CVE Vulnerability Catalog

In the rtl8723bs driver in the Linux kernel, the return value of kzalloc_flex() is used without checking for allocation failure, potentially leading to a NULL pointer dereference and system crash.

In the Linux kernel, the restriction preventing multiple opens of /sys/fs/selinux/policy was removed, which previously allowed any process to block others from reading the SELinux policy. The fix eliminates the policy_opened flag and shrinks the critical section.

In the Linux kernel, a race condition in the pseries/papr-hvpipe module can cause a deadlock when interrupts fire during ioctl or release handlers.

In the libwx driver in the Linux kernel, request_threaded_irq() was used with a primary handler but no threaded handler, along with the IRQF_ONESHOT flag. This combination triggers a kernel warning. The fix switches to request_irq() and removes the unnecessary flag.

In the s3c64xx SPI driver in the Linux kernel, a NULL pointer dereference occurs on driver unbind. A change moving DMA channel allocation from probe() to s3c64xx_spi_prepare_transfer() did not remove the corresponding deallocation from remove(). The fix drops the bogus DMA channel release from remove().

A bug was found in the Linux kernel's KVM for x86, where __kvm_apic_update_irr skips scanning IRR when PID.ON is set but PIR is empty. This triggers a false WARNING in vmx_check_nested_events() and causes unnecessary L2 VM-Enter/VM-Exit cycles.

In the Linux kernel, the PM domain (genpd) framework is missing a pm_runtime_disable() call when detaching virtual devices. This leaves runtime PM enabled for those devices, potentially causing critical errors like NULL pointer dereference or unnecessary performance state votes.

In the Linux kernel, the CAAM cryptographic driver's hash_digest_key() function uses print_hex_dump() to display HMAC keys, potentially leaking sensitive data when CONFIG_DYNAMIC_DEBUG is enabled. The fix changes this to print_hex_dump_devel(), which is safer.

A vulnerability was found in the Linux kernel's handling of page faults during EFI runtime calls. A change in FPU code (d02198550423) causes kernel_fpu_begin() to disable softirqs via local_bh_disable(), setting SOFTIRQ_OFFSET in preempt_count. This makes efi_crash_gracefully_on_page_fault() incorrectly treat the context as an interrupt, leading to a panic() instead of graceful EFI_ABORTED recovery, resulting in a hard system freeze.

In the txgbe driver for copper NICs with external PHY, a missing RTNL lock during PHY disconnection on module removal triggers an RTNL assertion warning in phylink_disconnect_phy().

In the Linux kernel, the QCOM LPG LED driver lacks an array bounds check when selecting high-resolution values. A 3-bit register field is used to index an array with only 5 elements, potentially causing out-of-bounds reads and setting incorrect values.

In the Linux kernel, the hugetlb module crashes during early boot if kernel command-line parameters (hugepages, hugepagesz, default_hugepagesz) are specified without the '=' separator. This passes NULL to hugetlb_add_param(), which dereferences it in strlen(), causing a system crash.

In the Linux kernel, the TPM driver's tpm_dev_release() function uses kfree() instead of kfree_sensitive() to free the auth structure containing sensitive cryptographic data (HMAC session keys, nonces, passwords). Other code paths use kfree_sensitive(), leading to inconsistency and leaving sensitive data in memory.

In the Linux kernel, the IIO ADMV1013 driver may leave the str variable uninitialized if device_property_read_string() fails. The code then calls strcmp(str, ...) on an uninitialized pointer, leading to a NULL pointer dereference.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the Imagination (powervr) DRM driver when updating the ftrace mask. The issue is caused by passing incorrect data to a debugfs entry, leading to a segfault and system crash.

In the Linux kernel, the AMDGPU driver on RDNA4 (GFX 12) cards lacks GDS, GWS, and OA memory. The function amdgpu_ttm_init_on_chip() is called with zero size, leading to drm_mm_init(mm, 0, 0) and triggering a DRM_MM_BUG_ON assertion, causing a kernel crash during amdgpu module load.

In the fabric-chaincode-java library (Hyperledger Fabric chaincode shim API) from version 2.3.1 to before 2.5.10, when chaincode is deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server INFO level logging includes the TLS private key password in plaintext. An attacker with log access could recover the password and, if also obtaining the private key, impersonate the chaincode server.

A CRLF injection vulnerability in cowlib version 2.9.0 allows HTTP response splitting due to improper neutralization of non-VCHAR bytes in structured HTTP header values. The escape_string/2 function fails to escape CR and LF characters, enabling attackers to inject new headers into HTTP responses.

OpenBullet2 up to version 0.3.2 on Windows has a credential disclosure vulnerability. A remote attacker can configure a proxy source with a UNC path pointing to an attacker-controlled server, causing the application to attempt SMB authentication and leak the NTLMv2 hash of the process user.

A flaw in the 389 Directory Server's Content Synchronization persistent search plugin causes unbounded memory growth when an authenticated client stops reading sync responses, enabling denial of service. Race conditions in plugin thread lifecycle can also cause crashes during connection teardown or shutdown.