CVE Vulnerability Catalog

In the Linux kernel, the drm/amdkfd driver has a vulnerability where the range of queue type and mqd size values is not checked during CRIU restore. This could lead to improper behavior or potential security issues. The fix adds appropriate checks.

In the Linux kernel, the drm/amdkfd driver has a vulnerability involving a 32-bit overflow in the CWSR total size calculation. With large ctx_save_restore_area_size and debug_memory_size multiplied by the XCC count, the product can wrap, yielding an undersized CWSR save area that firmware later overruns. The fix promotes total_cwsr_size to u64 and uses check_add_overflow()/check_mul_overflow().

In the Linux kernel, the drm/virtio driver has an out-of-bounds read vulnerability in virtio_get_edid_block(). The function validates the read offset only against the device-supplied resp->size field, not against the fixed-size resp->edid array. A malicious virtio-gpu backend can advertise a large size and high block count, leading to reads past the array and an info leak from kernel memory.

In the Linux kernel, the drm/i915/hdcp driver has a vulnerability where the bounds check for the data->streams[] array is performed after the buffer overflow has already occurred. The fix moves the check before the write, preventing memory overwrite.

In the Linux kernel, the drm/amdgpu driver had a lifetime issue with the vm pointer in amdgpu_vm_get_task_info_pasid(). The pointer was used after the lock was released, potentially leading to use-after-unlock. The fix removes the amdgpu_vm_get_vm_from_pasid() function and inlines the code to hold the lock while in use.

In the Linux kernel, the drm/gpusvm driver had a device mapping leak on error during page retrieval. The fix publishes dpagemap early so the error path can properly unmap those mappings.

In the Linux kernel, the amd/display driver has a bug where the new_stream pointer is not set to NULL after release. A later error can cause a double release and potential use-after-free.

In the Linux kernel, the amlogic-c3 driver has a bug where missing validation of zones_num in AE and AWB config can lead to out-of-bounds access of the zone_weight buffer.

In the Linux kernel, the cedrus driver has a bug where invalid indices in H.264 reference lists can cause out-of-bounds reads of the DPB array. The fix skips such entries.

In the Linux kernel, the chips-media wave5 driver has a bug where a buffer can be returned to userspace before being removed from the ready queue, leading to list corruption and pointer poisoning.

In the Linux kernel, a vulnerability in the msi2500 driver (MSI2500 SDR receiver) causes queued vb2 buffers to leak when start_streaming() fails. Five error paths failed to return buffers to the vb2 framework, triggering WARN_ON and memory leaks. The fix consolidates error handling, ensuring all buffers are returned and the correct error code is propagated.

In the Linux kernel, the nxp imx8-isi driver fixed potential out-of-bounds issues. The maximum downscaling factor supported by ISI can be up to 16. Added a minimum value constraint before applying the setting to hardware to prevent the process from becoming unresponsive.

In the Linux kernel, the pwc driver (USB camera) has a buffer leak during start_streaming() failure. When start_streaming() returns an error without returning buffers via vb2_buffer_done(), a WARN_ON is triggered and queued buffers leak.

In the Linux kernel, the rtl2832_sdr driver has a vulnerability causing vb2 buffer leak on start_streaming() failure. If the function returns an error without returning buffers, WARN_ON triggers and queued buffers leak. The issue affects multiple error paths, including subdev, tuner, ADC, buffer and URB allocation failures.

In the Linux kernel, the stm32 dcmi driver (camera) has a notifier leak on probe failure. If notifier registration succeeds but later steps fail, the notifier is not unregistered, leading to a leak.

In the Linux kernel, the sun4i-csi driver (camera) has a buffer leak during start_streaming() failure. When start_streaming() returns an error without returning buffers, a WARN_ON is triggered and queued buffers leak.

In the Linux kernel, in the V4L2 control mechanism (v4l2-ctrls), there is a lack of validation for active L0/L1 reference counts for HEVC slice parameters. The common validation path does not verify these values before driver-specific code consumes them, which can lead to incorrect behavior.

In the Linux kernel, in the vivid driver, there is a missing check for vb2_is_busy() when toggling capabilities. The vivid_update_format_cap/out() functions can be called when the capture/output queue is not busy, but for controls that select CROP/COMPOSE/SCALE capability, this check is not performed. This can lead to unexpected results when the format is changed between REQBUFS and STREAMON.

A vulnerability was found in the Linux kernel's ALSA sequencer subsystem. The issue is that the queue deletion function does not close a re-opened timer, leading to a use-after-free condition. An attacker with access to /dev/snd/seq can exploit this flaw to corrupt kernel memory.

In the Linux kernel, in the ALSA timer subsystem, there is an issue with draining slave callbacks before the master detaches them. When a master instance is closed, remove_slave_links() clears each slave's ->timer, and the slave's own close then skips the drain entirely, which can lead to use-after-free if the slave's callback is still running.