CVE Vulnerability Catalog

A vulnerability in the Linux kernel regarding abuse of kprobe_write_ctx via freplace programs. Uprobe programs can modify struct pt_regs, and through kprobe+freplace they can affect kernel function arguments. The fix disallows attaching freplace programs to kprobe with different kprobe_write_ctx values.

In the Linux kernel, the brcmfmac driver for Broadcom Wi-Fi cards has a bug where the return value of brcmf_chip_add_core() is not checked for error pointers. This can lead to dereferencing an error pointer and potentially cause system instability.

In the Linux kernel task_vma iterator, there is a lock ordering issue. Holding the VMA lock during BPF program execution can lead to deadlocks. The fix takes a VMA snapshot and releases the lock before returning.

In the Linux kernel, the bpf_fd_array_map_clear() function is missing a cond_resched() call in its loop, which can cause RCU stalls and system crashes when clearing PROG_ARRAY maps with many entries.

In the 6pack (hamradio) driver in the Linux kernel, the sixpack_receive_buf() function does not skip bytes with TTY error flags, leading to processing of uninitialized data and KMSAN reporting an uninit-value read.

In the Linux kernel, a vulnerability in the cls_fw classifier allows a filter to be published to the datapath before the change() function is called, leading to a NULL pointer dereference when an invalid filter is processed.

A memory leak was found in the Linux kernel in the deferred packet drop mechanism of qdiscs. When the root qdisc does not implement the TCQ_F_DEQUEUE_DROPS flag, packets to be freed are not released and remain on a local list.

In the Linux kernel, bpf_prog_test_run_skb() calls eth_type_trans() and then uses skb->protocol to initialize sk family and address fields for the test. For IPv4/IPv6 packets, it may access ip_hdr(skb) or ipv6_hdr(skb) even when the test input only contains an Ethernet header. The fix rejects the input earlier if the Ethernet frame carries IPv4/IPv6 EtherType but the L3 header is too short.

A vulnerability in the Linux kernel in the Bluetooth HCI UART driver (hci_ldisc). When hci_register_dev() fails, the HCI_UART_PROTO_INIT flag is not cleared, potentially leading to recv being called after resources are freed. The fix clears the flag before closing.

In the Linux kernel, the DRM sun4i backend driver has an error pointer dereference bug. The function drm_atomic_get_plane_state() can return an error pointer that is not checked before use, potentially causing a system crash.

In the Linux kernel, the ASoC STI driver never frees regmap_field objects allocated during player init, potentially leaking resources when the driver is removed. The fix switches to devm_regmap_field_alloc() to automatically manage allocation lifetimes.

In passthrough mode of the dm-cache driver in the Linux kernel, a NULL pointer dereference occurs. When invalidating a cache entry and the bio prison cell lock fails due to a concurrent write to the same block, mg->cell remains NULL. The invalidate_complete() function attempts to unlock and free the cell without checking its validity, causing a system crash.

In the Linux kernel, the dm cache module has a bug in passthrough mode causing write hangs. The invalidate_remove() function mishandles write hit bios after cache invalidation, dropping the bio without submission.

In the Linux kernel, the dm-cache module has a vulnerability in dirty mapping checking when switching to passthrough mode. The bug arises from an assumption that table reload occurs after suspension, which is broken by LVM's preload mechanism. This can lead to loading dirty mappings into passthrough mode, causing data loss.

A memory leak was discovered in the Linux kernel's dm_cache_metadata_abort function within the dm-cache module. When the root_lock cannot be acquired because the block manager is read-only, the temporary block manager created before the lock is not released, causing a memory leak.

In the Linux kernel graphics driver (cdns-mhdp8546-core), the connector pointer is not set early enough in atomic_enable(). During error recovery paths this can lead to a NULL pointer dereference and system crash.

In the Linux kernel, the drm/msm/dpu driver has a mismatch between voltage and frequency during runtime resume. Calling dev_pm_opp_set_rate(dev, 0) drops the MMCX rail to MIN_SVS while the core clock remains at highest frequency, potentially causing instability or system crash.

In the ASoC audio driver for Qualcomm platforms (qdsp6), the widget type is not checked before accessing private data. A virtual widget may lack an associated DSP graph, leading to incorrect memory access.

In the Linux kernel, the PCI driver for Tegra194 has a CBB timeout caused by DBI register access before core power-on. When PERST# is deasserted twice, pci_epc_deinit_notify() and dw_pcie_ep_cleanup() are called before reset_control_deassert(), causing a timeout.

In the GFS2 filesystem of the Linux kernel, a NULL pointer dereference can occur in gfs2_log_release() during unmount when sdp->sd_jdesc is NULL. The previous patch missed this case.