CVE Vulnerability Catalog

In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX path errors. After commit 9db5b3cec4ec ("mptcp: borrow forward memory from subflow"), errors in the receive path prior to queueing skbs into the receive queue do not trigger forward-allocated memory reclaiming. Prevent forward memory from growing unboundedly in pathological drop scenarios by explicitly reclaiming memory when skbs are dropped.

In the Linux kernel's s390/qeth driver, qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by a user-supplied length without checking a lower bound, leading to out-of-bounds write. The fix rejects buffers smaller than udata_offset before allocation.

In the Linux kernel's ASoC lpass-tx-macro driver, tx_macro_dec_mode_get() and tx_macro_dec_mode_put() access the control value via ucontrol->value.integer.value[0] instead of ucontrol->value.enumerated.item[0], leading to out-of-bounds access for enum types. The fix uses the correct field.

In the Linux kernel's drm/shmem_helper driver, the ->huge_fault handler did not check if the PMD mapping exceeds VMA boundaries, potentially leading to VM_BUG_ON_VMA() in copy_pmd_range(). The fix adds VMA boundary checks before installing the mapping.

In the Linux kernel's fbdev driver, mode_string() uses snprintf() which can return a value larger than the remaining buffer space, causing the offset to advance past the sysfs buffer. The fix adds a size parameter and uses scnprintf(), plus an early return when offset exceeds the buffer.

In the Linux kernel's fbdev driver, fb_set_var() can delete a mode from the modelist, but does not check if fb_info->mode points to the deleted entry, leading to a stale pointer dereference on sysfs read. The fix clears fb_info->mode before deleting the mode.

In the Linux kernel's fbdev driver in fb_io_read(), a partial copy_to_user() causes desynchronization of the hardware pointer, leading to out-of-bounds reads. The fix breaks out of the loop immediately upon a partial copy.

In the Linux kernel amdgpu driver, there was no limit on the IB buffer size for GFX rings, which could corrupt adjacent control bits and destabilize command submission. A per-ring IB packet size limit was added and oversized submissions are now rejected.

In the Linux kernel, a vulnerability was found in the cs40l50-vibra input driver. The driver copies custom data of an FF_PERIODIC/FF_CUSTOM effect from user space without validating its length, which can lead to out-of-bounds reads and improper indexing of the bank array. Missing length checks (custom_len) and incorrect masking of the bank value (stored as s16) allow an attacker to trigger undesirable behavior.

In the Linux kernel FocalTech touchscreen driver, an array out-of-bounds bug in focaltech_process_rel_packet was fixed by making finger indices unsigned, preventing writes to state->fingers[-1].

In the Linux kernel BYD touchscreen driver, a race condition during disconnect was fixed by using timer_shutdown_sync() instead of timer_delete(), preventing use-after-free.

In the Linux kernel Synaptics RMI4 driver (F54), a bug could lead to heap buffer overflow because report_size was not zeroed on error, causing stale larger payload to be copied into a smaller V4L2 buffer.

In the Linux kernel Synaptics RMI4 driver (F54), a bug allowed report size to exceed allocated buffer, leading to out-of-bounds write. The fix records allocation size and rejects reports that do not fit.

In the Linux kernel Synaptics RMI4 driver (F54), a bug allowed changing input type during streaming, which could change report size and lead to heap buffer overflow. The fix blocks VIDIOC_S_INPUT with -EBUSY when streaming.

In the Linux kernel, the crypto qce driver has an error path bug in devm_qce_register_algs. On registration failure, the error path repeatedly calls the same unregister function instead of unregistering previously registered algorithms.

In the Linux kernel for the OpenRISC architecture, restore_sigcontext() restored all SR bits from the signal frame, leaving privileged bits under user control. This allows an unprivileged task to disable the MMU and gain access to arbitrary physical memory.

In the Linux kernel, the sur40 driver registered the input device too early, before V4L2 and vb2_queue components were fully initialized. This can lead to data races and system crashes. The fix moves registration to the end of the probe function.

In the Linux kernel, the mmc: atmel-mci driver has a use-after-free (UAF) vulnerability in atmci_remove due to a race condition. The host->bh_work can be queued by interrupt, timer, or DMA completion, and after module removal the host memory is freed before the work finishes, leading to use of freed memory.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a memory leak when cp_init() fails. The current cleanup logic does not handle all channel program segments, leading to memory leakage.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a lack of cancellation of existing workqueues during initialization. This can lead to dispatching work after the private structure is freed.