CVE Vulnerability Catalog

In the Linux kernel, the sur40 driver registered the input device too early, before V4L2 and vb2_queue components were fully initialized. This can lead to data races and system crashes. The fix moves registration to the end of the probe function.

In the Linux kernel, libceph may use invalid OSD indices from primary_temp in a corrupted osdmap, leading to out-of-bounds reads. The fix adds validation of indices in get_temp_osds().

In the Linux kernel, libceph's decode_watchers() lacked a bounds check before reading a 32-bit value, leading to an out-of-bounds read when struct_len=0. The fix uses the safe variant ceph_decode_32_safe.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a memory leak when cp_init() fails. The current cleanup logic does not handle all channel program segments, leading to memory leakage.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is no limit on the number of channel program segments. Processing is recursive, which can lead to exceeding the global limit and potential issues.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a lack of cancellation of existing workqueues during initialization. This can lead to dispatching work after the private structure is freed.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a lack of range checking for read/write region indexes. The introduction of the capability chain clamped indexes only for capabilities, but not for existing regions.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a lack of verification that the first IDAW remains constant between reads. This can lead to an inconsistent set of IDAWs.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is an out-of-bounds check on the CCW array. The loop may check a 257th element, which is out of bounds.

In the Linux kernel, in the s390/vfio_ccw subsystem, cleanup of cp resources is performed in fsm_notoper(), which can be called asynchronously while holding other locks. This can lead to deadlocks or malfunction.

In the Linux kernel, in the s390/vfio_ccw subsystem, the scope of io_mutex has been expanded to close remaining synchronization gaps. It also takes advantage of moving cp_free() to a workqueue, allowing safe lock management.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a lack of locking mechanism for the CRW region, which relies solely on asynchronous hardware events. A lock has been added to ensure consistent reading of the payload list.

In the Linux kernel, the xcrb_msg_to_type6cprb_msgx() function for s390/zcrypt lacks proper input validation, leading to integer overflow, missing minimum size validation, and arithmetic overflow in sum calculations. This can result in undersized buffer allocations, uninitialized memory access, and buffer overflows.

In the Linux kernel, the xcrb_msg_to_type6_ep11cprb_msgx() function for s390/zcrypt lacks minimum size validation, has arithmetic overflow in length calculations, and improper ASN.1 payload parsing. This can lead to uninitialized memory access and buffer overflows.

In the Linux kernel, the zcrypt_msgtype6_send_ep11_cprb() function for s390/zcrypt uses fragile struct overlays to access and modify the domain field in the EP11 CPRB payload, causing maintainability and security concerns. It lacks validation of actual ASN.1 encoding and has error-prone length format detection.

In the Linux kernel, the xcrb_msg_to_type6cprb_msgx() and xcrb_msg_to_type6_ep11cprb_msgx() functions for s390/zcrypt copy a user space message into a kernel buffer based on length, but further processing assumes 4-byte alignment. As a result, up to 3 bytes of uninitialized kernel memory are forwarded to further processing, potentially exposing kernel memory to the crypto card firmware.

In the Linux kernel, the amdgpu driver for AMD Display has a NULL pointer dereference in amdgpu_dm_crtc_set_vblank() when vblank is enabled or queried before a stream is attached to acrtc_state->stream. This can lead to a system crash.

In the Linux kernel, the amdgpu driver's AMDGPU_GEM_CREATE checked domain bits against AMDGPU_GEM_DOMAIN_MASK but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA, causing amdgpu_bo_placement_from_domain() to exceed AMDGPU_BO_MAX_PLACEMENTS and hit BUG_ON().

In the Linux kernel, the amdgpu driver incorrectly calculates the minimum size for UVD decode images because it uses width instead of pitch. Additionally, it does not reject pitch over 4096, which could lead to overflow.

In the Linux kernel, the amdgpu driver's amdgpu_cs_pass1() does not reject repeated chunk IDs, allowing multiple FENCE chunks in one submit. This causes amdgpu_cs_p1_user_fence() to run twice, overwriting p->uf_bo and leaking a BO reference.