CVE Vulnerability Catalog

In the Linux kernel's i2c amd-mp2 driver, on adapter registration failure, the I2C context is freed by devres, but the PCI driver may still dereference the stale pointer in IRQ and sleep callbacks. The fix unregisters the callback before returning the error.

In the Linux kernel's i2c imx driver, there is a race during slave registration and error handling. Assigning the slave pointer before pm_runtime_resume_and_get() can leave it non-NULL after an error, and a race with the interrupt handler can cause a NULL dereference. The fix defers the assignment until after successful resume and performs it inside the slave_lock critical section.

In the Linux kernel, dev_has_sync_state() reads dev->driver twice without holding device_lock(), which can lead to a race during concurrent unbind. The fix reads dev->driver exactly once with READ_ONCE(), pairing with WRITE_ONCE() in device_set_driver().

In libbpf, the signed loader does not ensure that a map is exclusive before validating map->sha. Without exclusivity, another BPF program with map access can mutate the contents after freezing, allowing validation on stale data. The fix adds an exclusivity check.

In the Linux kernel NTFS driver, a vulnerability was found where the restart-area length is truncated to u16, allowing the bounds check to be bypassed. A crafted NTFS image can cause an out-of-bounds read during filesystem mount.

In the Linux kernel, KVM for ARM64 in nested virtualization mode, kvm_handle_vncr_abort() assumed that -EFAULT from kvm_translate_vncr() always indicates an abort. However, 'late' failures on the output of S1 translation are possible, e.g., a GFN outside memslots. The fix prepares an external abort before returning from kvm_translate_vncr() and removes the BUG_ON() in the fault injection path.

In the Linux kernel, netfilter xt_nat SNAT and DNAT target handlers assume IP-family conntrack state and can dereference a NULL pointer when instantiated from an unsupported family through nft_compat. A bridge-family compat rule can trigger a NULL-dereference in nf_nat_setup_info(). The fix rejects non-IP families in xt_nat_checkentry() so unsupported targets cannot be installed, while keeping NFPROTO_INET allowed.

In the Linux kernel, the intel-speed-select tool (tools/power/x86) daemon uses a fixed pidfile path under /tmp. A local unprivileged user can pre-create a symlink at that path and cause a root-run daemon instance to write into an attacker-chosen file. The fix opens the pidfile with O_NOFOLLOW and validates it with fstat() before locking/writing.

In the Linux kernel, a vulnerability was found in the CXL subsystem where CXL_HEADERLOG_SIZE was defined as 512 bytes, while the actual Header Log register size in the RAS Capability structure is 64 bytes. This caused an out-of-bounds read (by 448 bytes) during data copying, and in the CPER caller path led to leaking 448 bytes of kernel stack memory into the trace event ring buffer, readable by userspace via tracefs.

In the Linux kernel, the UFS core driver trace events in drivers/ufs/core/ufs_trace.h used a pointer to the hba structure in TP_printk(), which is not allowed because TP_printk() is executed when the trace file is read, potentially much later when the pointer may be stale. The fix saves the device name at the time the tracepoint is called and places it into the ring buffer, eliminating the risk of dereferencing a freed pointer.

In the Linux kernel, the HFS+ filesystem lacked validation of B-tree node size. A corrupted HFS+ image with an invalid node size could lead to reading uninitialized memory during mount. Added a sanity check based on the technical specification.

In the Linux kernel, the scsi: hisi_sas driver lacked a slave_destroy interface, causing warnings during simultaneous link reset and module removal. The fix adds this interface to ensure proper link removal after workqueues are flushed.

In the Linux kernel, the scmi_power_name_get() function in firmware: arm_scmi lacked validation of the domain number, which could lead to out-of-bounds access. Fixed by returning "unknown" for invalid domains, like scmi_reset_name_get() does.

In the Linux kernel, there is a possible NULL pointer dereference in __in6_dev_stats_get(). The dev_get_by_index_rcu() function can return NULL if the original physical device is unregistered.

In the Linux kernel, the rapidio/tsi721 driver has an issue in tsi721_db_dpc(). In a list_for_each() loop, the 'found' variable is not reset at the start of each iteration, which can lead to incorrectly marking all items as found after the first correct doorbell, and if the item is not found, it may dereference invalid memory.

In the Linux kernel, the OCFS2 filesystem has an out-of-bounds write in ocfs2_remove_refcount_extent, which can lead to a kernel panic. The issue occurs when unlinking a refcounted file and the last leaf block is removed.

In the Linux kernel, the netfilter synproxy module has an unaligned memory access issue when adjusting the timestamp. Using unsafe operations can cause performance degradation or crashes on strict alignment architectures.

In the Linux kernel, the wcn36xx driver has an out-of-bounds read due to a short trigger BA firmware response. Lack of length validation can lead to reading stale heap data and corrupting the BA session state.

In the Linux kernel, the iommufd module lacks the dma_resv lock before calling dma_buf_unpin() in the release path, causing a kernel warning. This occurs when destroying or unmapping IOAS.

In the Linux kernel, in the Btrfs filesystem's LZO decompression function, there is an out-of-bounds read vulnerability. The segment length validation does not account for the compressed data size, which can lead to a null-ptr-deref and system crash.