CVE Vulnerability Catalog

A vulnerability related to out-of-bounds array access in the ntb_hw_switchtec module has been fixed in the Linux kernel. The patch protects against invalid index access to mw_sizes, which could lead to unexpected system behavior.

A vulnerability in the Linux kernel has been resolved that allowed two query interface operations to concurrently update interfaces. A locking mechanism has been introduced to prevent these races.

A vulnerability related to use-after-free in drm_crtc_commit after release has been fixed in the Linux kernel. The issue involved improper duplication of the drm_plane_state in the atmel_hlcdc_plane_atomic_duplicate_state() function.

A vulnerability in the Linux kernel has been fixed that allowed for out-of-bounds read in the decode_choice() function. The issue stemmed from improper boundary checking before calling get_len(), which could lead to unexpected behavior.

In the Linux kernel, a vulnerability related to use-after-free bugs has been fixed, which occurs during the detachment of the FarSync T-series card. These issues may arise in the fst_remove_one() function, where fst_card_info is deallocated, but fst_tx_task or fst_int_task may still be active.

A vulnerability in the Linux kernel related to improper management of the reconnect-pending bit in the net/rds module has been resolved. The issue occurs when canceling the reconnect worker if it has not been scheduled beforehand.

A vulnerability has been identified in the Linux kernel that has been resolved in the TMU driver. The issue was that the TMU device could be used as both a clocksource and a clockevent provider, and the driver improperly managed the device's power.

A vulnerability in the Linux kernel related to RDS connections lacking a proper shortcut in case of connection errors has been resolved.

A vulnerability related to URB leak in the pvr2_send_request_ex function has been fixed in the Linux kernel. The issue occurs when the function successfully submits a write URB but fails to submit the read URB, leading to an immediate return without waiting for the write URB to complete.

A vulnerability in the Linux kernel related to event handler initialization in IPMB has been resolved, which does not use I2C reads but requires a value to be set. Otherwise, an I2C read will return an uninitialized value from the bus driver.

A vulnerability related to locking usage for tcon fields in the Linux kernel has been resolved in the CIFS module. Previously, cifs_tcp_ses_lock was used to protect many objects, which has been improved by introducing dedicated locks for server, session, and tcon.

A vulnerability in the Linux kernel related to vhost has been resolved by moving the vdpa group bound check to vhost_vdpa. This reduces duplication and lowers the risk of a parent driver missing them.

A vulnerability has been identified in the Linux kernel related to improper reference counting management in the 'xfrm_state' structure. The issue occurs during the NETDEV_UNREGISTER event, leading to reference count leaks.

A vulnerability has been identified in the Linux kernel related to the handling of fake USB devices that can send their own report descriptors. If the input_mapping() hook is not called, the pm->input_ep82 pointer remains NULL, leading to a system crash.

A vulnerability has been identified in the Linux kernel within the ALSA usb-audio module, concerning the lack of size verification for URB packets during playback silencing. This issue may lead to uncontrolled writes outside the allocated buffer.

A vulnerability in the Linux kernel has been resolved by moving the wait_on_sem() function out of the spinlock. The issue occurred with iommu.strict=1, potentially leading to system lockups under high load conditions.

A vulnerability has been identified in the Classmate laptop driver in the Linux kernel, related to missing NULL pointer checks. In several places, code using the accel object may run before the address of that object is stored in the input device driver data.

A vulnerability in the Linux kernel related to validating rounded allocations in DRM_BUDDY_CONTIGUOUS_ALLOCATION has been resolved. The issue involved the requested size being rounded up to the next power of two, which could lead to errors.

A vulnerability has been identified in the Linux kernel within the USB pegasus module, which involves filling URBs with hardcoded endpoint pipes without verifying their descriptors. This may lead to improper functioning of USB devices.

A vulnerability in the Linux kernel related to error handling during initialization in the HID: hid-pl module has been resolved. Errors must be reported to avoid dereferencing a NULL pointer when FF is first used.