be lost.

A use-after-free vulnerability exists in the Linux kernel's fanotify subsystem regarding file range information. A pointer to the range position stored on the triggering task's stack is saved in a heap-allocated permission event, and when a signal interrupts the triggering task, the stack frame is unwound while the event reader still dereferences that pointer. This causes a stale stack value to be copied to userspace.

In the Linux kernel's fbdev omapfb panel-dsi-cm driver, the ddata->lock mutex is initialized after the display is registered. Once omapdss_register_display() publishes the display, another consumer can invoke a dsicm callback that takes this uninitialized mutex. This can lead to improper operation or a crash.

In the Linux kernel's fbdev uvesafb driver, uvesafb_init() registers the v86d connector callback before registering the platform driver. If platform_driver_register() fails, the function returns the error without unregistering the connector callback, leaving it registered. The later platform-device failure path already performs this unregistration.

In the Linux kernel forcedeth driver, the loops in nv_suspend() and nv_resume() use 'i <= register_size/sizeof(u32)', causing one extra iteration and an out-of-bounds access to the saved_config_space array. On VER3 devices the last iteration reads past the array and, on resume, performs an MMIO write one dword past the mapped register window. The bug is reported by UBSAN and, with CONFIG_UBSAN_TRAP=y, traps and aborts the running kernel code.

In the Linux kernel's hsi omap_ssi_core driver, the OMAP SSI driver uses a synthetic HSI controller device allocated via hsi_alloc_controller(), which does not go through the normal OF/platform device initialization path. As a result, the embedded struct device does not have a DMA mask initialized by default. After recent DMA API hardening changes, dma_map_sg() and related helpers require a valid dma_mask, otherwise the driver may crash or trigger warnings.

In the Linux kernel's hugetlb subsystem, __unmap_hugepage_range can adjust reservations since commit df7a6d1f6405. When a folio is mapped in both a parent and a child, and the parent unmaps the range first, the reservation adjustment causes an underflow of the reserved count. Once the child unmaps the range, the count is restored. The fix checks the mapcount before adjusting the reservation.

In the Linux kernel, the ghes_handle_arm_hw_error() function (ACPI APEI GHES) reduces the remaining length by sizeof(err) (pointer size) instead of sizeof(*err) (structure size) after skipping the cper_sec_proc_arm header. This overestimates the bytes left for cper_arm_err_info records and can cause the parser to read past the CPER section when err_info_num is large enough.