CVE Vulnerability Catalog

In the Linux kernel's fbdev driver, fb_set_var() can delete a mode from the modelist, but does not check if fb_info->mode points to the deleted entry, leading to a stale pointer dereference on sysfs read. The fix clears fb_info->mode before deleting the mode.

In the Linux kernel's fbdev driver in fb_io_read(), a partial copy_to_user() causes desynchronization of the hardware pointer, leading to out-of-bounds reads. The fix breaks out of the loop immediately upon a partial copy.

In the Linux kernel's drm/panthor driver, panthor_fw_load_section_entry() skips BO creation for zero-sized firmware sections but adds them to the section list, leading to NULL pointer dereference in later paths. The fix skips adding such sections to the list.

In the Linux kernel amdgpu driver, there was no limit on the IB buffer size for GFX rings, which could corrupt adjacent control bits and destabilize command submission. A per-ring IB packet size limit was added and oversized submissions are now rejected.

In the Linux kernel, a vulnerability was found in the cs40l50-vibra input driver. The driver copies custom data of an FF_PERIODIC/FF_CUSTOM effect from user space without validating its length, which can lead to out-of-bounds reads and improper indexing of the bank array. Missing length checks (custom_len) and incorrect masking of the bank value (stored as s16) allow an attacker to trigger undesirable behavior.

In the Linux kernel FocalTech touchscreen driver, an array out-of-bounds bug in focaltech_process_rel_packet was fixed by making finger indices unsigned, preventing writes to state->fingers[-1].

In the Linux kernel Iforce driver, input packet lengths were not validated, allowing out-of-bounds reads from short packets. The fix rejects zero-length USB transfers and requires proper packet prefixes.

In the Linux kernel BYD touchscreen driver, a race condition during disconnect was fixed by using timer_shutdown_sync() instead of timer_delete(), preventing use-after-free.

In the Linux kernel powerpc/pseries papr-phy-attest, missing validation of cmd.length could lead to buffer overflow. The fix adds length checks and fixes memory leaks on error paths.

In the Linux kernel Synaptics RMI4 driver (F54), a bug could lead to heap buffer overflow because report_size was not zeroed on error, causing stale larger payload to be copied into a smaller V4L2 buffer.

In the Linux kernel Synaptics RMI4 driver (F54), a bug allowed report size to exceed allocated buffer, leading to out-of-bounds write. The fix records allocation size and rejects reports that do not fit.

In the Linux kernel Synaptics RMI4 driver (F54), a bug allowed changing input type during streaming, which could change report size and lead to heap buffer overflow. The fix blocks VIDIOC_S_INPUT with -EBUSY when streaming.

In the Linux kernel Synaptics RMI4 driver (F54), worker errors were not propagated to the V4L2 queue, causing stale or uninitialized data to be delivered to userspace. The fix adds error checking and marks buffers as error state.

In the Linux kernel, the hynitron_cstxxx driver improperly validated touch count and finger IDs. This can lead to corrupted touch state or out-of-bounds buffer access.

In the Linux kernel, the crypto qce driver has an error path bug in devm_qce_register_algs. On registration failure, the error path repeatedly calls the same unregister function instead of unregistering previously registered algorithms.

In the Linux kernel, the gve driver lacks an implementation of adjfine, leading to a NULL pointer dereference when triggered from userspace, e.g., via testptp.

A use-after-free vulnerability was found in the Linux kernel's gpio-sloppy-logic-analyzer driver. The 'trigger' debugfs file lacked proper protection, allowing a write to freed memory during device unbind. The issue was fixed by using debugfs_create_file() instead of debugfs_create_file_unsafe().

In the Linux kernel, the gpio ml-ioh driver used a regular spinlock for register protection, which is invalid in irq_chip callbacks on PREEMPT_RT systems. The fix converts it to raw_spinlock_t.

In the Linux kernel, the decode_locker() function in cls_lock_client.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads. Missing bounds checks before copying the name, an unchecked pointer advance, and an uncapped length value can lead to memory corruption. The fix replaces unsafe operations with safe variants and returns -EINVAL on any bounds violation.

In the Linux kernel for the OpenRISC architecture, restore_sigcontext() restored all SR bits from the signal frame, leaving privileged bits under user control. This allows an unprivileged task to disable the MMU and gain access to arbitrary physical memory.