CVE Vulnerability Catalog

In the Linux kernel FocalTech touchscreen driver, an array out-of-bounds bug in focaltech_process_rel_packet was fixed by making finger indices unsigned, preventing writes to state->fingers[-1].

In the Linux kernel BYD touchscreen driver, a race condition during disconnect was fixed by using timer_shutdown_sync() instead of timer_delete(), preventing use-after-free.

In the Linux kernel Synaptics RMI4 driver (F54), a bug could lead to heap buffer overflow because report_size was not zeroed on error, causing stale larger payload to be copied into a smaller V4L2 buffer.

In the Linux kernel Synaptics RMI4 driver (F54), a bug allowed report size to exceed allocated buffer, leading to out-of-bounds write. The fix records allocation size and rejects reports that do not fit.

In the Linux kernel Synaptics RMI4 driver (F54), a bug allowed changing input type during streaming, which could change report size and lead to heap buffer overflow. The fix blocks VIDIOC_S_INPUT with -EBUSY when streaming.

In the Linux kernel, the crypto qce driver has an error path bug in devm_qce_register_algs. On registration failure, the error path repeatedly calls the same unregister function instead of unregistering previously registered algorithms.

In the Linux kernel for the OpenRISC architecture, restore_sigcontext() restored all SR bits from the signal frame, leaving privileged bits under user control. This allows an unprivileged task to disable the MMU and gain access to arbitrary physical memory.

In the Linux kernel, the sur40 driver registered the input device too early, before V4L2 and vb2_queue components were fully initialized. This can lead to data races and system crashes. The fix moves registration to the end of the probe function.

In the Linux kernel, the mmc: atmel-mci driver has a use-after-free (UAF) vulnerability in atmci_remove due to a race condition. The host->bh_work can be queued by interrupt, timer, or DMA completion, and after module removal the host memory is freed before the work finishes, leading to use of freed memory.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a memory leak when cp_init() fails. The current cleanup logic does not handle all channel program segments, leading to memory leakage.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a lack of cancellation of existing workqueues during initialization. This can lead to dispatching work after the private structure is freed.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a lack of range checking for read/write region indexes. The introduction of the capability chain clamped indexes only for capabilities, but not for existing regions.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is an out-of-bounds check on the CCW array. The loop may check a 257th element, which is out of bounds.

In the Linux kernel, in the s390/vfio_ccw subsystem, cleanup of cp resources is performed in fsm_notoper(), which can be called asynchronously while holding other locks. This can lead to deadlocks or malfunction.

In the Linux kernel, in the s390/vfio_ccw subsystem, the scope of io_mutex has been expanded to close remaining synchronization gaps. It also takes advantage of moving cp_free() to a workqueue, allowing safe lock management.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a lack of locking mechanism for the CRW region, which relies solely on asynchronous hardware events. A lock has been added to ensure consistent reading of the payload list.

In the Linux kernel, the xcrb_msg_to_type6cprb_msgx() function for s390/zcrypt lacks proper input validation, leading to integer overflow, missing minimum size validation, and arithmetic overflow in sum calculations. This can result in undersized buffer allocations, uninitialized memory access, and buffer overflows.

In the Linux kernel, the xcrb_msg_to_type6_ep11cprb_msgx() function for s390/zcrypt lacks minimum size validation, has arithmetic overflow in length calculations, and improper ASN.1 payload parsing. This can lead to uninitialized memory access and buffer overflows.

In the Linux kernel, the zcrypt_msgtype6_send_ep11_cprb() function for s390/zcrypt uses fragile struct overlays to access and modify the domain field in the EP11 CPRB payload, causing maintainability and security concerns. It lacks validation of actual ASN.1 encoding and has error-prone length format detection.

In the Linux kernel, the amdgpu driver's AMDGPU_GEM_CREATE checked domain bits against AMDGPU_GEM_DOMAIN_MASK but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA, causing amdgpu_bo_placement_from_domain() to exceed AMDGPU_BO_MAX_PLACEMENTS and hit BUG_ON().