CVE Catalog

A NULL pointer dereference vulnerability has been identified in the Linux kernel's vDPA user driver. This issue arises when the control device's 'drvdata' is absent, leading to a NULL pointer dereference while accessing the 'msg_timeout' attribute through sysfs. The vulnerability has been resolved by eliminating the unnecessary attribute from the control device.

A use-after-free vulnerability has been identified in the Linux kernel's mt76 wireless driver. This issue arises when the driver improperly manages memory related to wireless client identifiers, leading to potential memory corruption. The vulnerability was detected by the Kernel Address Sanitizer (KASAN), which reported a read operation from a freed memory address. The problem occurs in the mt76_txq_schedule function, where the transmission queue's client identifier pointer is not adequately protected, allowing for unsafe memory access.

A deadlock vulnerability has been identified in the Linux kernel's bcache component, specifically related to journal bucket management. This deadlock can occur when all journal buckets are filled by active journal sets under heavy write I/O load. During cache set registration after a reboot, the system loads active journal sets and reinserts them into the btree, a process known as journal replay. If this process triggers a btree node split, new journal requests may be generated. However, if there is no space in the journal buckets, the replay must wait for a bucket to be freed, leading to a deadlock situation. The vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's rtl818x wireless driver can lead to a kernel panic when using rtl8180 or rtl8185 network cards. The issue arises from the driver attempting to use a transmission queue that has not been initialized, which can cause a 'divide error' crash. This vulnerability was introduced when wpa_supplicant was updated from version 2.9 to 2.10, as the new version started using a priority that the affected driver does not support. The problem has been resolved by patching the driver to ignore the skb priority for these specific cards, which only have one transmission queue.

A vulnerability in the Linux kernel's TCP implementation has been addressed by adding accessors to read and set the TCP send congestion window (snd_cwnd). This change was prompted by previous issues where the assumption that snd_cwnd was always greater than zero was violated. Recently, the syzbot tool reported a warning related to zero congestion window values, which could lead to significant debugging challenges. The new accessors aim to prevent snd_cwnd from being set to invalid values, thereby improving the robustness of TCP congestion control.

A refcount leak vulnerability has been identified in the Linux kernel's MIPS CPC component. The issue arises from a missing reference count release, which should have been applied after finding a compatible device node. This oversight can lead to improper memory management.

A null pointer dereference vulnerability has been identified in the Linux kernel's IOMMU/ARM-SMMU component. The issue arises in the 'arm_smmu_device_probe()' function when 'platform_get_resource()' returns NULL. This can lead to a null pointer dereference when the 'res' variable is used. The vulnerability has been addressed by modifying the code to use 'res' only after 'devm_ioremap_resource()' has checked it, and by employing 'devm_platform_get_and_ioremap_resource()' to streamline the code.

A vulnerability in the Linux kernel's PREEMPT_RT version has been identified, related to the handling of boot parameters for tracing initialization calls. When specific tracing parameters are set, the kernel's output function is invoked while holding a spin lock in a context that does not allow sleeping. This issue arises because, in the PREEMPT_RT kernel, regular spin locks are replaced with sleepable real-time spin locks, leading to a violation of context requirements. The vulnerability was triggered by enabling the 'trace_event=initcall:initcall_start tp_printk=1' parameters, causing a sleeping function to be called from an invalid context, as reported in the kernel's locking spinlock real-time file.

A vulnerability in the Linux kernel's rpcrdma component can lead to a NULL pointer dereference. This issue occurs when an RDMA server returns a fault format reply, causing an NFSv3 client to incorrectly treat it as a callback call when the callback service is absent. The vulnerability arises in several different versions and ranges of the Linux kernel.

A vulnerability in the Linux kernel's Zynqmp DMA engine has been identified, related to a potential overflow in the handling of descriptor sizes within the DMA channel management functions. The issue arises because the descriptor size and the number of descriptors are treated as 32-bit values, which could lead to an overflow in certain multiplication scenarios, despite the overflow not being currently observed. The vulnerability has been addressed by changing the descriptor size data type to size_t, thereby preventing the potential overflow. Additionally, the fix reuses the ZYNQMP_DMA_DESC_SIZE macro in the argument for the dma_alloc_coherent function, improving consistency and clarity.

A null pointer dereference vulnerability has been identified in the Linux kernel's IOMMU ARM SMMU V3 implementation. This issue arises because the code does not properly check the return value of the platform_get_resource() function. If platform_get_resource() returns NULL, it can lead to a null pointer dereference, causing a potential crash or undefined behavior.

A vulnerability in the Linux kernel's F2FS (Flash-Friendly File System) implementation involves the improper use of warning statements in the validation of block addresses. The function 'f2fs_is_valid_blkaddr' triggers a warning if the block address is outside the expected range, particularly for certain data types. This issue can be exploited to bypass normal validation checks, potentially leading to further issues in file system integrity or performance.

A vulnerability in the Linux kernel's F2FS (Flash-Friendly File System) implementation can lead to an infinite loop when flushing node pages. This issue arises because the F2FS test suite can consistently trigger an I/O error, causing the node page flushing process to loop indefinitely. The problem has been addressed by modifying the F2FS code to prevent this infinite loop scenario.

A vulnerability in the Linux kernel's NFSv4 implementation can lead to deadlocks when handling layout get operations. This issue arises because layout locks are held across multiple RPC calls, such as 'setattr()', which can trigger a recall and potentially cause a deadlock. The vulnerability has been addressed by ensuring that layout locks are released before making further RPC calls.

A deadlock vulnerability has been identified in the Linux kernel's staging driver for the RTL8192E wireless chipset. The issue arises in the 'rtllib_beacons_stop()' function, where a thread (Thread 1) sends a beacon while holding a lock. This thread then calls 'del_timer_sync()' to wait for a timer to stop, but the timer handler needs the same lock, creating a circular wait condition that causes the function to block indefinitely. The vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's tty component could lead to a resource leak during the 'icom_probe' process. This issue arises when 'pci_read_config_dword' fails, as the allocated resources are not properly released. The vulnerability has been addressed by modifying the probe function to call 'pci_release_regions' and 'pci_disable_device' in such failure scenarios, ensuring that resources are recycled appropriately.

A deadlock vulnerability has been identified in the Linux kernel's USB host driver, specifically within the oxu_bus_suspend() function. The issue arises when the function holds a lock and simultaneously waits for a timer to stop, creating a circular dependency that causes the function to block indefinitely. This deadlock occurs because the timer handler requires the same lock that oxu_bus_suspend() is holding, leading to a situation where both threads are waiting on each other and cannot proceed.

A memory leak vulnerability has been identified in the Linux kernel's staging RTL8712 driver. The issue arises in the 'r871xu_drv_init()' function, where the 'r8712_init_drv_sw()' failure prevents proper release of memory allocated by 'r8712_alloc_io_queue()'. This memory leak occurs because 'r8712_usb_dvobj_deinit()' does not execute under these failure conditions. The vulnerability can be exploited by causing 'r8712_init_drv_sw()' to fail, leading to an unaddressed memory allocation. The problem is exacerbated because 'r8712_usb_dvobj_deinit()' is not called in a way that accounts for the driver's initialization state, leaving allocated resources unreleased.

A deadlock vulnerability has been identified in the Linux kernel's handling of Wi-Fi events, specifically within the RTL8192BS driver. The issue arises in the rtw_joinbss_event_prehandle() function, where two threads can become stuck waiting for each other to release locks, causing a permanent blockage. This deadlock occurs because one thread holds a lock while waiting for a timer to stop, and the timer's handler also requires the same lock, leading to a circular wait condition.

A refcount leak vulnerability has been identified in the Linux kernel's xillybus character driver. The issue arises in the xillyusb_probe function, where usb_get_dev is called, but usb_put_dev is not properly invoked before releasing the device, leading to a reference count leak.

A deadlock vulnerability has been identified in the Linux kernel's RTL8723BS Wi-Fi driver, specifically within the rtw_surveydone_event_callback() function. The issue arises when one thread holds a lock and waits for a timer to stop, while another thread requires the same lock to proceed, creating a permanent block. The vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's extcon device management can lead to a kernel Oops error. This issue arises because the state_show function can be called intermittently before the driver data is fully set, causing a null reference that triggers the Oops error. The vulnerability has been addressed by modifying the driver registration process to occur after the driver data is established.

A null pointer dereference vulnerability has been identified in the Linux kernel's Synclink GT driver. This issue arises in the 'slgt_clean' function when the driver fails to allocate an HDLC device. If the driver module is removed at this point, it triggers a general protection fault due to a null pointer dereference. The vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's DWC3 USB host controller implementation has been addressed. The issue arose from the unnecessary assignment of ACPI companions to xHCI ports and USB devices, which inadvertently replaced the secondary pointer of the firmware node for the parent DWC3 device. This unintentional sharing of the primary firmware node created potential side effects, such as resource leaks. The vulnerability has been resolved by stopping the ACPI companion assignment, as it is no longer needed.

A deadlock vulnerability has been identified in the Linux kernel's handling of IEEE 802.11 beacons, specifically within the RTL8192U staging driver. The issue arises in the 'ieee80211_beacons_stop()' function, where a circular wait condition occurs between two threads. Thread 1 holds a lock while waiting for a timer to stop, and Thread 2 requires the same lock to release the timer, leading to a permanent block. The vulnerability has been addressed by modifying the function to allow the timer to be released without holding the lock, thereby preventing the deadlock.

A deadlock vulnerability has been identified in the Linux kernel's handling of serial communication, specifically within the sa1100_set_termios() function. The issue arises when one thread holds a lock while waiting for a timer to stop, and another thread attempts to acquire the same lock, leading to a permanent blockage. This vulnerability affects the tty subsystem of the Linux kernel.

A deadlock vulnerability has been identified in the Linux kernel within the RTL8192EU driver. The issue arises in the 'rtw_joinbss_event_prehandle()' function, where a timer is set while holding a lock. This creates a situation where the timer handler also requires the same lock, leading to a permanent blockage. The vulnerability has been addressed by modifying the function to allow the timer handler to access the necessary lock, thus preventing the deadlock.

A vulnerability in the Linux kernel's USB host component, specifically in the isp116x driver, has been addressed. The issue arose because the return value of the platform_get_resource() function was not properly checked. If platform_get_resource() returned NULL, it could lead to a null pointer dereference. The vulnerability has been resolved by adding the necessary checks to prevent this dereference.

A vulnerability in the Linux kernel's RTL8712 USB driver has been addressed, concerning uninitialized memory in the 'usb_read8()', 'usb_read16()', and 'usb_read32()' functions. When the 'r8712_usbctrl_vendorreq()' function returns a negative value, the 'data' variable in the read functions is left uninitialized. This issue was detected by the Kernel Memory Sanitizer (KMSAN), which reported the use of an uninitialized value in a string processing function, leading to potential information leakage through the kernel's printk logging system.

A race condition vulnerability has been identified in the Linux kernel's Network Block Device (NBD) module. This issue arises during the concurrent execution of the 'nbd_alloc_config()' function and the removal of the NBD module. The problem occurs because 'try_module_get()' returns false, allowing 'nbd_alloc_config()' to proceed without proper validation. As a result, this race condition can cause a resource leak of 'nbd_config' and related resources, such as 'recv_workq', and trigger a NULL pointer dereference in the 'nbd_read_stat()' function, leading to a kernel oops.

A vulnerability in the Linux kernel's USB gadget driver can lead to a NULL pointer dereference. This issue arises because the driver improperly resets the 'bus' entry of the gadget's driver, interfering with the gadget subsystem's new bus management. The vulnerability has been observed in the 'dwc2' USB gadget driver on ARM architectures, particularly in Samsung Exynos devices, with the issue triggered during the module loading process.

A vulnerability in the Linux kernel's RTL8712 USB driver has been addressed, concerning an uninitialized variable issue in the 'r871xu_drv_init' function. The problem arises when the 'tmpU1b' variable, after calling 'r8712_read8' with the 'EE_9346CR' parameter, returns 0. In this case, the 'mac[6]' variable remains uninitialized, potentially leading to undefined behavior. This issue was detected by the Kernel Memory Sanitizer (KMSAN), which reported the uninitialized value in the 'r871xu_drv_init' function.

A denial-of-service vulnerability has been identified in the Linux kernel's Network Block Device (NBD) subsystem. When using 'qemu-nbd' to disconnect a device, the process can become unresponsive for an extended period, blocking for over 368 seconds. This hang occurs because the 'NBD_DISCONNECT' command fails, leaving requests in flight that cannot be cleared due to a change in how the NBD module handles request timeouts. As a result, the requests remain incomplete, causing a prolonged I/O hang.

A deadlock vulnerability has been identified in the Ceph file system implementation of the Linux kernel. This issue arises when the client holds certain file operation caps while waiting for a metadata server (MDS) to respond, creating a circular wait condition. The vulnerability occurs in scenarios where a file is created with read-write permissions and the request is sent to a specific MDS. The problem is triggered when the client attempts to write to the file, prompting a request for file metadata that conflicts with the client's held caps, leading to a deadlock.

A race condition vulnerability has been identified in the Linux kernel's Network Block Device (NBD) module. This issue arises during the module's cleanup process, where the netlink command handling may not synchronize properly with module removal. As a result, this can lead to a null pointer dereference, causing a kernel oops error. The vulnerability was observed in Linux kernel version 5.14.0-rc4.

A vulnerability in the Linux kernel's AMD display driver can lead to a divide-by-zero error, causing a system panic. This issue arises because the driver does not properly check if a divisor is zero before performing a division, potentially leading to a critical failure.

A vulnerability in the Linux kernel's netfilter component, specifically in nf_tables, has been addressed. The issue involved a stack leak into userspace, which could occur because registers were not properly initialized in the nft_do_chain() function. This vulnerability could potentially be exploited to leak sensitive information from the kernel stack to userspace.

A vulnerability in the Linux kernel's Advanced Linux Sound Architecture (ALSA) Open Sound System (OSS) layer has been identified, related to improper buffer allocation for Pulse Code Modulation (PCM) data. This issue arises when the PCM OSS layer creates a temporary buffer for data conversion, which can unexpectedly exceed the maximum integer value, leading to an overflow. The vulnerability has been addressed by introducing a 1MB upper limit on buffer sizes, ensuring that temporary allocations remain within a manageable range.

A use-after-free vulnerability has been addressed in the Linux kernel's Advanced Linux Sound Architecture (ALSA) subsystem. This issue arose from a lack of proper checks and protections against concurrent calls to the PCM hardware parameters and hardware free IOCTLs. Such races could lead to a use-after-free condition. The vulnerability has been mitigated by introducing a new mutex, 'runtime->buffer_mutex', to safeguard these overlapping calls. The patch also slightly modifies the IOCTL functions for improved code simplicity.

A double free vulnerability has been identified in the Linux kernel's mac80211 component, specifically related to mesh networking. This issue arises when a device leaves a mesh network and then rejoins, causing a memory corruption through improper handling of mesh information elements. The vulnerability can lead to kernel panics and was first observed in an application called 'Senf', which uses its own network management rather than the standard wpa_supplicant.

A vulnerability in the Linux kernel's user access handling has been addressed. Three architectures improperly check the end of a user access against the address limit, potentially leading to an integer overflow. This flaw allows the passing of a negative length or another overflow, resulting in a false success return when it should not occur. The vulnerability has been fixed by adopting a more reliable implementation that optimizes for a constant 'size' argument, transforming the common case into a single comparison.

A vulnerability in the Linux kernel's Advanced Linux Sound Architecture (ALSA) subsystem has been addressed. The issue stemmed from a lack of synchronization during concurrent preallocation of PCM (Pulse Code Modulation) buffers via proc files. This oversight could potentially lead to a use-after-free condition or other related problems. The vulnerability has been mitigated by applying the PCM open mutex to the proc write operation, thereby preventing the race conditions associated with concurrent proc writes and PCM stream operations.

A vulnerability in the Linux kernel's TPM (Trusted Platform Module) handling has been identified, specifically related to reference counting for the TPM chip structure. This issue can lead to a use-after-free condition. The vulnerability arises when the TPM device is accessed through the TPM 2 character device interface while the reference count is already zero, causing a warning about an invalid reference count operation. The problem is linked to the timing of when the TPM 2 device is registered and how the reference count is managed, particularly after certain TPM commands are sent.

A vulnerability in the Linux kernel's TPM (Trusted Platform Module) handling has been identified, specifically within the TPM 2.0 operations. The issue arises from a race condition related to the management of TPM spaces, which can lead to a null pointer dereference. This vulnerability was introduced during a series of changes aimed at removing nested TPM operations, where the proper synchronization was overlooked in certain functions. Although the flaw is typically brief and occurs only under specific circumstances, there have been reports of it being exploited in practice.

A vulnerability in the Linux kernel's IIO accelerometer driver for the MMA8452 sensor has been addressed. The issue arose from incorrect logic in retrieving the MMA8452 data, specifically in how the device's I2C client was identified. The original approach inadvertently worked by using the device's driver data, but after a recent commit removed unnecessary self-driver data, this method failed, leading to a null pointer dereference and a kernel crash when the available scale was accessed from userspace. The vulnerability has been fixed by properly using the device's driver data to obtain the IIO device reference, ensuring correct I2C client identification.

A memory leak vulnerability has been addressed in the Linux kernel's coresight component. The issue arose during the device registration process, where the 'device_initialize()' function was called without properly releasing the device reference in case of a registration failure. To mitigate this memory leak, the 'put_device()' function should be used for error handling instead of directly freeing the device.

A vulnerability in the Linux kernel's firmware sysfb driver has been addressed, which involved a platform-device leak in the error handling path of the sysfb_create_simplefb function. This issue could occur if the registration of a platform device failed, leading to a resource leak by not properly freeing the device. The vulnerability was present in the stable Linux kernel versions through 5.14.

A vulnerability in the Linux kernel's F2FS file system quota management has been identified, where improper handling of quota synchronization can lead to a NULL pointer dereference. This issue arises because the loop condition in the quota synchronization function does not correctly pass the active quota type, allowing the compiler to optimize away a crucial check. As a result, a NULL pointer dereference occurs, causing a kernel panic. This vulnerability affects Linux kernel versions 5.4.179-arter97-r8-64666-g2f16e087f9d8.

A vulnerability in the Linux kernel's CIFS (Common Internet File System) implementation has been addressed. In a multiuser environment, each user maintains a separate connection structure for shared resources, leading to individual handles for cached directories. When unmounting such a share, it is crucial to release the pinned directory entry for each connection, rather than just the master connection. Failing to do so results in warnings during the unmount process, indicating that directory entries are still in use.

A vulnerability in the Linux kernel's NFS server component (NFSD) has been addressed. The issue was an underflow in the function 'nfssvc_decode_writeargs()', which could potentially lead to unexpected behavior. The vulnerability arose because the 'len' parameter in the 'args' structure did not have a defined lower bound, allowing for the possibility of an underflow. This issue has been resolved by changing the parameter type to unsigned, eliminating the risk.