CVE Vulnerability Catalog

In the Linux kernel, the virtio-gpu driver has an issue during driver removal when KMS is disabled. DRM atomic and modesetting are not initialized, leading to access of uninitialized data and kernel crash.

In the Linux kernel, a false positive WARN was removed when marking a page as dirty while the VM is dying. The issue affected SEV-ES guests where KVM kept a writable mapping of a guest page after an exit to userspace and tried to unmap it during vCPU destruction, triggering a warning about missing active vCPU.

A fix in the Linux kernel for the pinctrl mcp23s08 driver. Initialization of mcp->dev and mcp->addr was too late, causing a NULL pointer dereference during regmap init.

In the Linux kernel for ARM architecture, there is an issue in __switch_to() related to KASAN VMAP stack shadow. The ldr instruction was used to read the stack shadow, which is byte-granular and may not be word-aligned, causing an alignment fault on ARMv5.

In the Linux kernel on ARM64, the pagetable_dtor() call was missing when freeing hot-removed page table pages, causing bad page states, PTL allocation leaks, and incorrect NR_PAGETABLE stats. The fix adds the missing call in free_hotplug_pgtable_page().

In the i2c-imx driver in the Linux kernel, there is an inconsistency between clock and pinctrl state in runtime PM. During suspend, the clock is disabled before switching pinctrl state, and a pinctrl failure leaves the clock disabled, causing a crash on subsequent hardware access.

In the i2c-qcom-cci driver in the Linux kernel, there is a NULL pointer dereference in cci_remove(). When only one of two I2C masters is initialized, calling cci_halt() for the uninitialized master causes a kernel crash during device unbinding or driver removal.

In the Linux kernel, the airoha network driver lacks a NULL check for the result of of_reserved_mem_lookup(). This can lead to a NULL pointer dereference and system crash when a device tree entry is misconfigured.

In the Linux kernel bonding driver, a NULL pointer dereference occurs in bond_do_ioctl() because slave_dbg() is called before the NULL check for slave_dev. This can cause a system crash when a non-existent interface is specified.

In the Linux kernel NVMEM onie-tlv driver, an infinite loop occurs when encountering an unknown entry type (e.g., 0x41), causing a system hang.

In the Linux kernel, the mm/damon/lru_sort module has a vulnerability due to missing error handling for context allocation. The damon_lru_sort_enabled_store() function assumes allocation always succeeds, leading to a NULL pointer dereference on failure.

In the Linux kernel, the DAMON_RECLAIM module has a NULL pointer dereference bug. The damon_reclaim_enabled_store() function assumes that the damon_ctx allocation will always succeed, which can lead to using an uninitialized pointer.

In the Linux kernel mincore_swap() function, there is an ordering issue in entry checks. On builds without CONFIG_SWAP but with CONFIG_MIGRATION or CONFIG_MEMORY_FAILURE, migration/poison entries are incorrectly treated as swap, causing false warnings and incorrect results.

In the Linux kernel's slimbus qcom-ngd-ctrl driver, callbacks are registered before the NGD (Next Generation Device) is created. When remoteproc starts in parallel with driver probing, callbacks operate on uninitialized data, causing system crashes.

In the Qualcomm slimbus driver (qcom-ngd-ctrl), a potential deadlock was detected due to an ABBA locking order between tx_lock and ctrl->lock. During SSR/PDR down notification, tx_lock is acquired before ctrl->lock, while other code paths take them in reverse order, leading to a possible system hang.

A WARN warning was triggered in the Linux kernel's scx_cgroup_move_task() function during task migration by the sched_ext scheduler. The issue occurs when systemd modifies subtree_control and cgrp_moving_from is NULL, which is a legitimate CSS-based migration, not an error. The fix removes the warning while keeping ops.cgroup_prep_move() and ops.cgroup_move() paired.

In the Linux kernel, the debugobjects module has an issue on RT-enabled systems. The fill_pool() function calls rtlock_lock(), which asserts if current->pi_blocked_on is set, potentially causing a kernel panic.

A fix in the Linux kernel for debugobjects where calling fill_pool() in hardirq context during early boot could cause a deadlock.

The vulnerability in MCO is due to missing server-side validation of uploaded file types. Validation relies solely on client-side checks, which can be bypassed. An authenticated, low-privileged attacker can upload files of arbitrary types to the server.

MCO is vulnerable to User Enumeration through authentication-related functionalities. The application returns distinguishable responses for valid and invalid users during username reminder and password reset operations, allowing an attacker to enumerate valid usernames and email addresses.