CVE Vulnerability Catalog

In the Linux kernel, a resource leak was detected in the mctp i3c module during failed driver registration. If I3C driver registration fails, the notifier and mctp_i3c_bus objects are not cleaned up, leading to memory leaks and leaving a notifier pointing into a module that failed to load. The fix adds cleanup in the error path.

In the Linux kernel, the drm/xe driver for Intel GPUs has a vulnerability due to missing drm_dev guards when detaching CCS read/write buffers. In certain scenarios, buffers are freed after the device is unbound, leading to a NULL pointer dereference and system crash.

In the Linux kernel vmxnet3 driver, vmxnet3_get_hdr_len() triggers BUG_ON for Geneve packets when the descriptor indicates an inner header instead of the outer. The fix checks the VMXNET3_RCD_HDR_INNER_SHIFT flag and safely returns 0 instead of triggering BUG_ON.

In the Linux kernel, in the DRM/XE driver for Intel GPUs, a memory leak was discovered in xe_vm_create(). On a reservation object allocation failure, resources initialized by xe_svm_init() are not freed, leading to memory leaks in both fault-mode and non-fault-mode VMs.

In the Linux kernel TIPC subsystem, MTU validation for media and bearers lacks an upper bound check, allowing values above U16_MAX, leading to truncation and division by zero. The fix rejects MTU values above U16_MAX.

In the Linux kernel for LoongArch, the BPF JIT sign-extends signed ALU32 div/mod results, leaving upper 32 bits set, inconsistent with the verifier model. The fix adds zero-extension of the result after the divide/modulo operation.

In the Linux kernel QRTR subsystem, socket creation is not restricted to the initial network namespace, allowing unprivileged processes in other namespaces to send QRTR datagrams to sockets in other namespaces, breaking isolation. The fix confines the socket family to the initial network namespace.

In the Linux kernel, the mlx5 driver has a buffer overflow when reading the MCIA register if the device supports 32 dword reads, but the data structure only defines 12 dwords. This can lead to out-of-bounds read and kernel panic, especially with FORTIFY_SOURCE enabled.

In the Linux kernel, the RDS TCP module has a race condition during netns teardown. The sysctl is unregistered after closing the listen socket, which can lead to use-after-free in rds_tcp_skbuf_handler().

In the Linux kernel, the drop_monitor module has a size calculation error for 64-bit attributes. Underestimating the SKB buffer size can lead to a kernel panic (skb_over_panic) when adding attributes.

A use-after-free vulnerability was found in the Linux kernel's tcp_bpf_sendmsg() function in the BPF sockmap mechanism. The issue arises from an unsafe comparison of the msg_tx pointer with psock->cork after reacquiring the socket lock, which can lead to double-freeing of memory (stale cork) when two threads send concurrently on the same socket.

A use-after-free vulnerability was found in the Linux kernel's tracing subsystem, specifically in freeing trigger private data after synchronization was deferred to a separate thread. This allows a concurrent tracepoint handler to access freed memory. The fix restores synchronization for histograms and adds an optional callback for enable triggers.

In the Linux kernel xe driver, a buffer overflow was found in the steered register list allocation. The allocation size is calculated using only the geometry DSS mask, while the filling loop uses the union of geometry and compute masks, causing writes past the allocated buffer.

In the Linux kernel amdgpu driver, issues were found in context pstate override handling, including potential use-after-free and NULL pointer dereference during context initialization. Additionally, context exit may overwrite the configuration set via sysfs.

In the Linux kernel drm/xe driver, there is a use-after-free vulnerability involving imported dma-buf objects. A BO can reference the exporter's reservation object which may be freed before the importer takes a reference, leading to a system crash.

In the Linux kernel, the drm/xe/vm driver has a vulnerability where using -1 as an array index during BO VMA prefetch with CONSULT_MEM_ADVISE_PREF_LOC causes an out-of-bounds access. The fix resolves the preferred location for BO VMAs directly.

In the Linux kernel, the drm/xe/pt driver has a vulnerability where current_op is not reset in xe_pt_update_ops_init(). During retries, this can lead to out-of-bounds write and subsequent use-after-free crash. The fix resets current_op and related flags.

In the Linux kernel, the drm/imagination (powervr) graphics driver has a double call to drm_sched_entity_fini(), leading to a refcount underflow and potential use-after-free. The issue occurs during context destruction when drm_sched_entity_fini() is called both in pvr_queue_kill and pvr_queue_destroy paths.

In the Linux kernel, the drm/imagination driver has a vulnerability in pvr_set_uobj_array() where the strides for user and kernel pointers are swapped during array copying. This leads to reads/writes at wrong addresses and incorrect padding clearing.

In the Linux kernel, the drm/imagination driver has a vulnerability due to lack of synchronization between find and map operations in drm gpuvm. During map/unmap operations, a find operation may be in progress, leading to NULL pointer dereference. The fix acquires vm_ctx->lock before mapping memory.