CVE Vulnerability Catalog

A vulnerability in the Linux kernel has been fixed that led to a NULL-pointer dereference in the acpi_processor_errata_piix4() function. The issue occurred during the assignment of IDE and ISA devices.

A vulnerability has been identified in the Linux kernel related to the btree repair functions for free space and inode. The issue involves a lack of checking for deleted cursors when revalidating two btrees, which may lead to filesystem malfunctions.

A vulnerability in the Linux kernel has been resolved that allowed a user-triggerable WARN in the nested_svm_load_cr3() function. The WARN has been removed from the svm_set_nested_state() function on failure of loading, as it can be trivially triggered from userspace by modifying CPUID after load.

In the Linux kernel, a vulnerability related to a reference leak in mtk_mdp_remove() has been fixed. The issue was resolved by adding platform_device_put() to prevent the reference leak.

A vulnerability has been identified in the Linux kernel that leads to a memory leak in the atomic_destroy_state function. After several commits, slab memory increases as some drm_crtc_commit objects are not freed.

A vulnerability has been identified in the Linux kernel related to the sticky mode in the SQ manager. This issue can lead to stalls when multiple SQs share an SMQ and transmit concurrently.

A vulnerability has been identified in the Linux kernel related to manipulating the 'mfd_of_node_list'. A mutex has been added to ensure safety during access and modification of this list, preventing potential crashes.

A vulnerability in the Linux kernel has been resolved by moving the wait_on_sem() function out of the spinlock. The issue occurred with iommu.strict=1, potentially leading to system lockups under high load conditions.

A vulnerability related to the eDP issue in the drm/amd/display module has been fixed in the Linux kernel, which required adding a function hook check before use.

In the Linux kernel, a vulnerability related to dm-verity has been resolved, which incorrectly handled errors in the dm_bufio_client_create() function. If the call to this function fails, dm_bufio_client_destroy() is later called with an ERR_PTR() argument.

A vulnerability in the Linux kernel leads to a General Protection Fault (GPF) in the write_page() function during array resize. This issue is caused by a use-after-free race between bitmap_daemon_work().

A vulnerability has been identified in the Linux kernel within the ALSA usb-audio module, concerning the lack of size verification for URB packets during playback silencing. This issue may lead to uncontrolled writes outside the allocated buffer.

In the Linux kernel, a vulnerability related to a resource leak in the cx25821_dev_setup() function has been fixed. The issue occurred when ioremap() failed, leading to the memory region obtained by cx25821_get_resources() not being released.

A vulnerability in the Linux kernel related to double free in the pruss_clk_mux_setup() function has been resolved. The issue occurred during the call to devm_add_action_or_reset(), which triggered pruss_of_free_clk_provider() on error.

A vulnerability in the Linux kernel related to reserving slots for the clk_hw structure in the 9FGV0841 has been resolved. The issue concerns the lack of sufficient slots for eight outputs, which may lead to out-of-bounds writes.

A vulnerability in the Linux kernel related to swapped parameters in the pci_{primary/secondary}_epc_epf_unlink() functions has been resolved.

A vulnerability has been identified in the Linux kernel within the dpaa2-switch driver, which involves a lack of validation for the num_ifs value against the maximum allowed number of interfaces. This can lead to out-of-bounds writes.

A vulnerability has been identified in the Linux kernel related to the handling of fake USB devices that can send their own report descriptors. If the input_mapping() hook is not called, the pm->input_ep82 pointer remains NULL, leading to a system crash.

In the Linux kernel, a vulnerability related to a 'scheduling while atomic' bug in the mlx5e_ipsec_init_macs() function has been fixed. This was resolved by replacing mlx5_query_mac_address() with ether_addr_copy() to directly obtain the local MAC address.

A vulnerability has been identified in the Linux kernel's implementation of the minix filesystem, which does not support any value for s_log_zone_size other than 0. Fixes have been introduced to add required sanity checking.