CVE Vulnerability Catalog

In the Linux kernel, the iommu/tegra241-cmdqv driver's tegra241_vintf_init_vsid() programs the guest-provided vSID into SID_MATCH, whose VIRT_SID field spans bits [20:1] with bit 0 as the match-enable flag, so the hardware matches only a 20-bit Stream ID. The bound check rejects only virt_sid > UINT_MAX, admitting a value far wider than the field; the write "virt_sid << 1 | 0x1" then drops every bit above 20, so a virt_sid of 0x80000000 lands as SID_MATCH = 0x1, a valid match on vSID 0, aliasing the wrong Stream ID. Because vdev->virt_id is guest-controlled, a VMM can trigger it.

In the Linux kernel, the IOMMUFD selftest TRIGGER_IOPF borrows an attach handle from group->pasid_array without synchronizing against PASID detach, so a concurrent iommu_report_device_fault() can dereference a freed handle, causing a UAF. The fix adds an iopf_rwsem in mock_dev for synchronization.

In the Linux kernel, isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() use the user-provided level as an index into perf_levels[] without validation, allowing out-of-bounds reads. The fix adds bounds checks and rejects disabled SST-PP levels.

In the Linux kernel, isst_if_clos_assoc() validates socket_id with '>' instead of '>=', allowing indexing past the sst_inst[] array; additionally, a missing NULL check for unbound packages leads to a NULL dereference. The fix rejects socket_id >= topology_max_packages() and NULL sst_inst.

In the Linux kernel, the mmc via-sdmmc driver does not cancel carddet_work on device removal; already queued work can run after the host is freed, causing a use-after-free. The fix cancels carddet_work after freeing the IRQ and before cancelling finish_bh_work.

In the Linux kernel, the mmc via-sdmmc driver registers and enables the card-detect interrupt before mmc_add_host(); if mmc_add_host() fails, the interrupt stays registered and runs against the freed host, causing a use-after-free. The fix adds a probe-error path that disables and frees the interrupt and cancels carddet_work.

In the Linux kernel, the panasonic-laptop driver has an out-of-bounds write past the pcc->sinf[] array. The function acpi_pcc_retrieve_biosdata() writes a sentinel value at index equal to the SINF package count, which when num_sifr equals that count results in a one-element overflow (a silent 4-byte heap overflow). This occurs on hardware where HKEY.SQTY returns 37 and HKEY.SINF()'s package has 38 elements.

In the Linux kernel, the platform/chrome sensorhub driver did not validate the EC-reported sensor number (in->sensor_num) in cros_ec_sensorhub_ring_handler(). A value equal to or greater than sensor_num caused an out-of-bounds read and write of the batch_state[] array.

In the Linux kernel, the platform/x86/amd/pmc driver's amd_stb_s2d_init() discarded the return values of several S2D SMU commands and the S2D_PHYS_ADDR_LOW/HIGH values. On failure the physical address was left uninitialized and passed to devm_ioremap(), potentially mapping physical address 0.

In the Linux kernel, the platform/x86/amd/pmc driver's amd_pmc_probe() registered the LPS0 s2idle handler and created the debugfs directory before calling amd_stb_s2d_init(). When the latter failed, the error path did not unregister the handler or remove the debugfs directory, leading to list corruption and a kernel BUG on module reload.

In the Linux kernel, the platform/x86 hp-bioscfg driver's hp_get_string_from_buffer() clamped the converted string length against the destination buffer size using "size > dst_size". When the length equaled dst_size, the unconditional NUL terminator write landed one byte past the destination buffer.

In the Linux kernel's platform/x86 hp-bioscfg module, the per-type ACPI package parsers were handed the wrong element count — instead of the validated obj->package.count they derived it from the NAME field (an ACPI_TYPE_STRING), effectively reading string.length through the acpi_object union. This is safe today because hp_init_bios_package_attribute() rejects packages with fewer elements than the type requires, but an upcoming relaxation of that check would cause an out-of-bounds heap read. The fix forwards the validated obj->package.count to every parser.

In the Linux kernel, io_waitid_cb() in the io_uring subsystem does not honor the tw.cancel flag when the fallback task_work path runs from a kworker thread. This causes __do_wait() to be called in the wrong task context, potentially leading to incorrect waitid behavior.

A use-after-free vulnerability exists in the Linux kernel's icc_get() and of_icc_get_by_index() functions. When memory allocation for path->name fails, the error path calls kfree(path) without removing the path's requests from the req_list, leaving dangling pointers that can be dereferenced later. The fix replaces kfree(path) with icc_put(path) and ensures the icc_lock mutex is released before calling icc_put().

In the Linux kernel, ipmb_write() in the IPMI driver read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes, and a length smaller than the SMBus header underflows the block write length.

In the Linux kernel, ipmi_add_smi() creates the nr_users and nr_msgs files before trying to create the maintenance_mode file. If that last creation fails, the error path removes only nr_users before dropping the final reference to the interface, leaving the nr_msgs sysfs attribute registered in the freed interface.

In the Linux kernel, if an error occurs during startup of an IPMI interface, it may have scheduled work to run. The work needs to be canceled before the interface can be freed, which was missing in the ipmi:msghandler module.

In the Linux kernel, afiucv_hs_rcv() (net/iucv) selected an AF_IUCV socket based solely on four 8-byte name fields in the transport header, without checking the ingress net_device. This allowed a frame arriving on any netdev, including one in another network namespace, to be delivered to an AF_IUCV socket. The fix skips any socket whose hs_dev does not match the ingress device.

A use-after-free vulnerability exists in the Linux kernel's SLIP driver within the sl_sync() function. The slip_devs[] array stores bare net_device pointers without taking references, and entries are freed outside rtnl_lock() protection, allowing access to freed memory during slip_open().

In the Linux kernel, tun_get_user() in the TUN/TAP driver uses tun->align both as skb headroom and to decide how much packet data to keep linear. When align exceeds the usable space in a one-page skb head, SKB_MAX_HEAD(align) underflows, the result becomes negative, and after assignment to a size_t it causes skb->data to be placed outside the allocated head. OVS can propagate an oversized headroom request from another port to TUN or TAP.