CVE Catalog

A vulnerability in the Linux kernel's SCSI lpfc driver can cause a null pointer dereference, resulting in a use-after-free error. This issue arises when the function lpfc_issue_els_flogi() fails and returns a non-zero status. The nodereference count is then decremented, prematurely releasing the nodelist structure. If there is pending work from a prior registration or a dev-loss-evt event, the released node is referenced again, causing the null pointer dereference. A similar issue occurs when processing non-zero ELS PLOGI completion statuses, where the node may be released too early, leading to the same use-after-free dereference when the dev-loss-evt work is completed.

A memory leak vulnerability has been identified in the Linux kernel's SCSI LPFC driver, specifically related to NPIV ports handling PLOGI_RJT responses. The issue arises in the functions lpfc_ignore_els_cmpl() and lpfc_els_rsp_reject(), where memory allocated for PLOGI_RJT responses is not properly freed. This vulnerability can lead to resource exhaustion over time as leaked memory is not returned to the system.

A buffer overflow vulnerability has been identified in the Linux kernel's ath11k wireless driver. This issue arises from a mismatch between the reported maximum number of SSIDs for active probe requests and the actual capacity of the scan request parameters structure. The driver reports a maximum of 16 SSIDs, while the structure can only hold 10. This discrepancy allows for a buffer overflow that can be triggered by wpa_supplicant in userspace. The vulnerability occurs when the SSIDs are copied into the scan request parameters, potentially overwriting important data such as the extra IE pointer.

A NULL pointer dereference vulnerability has been identified in the Linux kernel's virtio GPU driver. This issue arises in the 'virtio_gpu_conn_get_modes' function, where a NULL value may be returned by 'drm_cvt_mode'. The vulnerability was discovered using the syzkaller fuzzer, which forced a failure in memory allocation, leading to the NULL dereference. The issue has been observed in Linux kernel version 4.19.90.

A vulnerability in the Linux kernel's loop device driver has been addressed. The issue involved ensuring that the loop device associated with the gendisk private data remained valid until the gendisk was completely freed. The loop driver previously took significant measures to prevent a device from being released while still in use. However, to resolve a potential deadlock, this restriction will be eased slightly in the near future.

A double free vulnerability has been identified in the Linux kernel's power management component for AMD graphics. The issue arises in the function 'si_parse_power_table()', where an array is allocated to hold power state information. If the allocation of any array member fails, the array is freed and an error code is returned. However, the array is subsequently freed again in the 'si_dpm_fini()' function, leading to a potential double free scenario. This vulnerability also causes a memory leak, as the array members are not freed during the allocation process. Additionally, the power state count is not updated until all allocations are successfully completed, which could result in accessing uninitialized variables or a use-after-free condition.

A null pointer dereference vulnerability has been identified in the Linux kernel's AMD GPU driver. This issue occurs in versions of the kernel prior to 5.16.0 when the software power management unit (PMU) is disabled. The vulnerability arises because the driver does not properly check if certain functions are initialized before releasing the context, leading to a kernel panic. The problem was observed during the 'amdgpu_test' process, where the driver attempted to access an uninitialized pointer, causing a crash.

A vulnerability in the Linux kernel's DW9714 I2C driver has been addressed, which involved improper management of the regulator during error handling. When the driver failed to probe, it triggered a warning related to regulator management. The issue has been resolved by ensuring the regulator is disabled in such error scenarios.

A null pointer dereference vulnerability has been identified in the Linux kernel's Venus media driver. This issue arises during the error handling process when the 'venus_probe' function fails. The vulnerability occurs because the 'hfi_destroy' function is called after 'pm_runtime_put_sync', which leaves the 'score->ops' pointer null. Consequently, 'hfi_core_deinit' cannot execute the 'core_deinit' function, leading to a null pointer dereference. The vulnerability has been addressed by modifying the error handling to prevent the null dereference.

A vulnerability in the Linux kernel's md/bitmap functionality can cause a kernel crash in clustered environments. The issue arises when the bitmap area contains invalid data, triggering a segmentation fault in the mdadm tool. While mdadm can handle broken metadata in non-clustered environments, this particular bug affects only clustered arrays, where the kernel space manages bitmap slot information. The vulnerability is rooted in an incorrect sanity check that fails to prevent the assignment of corrupted bitmap data, leading to a 'divide error' during processing.

A warning has been introduced in the Linux kernel's cx25821 media module related to improper cleanup during module removal. When the module is unloaded, it fails to properly clear the associated interrupt request (IRQ) entries, leading to a warning about removing a non-empty directory in the IRQ proc filesystem. This issue can cause a resource leak by not fully cleaning up after the module is removed.

A use-after-free vulnerability has been identified in the Linux kernel's cx23885 PCI driver. This issue arises in the error handling of the cx23885_initdev() function. When the driver fails to set the DMA mask, it inadvertently leads to a use-after-free condition. The vulnerability occurs because the driver initializes I2C-related resources in the cx23885_dev_setup() function but fails to release them during error handling. As a result, this oversight causes a read of freed memory, which can be exploited.

A denial-of-service vulnerability has been identified in the Linux kernel's ath11k module. When the ath11k module is removed using the rmmod command while spectral scan is enabled, a crash occurs. This crash is caused by a null pointer dereference, as the module attempts to process spectral data after being instructed to deactivate the scan. The issue can be reproduced on devices using the QCN6122 hardware.

A vulnerability in the Linux kernel's MMC host driver for the JZ4740 platform has been addressed. The issue involved improper handling of Direct Memory Access (DMA) segment sizes, which could lead to warnings when the DMA segment length exceeded the maximum size claimed by the device. This vulnerability was particularly relevant with DMA API debugging enabled, as it could cause discrepancies between the device's reported capabilities and the actual data being processed.

A resource leak vulnerability has been identified in the Linux kernel's SCSI lpfc driver. When the lpfc_complete_unsol_iocb() function receives a frame with an unhandled type, the frame is discarded, leading to a leak of resources. The vulnerability arises because the function fails to properly return resources before dropping the frame. Additionally, the handling of NOP basic link service in the lpfc_fc_frame_check() function requires an update.

A vulnerability in the Linux kernel's handling of compatibility system calls for arm64 processes has been addressed. When a compatibility process attempts to execute an unknown system call above the __ARM_NR_COMPAT_END threshold, the kernel responds by sending a SIGILL signal to the process. However, the error reporting mechanism inadvertently misinterprets the syscall number as an exception syndrome value, leading to the display of incorrect error messages. This issue arises because the compatibility syscall handler does not properly validate syscall numbers, allowing invalid values to be processed incorrectly. The vulnerability could be exploited by a compatibility process that sends a syscall number interpreted as negative, bypassing normal error handling and causing the kernel to print misleading exception information.

A double free vulnerability has been identified in the Linux kernel's ath10k wireless driver. This issue arises when a firmware recovery, triggered by a timeout or crash, is immediately followed by a suspend event. The recovery process calls for the driver to clean up, but if the suspend event occurs during this recovery, it can lead to a double invocation of the halt function. This, in turn, causes a crash by freeing memory that was not properly allocated. The vulnerability affects several versions of the Linux kernel where the ath10k driver is used.

A vulnerability in the Linux kernel's ASoC SOF IPC3 topology handling can lead to out-of-bounds access. The issue arises in the 'sof_get_control_data()' function, which expects to process only byte-type payloads. However, it also accommodates other control types, leading to potential memory access errors. The vulnerability can be exploited by crafting a specific topology that misaligns with the expected data types.

A vulnerability has been identified in the Linux kernel's ASoC Mediatek component, specifically within the mt2701_wm8960_machine_probe function. The issue arises from a missing reference count management, which can lead to a memory leak. The vulnerability is related to the improper handling of a node pointer returned by the of_parse_phandle() function, which increases the reference count. The absence of a corresponding of_node_put() call creates a refcount leak.

A vulnerability in the Linux kernel's ice driver can lead to a null pointer dereference. The issue arises in the ice_get_vf_vsi function, which may return NULL when handling messages during a reset process that involves removing and recreating the Virtual Station Interface (VSI). This vulnerability is present in the ice driver of the Linux kernel.

A vulnerability in the Linux kernel's handling of the CS35L41 audio codec has been identified, specifically related to out-of-bounds access in the OTP (One-Time Programmable) data unpacking process. The issue arises because the OTP element count defined in the driver's OTP map exceeds the actual number of entries, leading to a shift-out-of-bounds condition. This flaw triggers a Undefined Behavior Sanitizer (UBSAN) warning, indicating that the shift operation is attempting to access memory outside the allocated bounds, which could potentially be exploited.

A vulnerability has been identified in the Linux kernel's ASoC Mediatek component, specifically in the error handling of the mt8173_max98090_dev_probe function. This vulnerability involves a reference count leak in the error path, which could potentially be exploited to cause unintended behavior.

A vulnerability in the Linux kernel's cpufreq governor related to improper memory management of kobjects has been addressed. The issue arose because the dbs_data structure, which includes a gov_attr_set that embeds a kobject, was not being freed correctly. Kobjects require a specific release method, and the standard kfree function could not be used to deallocate them directly. To resolve this, the cpufreq_dbs_data_release function was introduced to properly release the dbs_data via the kobject release method. This change prevents potential memory management warnings and call trace issues related to improperly freed objects.

A denial-of-service vulnerability has been identified in the Linux kernel's MTD raw NAND Denali driver. The issue arises because the driver does not use managed device resources, leading to a timeout while waiting for an interrupt. This mismanagement causes the probe to fail, as no NAND device is detected. The failure triggers a page fault in the kernel, specifically a supervisor write access error, which can disrupt normal system operations.

A vulnerability in the Linux kernel's framebuffer (fbdev) deferred I/O management has been addressed. The issue involved a race condition that led to list corruption in the page management system. One process was adding pages to the deferred I/O list while another was reinitializing the same pages, causing a mismatch in the list pointers. This corruption was detected by the kernel's list debugging mechanism, which flagged an inconsistency in the expected list structure. The vulnerability arose because the reinitialization process did not properly synchronize with the addition of pages, allowing for the corruption to occur.

A vulnerability in the Linux kernel's OMAP DRM overlay driver has been addressed. The issue was a NULL pointer dereference, which was flagged by the Coccinelle code analysis tool. The error occurred because a variable was dereferenced without being properly initialized, leading to potential instability or crashes. The fix involved correcting the code to reference a valid object index instead of a NULL value.

A denial-of-service vulnerability has been identified in the Linux kernel's I2C Max9286 module. When the Max9286 module is removed, it triggers a kernel oops due to an invalid memory access. This issue arises because the I2C client data no longer points to the correct private data but instead refers to a video4linux2 subdevice, leading to a level 0 translation fault. The vulnerability affects Linux kernel version 5.15.5 and was introduced by a change in the Max9286 module's initialization process.

A potential double free vulnerability has been identified in the Linux kernel's HID Elan driver. The issue arises because the 'input' resource is managed by 'devm_input_allocate_device()', which automatically handles registration and deallocation. However, an explicit call to 'input_free_device()' could lead to a double free situation.

A vulnerability in the Linux kernel's handling of the DA9121 regulator can lead to a slab-out-of-bounds memory access. This issue arises in version 5.18.0-rc2 when the DA9121 device is probed with an invalid device tree specification. The improper initialization causes the subvariant ID to be set incorrectly, allowing the 'da9121_assign_chip_model' function to access the regmap without proper initialization, creating a risk of memory corruption.

A vulnerability in the Linux kernel's DRM/Mediatek component has been addressed, related to the handling of vertical blanking (vblank) callback functions. A kernel panic could occur because the callback data might be NULL when used in the overlay interrupt handler, due to a timing issue between disabling vblank and the interrupt handler's execution. This vulnerability could lead to a crash by causing a kernel panic, disrupting system stability.

A use-after-free vulnerability has been identified in the Linux kernel's NFC subsystem. The issue arises because the logic in the NFC device registration process does not properly account for the timing of rfkill unregistration. As a result, the rfkill object can be accessed after it has been freed, leading to potential memory corruption. This vulnerability has been observed in Linux kernel version 5.18-rc2.

A vulnerability in the Linux kernel's SCSI LPFC driver has been addressed, related to improper handling of external loopback tests. When an external loopback plug is used, the system correctly processes a FLOGI request by aborting it, recognizing the loopback. However, after removing the loopback and connecting to a target device, the system encounters a fault in the 'llpfc_set_rrq_active()' routine. This issue arises from a reference counting error: the completion of a new FLOGI request releases a fabric node, which is then incorrectly referenced by an original ABTS command that has not been properly updated, causing the system to 'oops'. The vulnerability has been corrected by adding a flag to track loopback mode and prevent the ABTS from being sent when it is active.

A potential out-of-bounds access vulnerability has been identified in the Linux kernel's ath9k_htc wireless driver. The issue arises because the 'rxstatus->rs_keyix' field can be passed to the 'test_bit()' function without proper validation, potentially leading to unauthorized access or manipulation of data.

A vulnerability in the Linux kernel's RGA media component could lead to a memory leak. The issue arises because the 'm2m_dev' resource is not properly released when the 'rga_probe' function fails.

A use-after-free vulnerability has been identified in the Linux kernel's usbnet driver, specifically in the handling of USB Ethernet adapter disconnections. This issue arises because the order of operations in the disconnect process has been altered, leading to a mismatch with how the connection is established. The vulnerability was introduced by a commit that reversed the sequence of unbinding and unregistering the network device, causing a physical layer (PHY) to be improperly managed. When a PHY is disconnected and stopped during the unbinding process, it is incorrectly stopped again by the unregistration, creating a conflict that can be exploited.

A vulnerability in the Linux kernel's handling of the wl1251 wireless driver can cause a kernel panic, rendering the driver unusable on devices like the OpenPandora. This issue arises because the driver improperly uses stack parameters for Direct Memory Access (DMA) after the introduction of vmap'ed stacks, which no longer allow such usage. The problem occurs in several places when the wl1251 driver is accessed through Secure Digital Input Output (SDIO). The vulnerability has been addressed by reallocating temporary buffers or using the wl1251_read32() function.

A vulnerability in the Linux kernel's DRM/MSM component can lead to null pointer dereferences. This issue arises when the 'aspace' variable is used without first checking its value, which can remain null in the absence of IOMMU, as seen on the msm8974 platform. The vulnerability has been addressed by ensuring that 'aspace' is properly validated before use.

A vulnerability in the Linux kernel's Advanced Linux Sound Architecture (ALSA) component allows for a null pointer dereference in the PCM (Pulse Code Modulation) subsystem. The issue arises because the pointer to the substream is dereferenced before it is checked for nullity, leading to potential instability. Although the PCM_RUNTIME_CHECK macro calls BUG_ON to handle such cases, it is still necessary to perform a pointer check before assigning the card pointer.

A vulnerability has been identified in the Linux kernel's networking component, specifically within the skb_checksum_help() function. This issue arises from the presence of two BUG() calls, which can lead to a crash. The syzbot tool has reported the ability to trigger these BUG() calls, indicating a flaw that needs to be addressed. The current BUG() calls could be replaced with WARN_ON_ONCE() to allow skb_checksum_help() to return an error code instead. However, it's important to note that syzbot will still cause a crash until the underlying issue is resolved.

A denial-of-service vulnerability has been identified in the Linux kernel's MediaTek VCodec decoder driver. When the driver is removed, it can cause a kernel crash if the driver supports sub-device mode. This occurs because a certain parameter is null, leading to a crash when the module is unloaded.

A vulnerability in the Linux kernel's HDMI driver for the DRM MSM subsystem can lead to a null pointer dereference. This issue arises because the code does not properly check the return value of the 'platform_get_resource_byname()' function. If this function returns NULL, it can cause a null pointer dereference, potentially leading to a system crash or other unintended behavior.

A null pointer dereference vulnerability has been identified in the Linux kernel's MTD raw NAND Cadence driver. The issue arises in the 'cadence_nand_dt_probe()' function when 'platform_get_resource()' returns NULL, leading to a potential dereference of a null pointer. This vulnerability can be mitigated by rearranging the code to use the resource after it has been properly mapped, and by utilizing 'devm_platform_get_and_ioremap_resource()' to streamline the resource handling.

A logic error in the Linux kernel's handling of the RT5645 audio component can lead to a use-after-free vulnerability. This issue arises in the ASoC (ALSA System on Chip) layer when the RT5645 device is removed. The removal function, rt5645_i2c_remove(), incorrectly manages the order of operations by first canceling a work item related to jack detection and then deleting a timer associated with button checks. This flawed sequence can cause the timer's callback function to reschedule the canceled work, creating a potential use-after-free scenario. The vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's NVMe PCI component can lead to a NULL pointer dereference. This issue arises in the 'nvme_alloc_admin_tags' function, where the 'admin_q' variable may be set to an error state (typically due to insufficient memory) if the 'blk_mq_init_queue' call fails. When this error is propagated up the stack, it can trigger the 'nvme_remove_dead_ctrl' function, which checks only if the 'admin_q' is non-NULL. This oversight allows the function to attempt to quiesce a queue that doesn't exist, resulting in a bad or NULL pointer dereference.

A null pointer dereference vulnerability has been identified in the Linux kernel's Rockchip Video Output Processor (VOP) driver. This issue arises in the 'vop_bind()' function, where 'platform_get_resource()' may return NULL. If this occurs, calling 'resource_size()' will lead to a null pointer dereference. The vulnerability can be exploited by moving the 'resource_size()' call after 'devm_ioremap_resource()', which checks the resource for NULL before accessing it.

A vulnerability in the Linux kernel's DRM MSM MDP5 component can lead to a NULL dereference error. This issue arises in the 'mdp5_pipe_release' function, which does not currently check for errors when acquiring the modeset lock. As a result, 'mdp5_pipe_release' may encounter a NULL dereference if 'mdp5_get_global_state' returns a deadlock error. The vulnerability has been addressed by modifying 'mdp5_pipe_release' to check for errors and propagate them appropriately.

A use-after-free vulnerability has been identified in the Linux kernel's Direct Rendering Manager (DRM) subsystem, specifically within the Qualcomm Snapdragon MSM graphics driver. This vulnerability occurs during the runtime resume process, where a hardware configuration pointer is improperly set to NULL. As a result, the system attempts to access freed memory, leading to a kernel paging request error. The issue has been addressed in the official Linux kernel repository.

A vulnerability in the Linux kernel's DRM MSM MDP5 component allows for improper deadlock detection when acquiring the modeset lock. The issue arises because the 'mdp5_mixer_release' function does not currently check for error codes indicating a deadlock, which could lead to a null dereference. The vulnerability has been addressed by modifying 'mdp5_mixer_release' to properly check for and propagate error codes.

A null pointer dereference vulnerability has been identified in the Linux kernel's MTD (Memory Technology Device) subsystem, specifically within the Intel Rawnand driver. The issue arises in the 'ebu_nand_probe()' function when 'platform_get_resource()' returns NULL. This oversight can lead to a null pointer dereference by improperly using the 'res' variable before it is validated. The vulnerability has been addressed by rearranging the code to ensure 'res' is only used after 'devm_ioremap_resource()' has confirmed its validity, thus preventing the null pointer dereference.

A refcount leak vulnerability has been identified in the Linux kernel's ASoC Freescale driver, specifically within the 'imx_sgtl5000_probe' function. The issue arises because the 'of_find_i2c_device_by_node' function takes a reference, and error paths do not properly release this reference, leading to a memory leak.