CVE Vulnerability Catalog

A fix in the Linux kernel for a memory leak in blk_revalidate_disk_zones(). On zone revalidation error, memory allocated for args.zones_cond was not freed.

In the Linux kernel blkcg_maybe_throttle_current() function, a missing put_disk() call on the error path causes a disk reference leak. The disk will never be freed.

A deadlock was discovered in the Linux kernel's sysfs mechanism during the RAID array clear operation (array_state=clear). The issue stems from incorrect reference release ordering, leading to recursive locking and a potential deadlock warning.

A fix in the Linux kernel for ublk where the per-IO canceled flag was not reset after fetch, potentially preventing cancellation on server failure.

In the Linux kernel, the md (RAID) module has a deadlock during raid456 reshape. I/O operations waiting for reshape progress can block array suspend because reshape is frozen and active IO references are not released.

A deadlock was discovered in the Linux kernel's Btrfs subsystem between a reflink operation and a transaction commit when the flushoncommit mount option is used. The issue occurs when reflink copies an inline extent beyond the destination file's current i_size, causing threads to block each other.

In the Linux kernel amd-pstate driver, the amd_pstate_epp_cpu_init() function has a memory leak. On failure to set epp, the cpudata object is not freed.

In the Linux kernel perf/amd/ibs driver, perf_allow_kernel() is called from NMI context, which is unsafe and can cause a crash. Permissions should be cached at initialization.

In the Linux kernel ath11k driver, memory leaks occur in ath11k_mac_setup_bcn_tmpl_ema() and ath11k_mac_setup_bcn_tmpl_mbssid(). Allocated beacon template memory is not freed on error.

A null pointer dereference vulnerability was found in the Linux kernel's bpf_lwt_xmit_push_encap function. The issue occurs when skb->_skb_refdst is not initialized during BPF program test runs, leading to a kernel crash.

A race condition in the Linux kernel during unmap operations on PMD migration entries has been fixed. The issue occurs when move_pages and munmap syscalls are executed concurrently, triggering a VM_BUG_ON in pmdp_huge_get_and_clear_full. The vulnerability affects PowerPC 64-bit architecture.

In the Linux kernel libertas driver, usb_kill_urb() is called from interrupt context, which can cause synchronization issues. Instead, the driver now checks for pending URBs.

A fix in the Linux kernel for potential deadlock in BPF local storage. Deleting selem in NMI context could deadlock, so an error check was added.

In the mt76 WiFi driver (mt7925 model), there is a bug in mt7925_mac_write_txwi where missing NULL check for 'vif' pointer can lead to NULL pointer dereference and kernel panic.

In the mt76 WiFi driver, there is a memory leak when destroying the device. Rx queues have an associated page_pool that is not destroyed in mt76_dma_cleanup, and pages are not returned to the pool when WED is not enabled.

In the Linux kernel, the mt7925 driver (mt76) has a potential deadlock in mt7925_roc_abort_sync. It calls cancel_work_sync() while roc_work() holds dev->mt76.mutex, causing a lockup. This occurs during station removal.

In the Linux kernel, in the mt76 driver, mt76_connac_mcu_alloc_sta_req() allocates an skb that should be freed by mt76_mcu_skb_send_msg(). However, if an intermediate function (mt76_connac_mcu_sta_wed_update() or mt76_connac_mcu_sta_key_tlv()) fails before sending, the allocated skb leaks.

In the Linux kernel, a potential deadlock was found in the mt76 mt7921 WiFi driver in the mt7921_roc_abort_sync function. This function can deadlock on cancel_work_sync() when roc_work() holds dev->mt76.mutex and the caller already owns the same mutex. The deadlock occurs during station removal in the path mt76_sta_remove -> mt7921_mac_sta_remove -> mt7921_roc_abort_sync.

In the Linux kernel, the mt76 driver has a deadlock in mt76_remain_on_channel() and mt76_roc_complete(). They call mt76_set_channel() while already holding dev->mutex, causing a lockup.

In the Linux kernel, the configuration option was switched from CONFIG_CFI_CLANG to CONFIG_CFI, as it is now compiler-agnostic. Using the old name results in the code being compiled out, meaning CFI failures for btf_dtor_kfunc_t would still trigger.