CVE Vulnerability Catalog

In the Linux kernel, in the power: supply: lp8727 driver lp8727_release_irq() cancels pchg->work before freeing the IRQ, so an IRQ delivered in between can re-arm the work through the threaded handler. After .remove returns, the devm layer frees pchg while lp8727_delayed_func() may still run and dereference it. The fix frees the IRQ first, then cancels the work.

In the Linux kernel, the qcom_battmgr driver's qcom_battmgr_sc8280xp_strcpy() copies firmware strings without guaranteeing a terminator when the firmware does not use Pascal-style strings. Fields model_number, serial_number, and oem_info may lack a null terminator, causing out-of-bounds reads when printed to userspace.

In the Linux kernel, the rt9455 power supply driver contains a use-after-free bug. During driver removal (rt9455_remove), delayed works are cancelled in the wrong order — batt_presence_work can queue max_charging_time_work after it has been cancelled, causing a dereference of the freed rt9455_info structure. The issue also occurs in the probe error path when rt9455_hw_init() fails after the IRQ has been requested.

In the Linux kernel on s390, the MVIY_PERCPU() macro generates an assembler macro invocation with whitespace-separated quoted arguments, which older binutils (before 2.39) misparse, skipping the mviy instruction. As a result, the interrupted per-CPU sequence is not marked in lowcore and the exception return path cannot repair the per-CPU address register after migration.

In the Linux kernel, the s390/dasd driver's dasd_default_erp_postaction() copies timing and device state from the finished ERP request back to the original request but drops proc_bytes. A partially completed request (an ESE read of a not-yet-allocated track returns fewer bytes than requested) that is then recovered through the ERP chain loses its partial-completion length, so __dasd_cleanup_cqr() sees proc_bytes == 0 and completes the whole request instead of requeueing the remainder, silently returning zeroed data for the part that was never read.

In the Linux kernel, the iommu/msm driver's msm_iommu_probe() adds its devm-managed IOMMU object to qcom_iommu_devices before adding the IOMMU sysfs device and registering it with the IOMMU core. If iommu_device_sysfs_add() or iommu_device_register() fails, the object remains on qcom_iommu_devices while the driver core releases the devm allocation, leaving a dangling list entry that later list walks may dereference.

In the Linux kernel, the iommu/tegra241-cmdqv driver's tegra241_vintf_init_vsid() programs the guest-provided vSID into SID_MATCH, whose VIRT_SID field spans bits [20:1] with bit 0 as the match-enable flag, so the hardware matches only a 20-bit Stream ID. The bound check rejects only virt_sid > UINT_MAX, admitting a value far wider than the field; the write "virt_sid << 1 | 0x1" then drops every bit above 20, so a virt_sid of 0x80000000 lands as SID_MATCH = 0x1, a valid match on vSID 0, aliasing the wrong Stream ID. Because vdev->virt_id is guest-controlled, a VMM can trigger it.

In the Linux kernel, the IOMMUFD selftest TRIGGER_IOPF borrows an attach handle from group->pasid_array without synchronizing against PASID detach, so a concurrent iommu_report_device_fault() can dereference a freed handle, causing a UAF. The fix adds an iopf_rwsem in mock_dev for synchronization.

In the Linux kernel, isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() use the user-provided level as an index into perf_levels[] without validation, allowing out-of-bounds reads. The fix adds bounds checks and rejects disabled SST-PP levels.

In the Linux kernel, isst_if_clos_assoc() validates socket_id with '>' instead of '>=', allowing indexing past the sst_inst[] array; additionally, a missing NULL check for unbound packages leads to a NULL dereference. The fix rejects socket_id >= topology_max_packages() and NULL sst_inst.

In the Linux kernel, the mmc via-sdmmc driver does not cancel carddet_work on device removal; already queued work can run after the host is freed, causing a use-after-free. The fix cancels carddet_work after freeing the IRQ and before cancelling finish_bh_work.

In the Linux kernel, the mmc via-sdmmc driver registers and enables the card-detect interrupt before mmc_add_host(); if mmc_add_host() fails, the interrupt stays registered and runs against the freed host, causing a use-after-free. The fix adds a probe-error path that disables and frees the interrupt and cancels carddet_work.

In the Linux kernel, the panasonic-laptop driver has an out-of-bounds write past the pcc->sinf[] array. The function acpi_pcc_retrieve_biosdata() writes a sentinel value at index equal to the SINF package count, which when num_sifr equals that count results in a one-element overflow (a silent 4-byte heap overflow). This occurs on hardware where HKEY.SQTY returns 37 and HKEY.SINF()'s package has 38 elements.

In the Linux kernel, the platform/chrome sensorhub driver did not validate the EC-reported sensor number (in->sensor_num) in cros_ec_sensorhub_ring_handler(). A value equal to or greater than sensor_num caused an out-of-bounds read and write of the batch_state[] array.

In the Linux kernel, the platform/x86/amd/pmc driver's amd_stb_s2d_init() discarded the return values of several S2D SMU commands and the S2D_PHYS_ADDR_LOW/HIGH values. On failure the physical address was left uninitialized and passed to devm_ioremap(), potentially mapping physical address 0.

In the Linux kernel, the platform/x86/amd/pmc driver's amd_pmc_probe() registered the LPS0 s2idle handler and created the debugfs directory before calling amd_stb_s2d_init(). When the latter failed, the error path did not unregister the handler or remove the debugfs directory, leading to list corruption and a kernel BUG on module reload.

In the Linux kernel, the platform/x86 hp-bioscfg driver's hp_get_string_from_buffer() clamped the converted string length against the destination buffer size using "size > dst_size". When the length equaled dst_size, the unconditional NUL terminator write landed one byte past the destination buffer.

In the Linux kernel's platform/x86 hp-bioscfg module, the per-type ACPI package parsers were handed the wrong element count — instead of the validated obj->package.count they derived it from the NAME field (an ACPI_TYPE_STRING), effectively reading string.length through the acpi_object union. This is safe today because hp_init_bios_package_attribute() rejects packages with fewer elements than the type requires, but an upcoming relaxation of that check would cause an out-of-bounds heap read. The fix forwards the validated obj->package.count to every parser.

In the Linux kernel, io_waitid_cb() in the io_uring subsystem does not honor the tw.cancel flag when the fallback task_work path runs from a kworker thread. This causes __do_wait() to be called in the wrong task context, potentially leading to incorrect waitid behavior.

A use-after-free vulnerability exists in the Linux kernel's icc_get() and of_icc_get_by_index() functions. When memory allocation for path->name fails, the error path calls kfree(path) without removing the path's requests from the req_list, leaving dangling pointers that can be dereferenced later. The fix replaces kfree(path) with icc_put(path) and ensures the icc_lock mutex is released before calling icc_put().