CVE Catalog

A vulnerability in the Linux kernel's ASoC codecs for WC938X has been addressed. The issue involved accessing enums as integers, which led to out-of-bounds array access on AArch64 platforms where the size of long is 8 bytes, compared to the 4-byte size of the enum. The vulnerability has been fixed by using enumerated items instead of integers.

A vulnerability in the Linux kernel's ALSA firewire-lib component has been addressed. The issue involved an uninitialized flag for AV/C deferred transactions, which could lead to undefined behavior. The vulnerability was identified by Undefined Behavior Sanitizer (UBSAN) as an invalid load of a boolean value. This problem arose because the 'deferrable' flag could remain uninitialized for non-control/notify AV/C transactions, potentially causing issues with AV/C responses that use INTERIM status, although such responses are not applicable to the affected transactions.

A vulnerability in the Linux kernel's media subsystem, specifically within the stk1160 driver, has been addressed. The issue arose in the video buffer management during the streaming process. When the 'start_streaming' callback failed, the driver incorrectly marked all queued buffers with 'VB2_BUF_STATE_ERROR'. The correct behavior should have been to return these buffers with 'VB2_BUF_STATE_QUEUED'. This mismanagement not only introduced an error state but also triggered a warning about the improper handling of the streaming process.

A memory leak vulnerability has been identified in the Linux kernel's ASoC Atmel component. The issue arises from improper error handling in the 'snd_proto_probe' function, where a device_node pointer returned by 'of_parse_phandle()' is not correctly released in error paths. This oversight can lead to a refcount leak. The vulnerability has been addressed by ensuring that 'of_node_put()' is called in error handling scenarios as well.

A vulnerability in the Linux kernel's ASoC rockchip component related to improper power management (PM) reference handling has been addressed. The issue arose because the 'pm_runtime_get_sync' function would increment the PM usage counter even if the operation failed, leading to a reference leak. This vulnerability has been fixed by replacing the problematic function with 'pm_runtime_resume_and_get', ensuring that the usage counter remains balanced.

A refcount leak vulnerability has been identified in the Linux kernel's ASoC Mediatek MT8192-MT6359 component. The issue arises because the device_node pointer, returned by of_parse_phandle() with an incremented refcount, is not properly released in error handling paths. This oversight can lead to a refcount leak. The vulnerability has been addressed by ensuring that of_node_put() is called in error handling as well.

A memory leak vulnerability has been identified in the Linux kernel's ASoC Atmel audio probe function for the AT91SAM9G20EK. The issue arises because a node pointer returned by 'of_parse_phandle()' lacks a corresponding 'of_node_put()' call, leading to a reference count leak. The vulnerability has been addressed by adding the missing 'of_node_put()' to prevent the refcount leak.

A refcount leak vulnerability has been identified in the ASoC MXS component of the Linux kernel. The issue arises in the 'mxs_sgtl5000_probe' function, which improperly handles error conditions. Specifically, when the 'codec_np' pointer is NULL while 'saif_np[0]' and 'saif_np[1]' are not NULL, the function fails to release the reference count of the regular pointers, leading to a memory leak.

A refcount leak vulnerability has been identified in the Linux kernel's ASoC Atmel WM8731 driver. The issue arises in the 'sam9x5_wm8731_driver_probe' function, where the device_node pointer, returned by 'of_parse_phandle()' with an incremented refcount, is not properly released using 'of_node_put()' in the error handling path. This oversight can lead to a memory leak by failing to decrement the reference count when the function encounters an error.

A memory leak vulnerability has been identified in the Linux kernel's ASoC Mediatek MT8195 driver. The issue arises during the device probe process, where the device_node pointer, returned by of_parse_phandle() with an incremented reference count, is not properly released. This oversight leads to a reference count leak, as of_node_put() is only called in the normal execution path, leaving the error path unaddressed.

A reference leak vulnerability has been identified in the Linux kernel's ASoC (ALSA System on Chip) component, specifically within the WCD934X codecs. The issue arises because the device_node pointer, returned by the of_parse_phandle() function with an incremented reference count, is not properly released using of_node_put() after it is no longer needed. This oversight can lead to a memory leak by failing to decrement the reference count, potentially causing resource management issues. The vulnerability has been addressed by adding the missing of_node_put() call in the WCD934X codec data parsing function.

A use-after-free vulnerability has been identified in the Linux kernel's ath11k driver, specifically for QCA6390 and WCN6855 chipsets. The issue arises when the driver fails to properly delete peer references after a station disconnects from an access point. This oversight, intended to prevent a firmware crash by altering the sequence of Wireless Management Interface (WMI) commands, inadvertently skipped essential peer deletion operations. As a result, a dangling pointer issue emerged, leading to a use-after-free condition that was flagged by the Kernel Address Sanitizer (KASAN). The vulnerability allows for unauthorized memory access, which could be exploited to execute arbitrary code or cause a system crash.

A vulnerability in the Linux kernel's ath11k driver was addressed by adding a missing reference count management function. The issue involved a refcount leak caused by not properly releasing a node pointer obtained through device tree node lookup functions. This leak could potentially lead to memory management issues.

A use-after-free vulnerability has been identified in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. This issue arises from a race condition between the BPF Type Format (BTF) module handling and the loading of kernel modules. When a kernel module is initialized, its BTF can be accessed by userspace and the BPF verifier before the module is fully ready. This premature access can lead to a situation where a BPF program successfully loads, but the module is subsequently freed, causing a use-after-free error when the BPF program is closed. The vulnerability has been addressed by modifying the BTF module handling to ensure that only fully initialized modules are accessed, thus preventing the race condition and the associated use-after-free vulnerability.

A vulnerability in the Linux kernel's ath9k_htc driver has been addressed, concerning uninitialized value bugs. These issues, reported by Syzbot, stem from missing field initializations. Specifically, in the 'htc_connect_service' function, the 'svc_meta_len' and 'pad' variables were not properly initialized. The 'htc_issue_send' function also failed to initialize the 'htc_frame_hdr::control' array. Although the firmware is expected to initialize it, the function has been updated to zero out the array, addressing the KMSAN (Kernel Memory Sanitizer) concerns.

A vulnerability in the Linux kernel's handling of VLAN filtering across DSA (Distributed Switch Architecture) switches has been addressed. The issue arose when changes to VLAN filtering were incorrectly synchronized across chips, leading to potential out-of-bounds accesses and crashes on certain switch chips, such as the mv88e6xxx. This vulnerability occurred because, when a port on one switch left a bridge, the VLAN filtering change was also applied to corresponding ports on other switches, regardless of whether those ports existed. This mismatch could cause the system to access invalid memory, resulting in a crash.

A memory leak vulnerability has been addressed in the Linux kernel's AMD display driver. The issue arose from a porting error that caused the stream assignment for a link to be retained without proper release, leading to a memory leak. The vulnerability has been resolved by correcting the porting error and reintroducing the necessary 'dc_stream_release()' call, which was originally intended as part of a previous patch.

A NULL pointer dereference vulnerability has been identified in the Linux kernel's AMD GPU display driver. The issue arises in the function 'amdgpu_dm_connector_add_common_modes()', where a mode variable is created and immediately passed to 'drm_mode_probed_add()'. This function dereferences the mode's head without any error handling, leading to a potential NULL pointer dereference if 'amdgpu_dm_create_common_mode()' fails. The vulnerability has been addressed by adding a NULL check for the mode variable.

A vulnerability in the Linux kernel's rtw88 driver has been addressed, which involved a memory overrun and leak during hardware scanning. The issue arose because insufficient memory was allocated, leading to buffer overwrites that caused the memory management module to raise access violation errors. Additionally, the vulnerability created potential memory leaks when the function returned early. The issue has been resolved by allocating the correct amount of memory and implementing proper deinitialization procedures.

A vulnerability leading to a potential memory leak has been identified in the Linux kernel's mt76 subsystem, specifically within the mt7915 component. The issue arises in the mt7915_mcu_add_sta function, where a Free allocated socket buffer (skb) may not be properly released in the event of a failure, creating a memory leak.

A vulnerability in the Linux kernel's Precision Time Protocol (PTP) implementation has been addressed. The issue arose when a physical clock was unregistered while still having associated virtual clocks, leading to a page fault error. This problem could be triggered by unloading a driver that provides a PTP clock with active virtual clocks.

A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) implementation has been identified, specifically related to the handling of BTF (BPF Type Format) declaration tags for functions. This issue can lead to a general protection fault, likely caused by a non-canonical address. The vulnerability arises because the BTF declaration tag for function types does not have a proper 'resolve' callback, unlike struct, union, or variable types. When the BTF parser encounters an illegal function type declaration, it can trigger a null pointer dereference error, as the parser attempts to access a function prototype type that is out of range.

A vulnerability in the Linux kernel's igc driver has been addressed, which caused kernel warnings when the RX ring parameters were changed using ethtool. The issue arose because the driver did not properly unregister the XDP (eXpress Data Path) receive queue information before registering it again, leading to a warning about a missing unregister. This vulnerability could be triggered by calling ethtool to modify the RX ring parameters on an interface using the igc driver.

A vulnerability in the Linux kernel's asix driver has been addressed, which involved improper error handling of USB read errors. The issue arose because the asix_read_cmd() function sometimes read fewer bytes than requested, leading to the potential use of uninitialized values. The vulnerability has been resolved by adding sanity checks to ensure that the number of bytes read meets the requested amount, and by implementing the necessary error handling throughout the driver code.

A memory leak vulnerability has been identified and fixed in the Linux kernel's mt76 mt7921s component. The issue arose in the mt7921_load_patch routine, where firmware data was not properly released, leading to a potential memory leak.

A memory leak vulnerability has been identified in the Linux kernel's power supply management for the AB8500 component. The issue arises in the 'ab8500_fg_sysfs_initkobject_init_and_add()' function, which improperly retains a reference to a kobject even when an initialization error occurs. This oversight can lead to a memory leak, as the allocated memory for the kobject is not released. The vulnerability has been addressed by modifying the function to call 'kobject_put()' for proper memory management.

A use-after-free vulnerability has been identified in the Linux kernel's CXL (Compute Express Link) port management. This issue arises in versions of the kernel that include KASAN (Kernel Address Sanitizer) and DEBUG_KOBJECT_RELEASE, where a decoder release function may prematurely free a port reference. The vulnerability allows a read operation of size 8 from an invalid memory address, potentially leading to memory corruption or unauthorized access to sensitive data.

A vulnerability in the Linux kernel's drm/bridge/anx7625 component allows for an overflow issue when reading Extended Display Identification Data (EDID). The vulnerability arises because the EDID block can exceed 256 bytes, necessitating the use of an 'int' type instead of 'u8' for the 'edid_pos' variable.

A NULL pointer dereference vulnerability has been identified in the Linux kernel's Direct Rendering Manager (DRM) subsystem, specifically within the Qualcomm Snapdragon (MSM) DisplayPort (DP) implementation. This vulnerability arises during compliance testing, where a test case provides a valid Extended Display Identification Data (EDID) with a deliberately incorrect checksum. The issue occurs because the connector for the DP panel is not properly assigned, leading to a NULL pointer dereference when the test case is executed.

A vulnerability in the Linux kernel's DAX (Direct Access) feature has been identified, where inodes are not properly flushed before the DAX cache is destroyed. This issue can be triggered by loading the 'nd_pmem' module and then removing it, which exposes remaining objects in the DAX cache that should have been cleared. The vulnerability arises because the 'dax_fs_exit()' function fails to flush inodes prior to cache destruction, leading to a potential memory management issue.

A memory leak vulnerability has been identified in the Linux kernel's VFIO PCI implementation. This issue arises when the PCI device's power management state is transitioned from D0 to D3hot and back to D0. During this process, the VFIO driver saves the PCI state to a local variable but fails to free the allocated memory under certain conditions, leading to a memory leak. This vulnerability can be exploited by looping the state transitions, causing an out-of-memory situation.

A vulnerability in the Linux kernel's Direct Rendering Manager (DRM) and DisplayPort (DP) handling has been addressed. The issue was an out-of-bounds (OOB) read caused by the link_status array being too small to properly read the Adjust Request Post Cursor2 register. This flaw was identified with a compiler warning about array bounds. The vulnerability arose in the 'drm_dp_get_adjust_request_post_cursor' function within the 'drm_dp_helper.c' file, where an array subscript accessed data outside the array's defined limits. The vulnerability has been fixed by replacing the common helper function with an open-coded fetch and decode, similar to existing practices in the AMD display driver.

A denial-of-service vulnerability has been identified in the Linux kernel's SCSI PM8001 driver. The issue arises in the 'pm8001_send_abort_all()' function, where the 'n_elem' field of the command control block (CCB) is not properly initialized. This oversight can lead to the task completion process encountering a CCB with a non-zero 'n_elem', which in turn causes invalid 'dma_unmap_sg()' calls. These erroneous calls can result in a system crash.

A reference leak vulnerability has been identified in the Linux kernel's Tegra DRM (Direct Rendering Manager) subsystem. The issue arises in the 'tegra_dsi_ganged_probe' function, where a reference obtained from 'of_find_device_by_node()' is not properly released when no longer needed. This oversight can lead to resource leaks, potentially causing memory management issues.

A race condition leading to a NULL pointer dereference has been identified in the Linux kernel's XSK (eXpress Data Path) socket teardown process. This vulnerability arises because the unbinding procedure incorrectly sets the socket's device reference to NULL before ensuring that all network processing has completed. As a result, a process may attempt to access a NULL device pointer, causing a crash. The issue is exacerbated by the fact that the synchronization mechanism used does not account for all data plane operations, potentially allowing the socket's state to be cleaned up prematurely while it is still in use.

A vulnerability in the Linux kernel's PowerPC architecture has been addressed, specifically related to how Data Segment Interrupts (SLB faults) are handled. In versions through 3.1, SLB faults do not provide a useful value in the Data Storage Interrupt Status Register (DSISR), leading to incorrect reporting of page fault types. This issue was particularly evident when using the xmon 'dump' command, where read accesses were misclassified as writes. The vulnerability arose because the fault handling logic relied on an undefined DSISR value, causing stale information to be used in determining the fault type.

A vulnerability in the Linux kernel's ath10k wireless driver has been addressed, concerning improper error handling in the management of certain resources. The issue arises because the device_node pointer, obtained through the of_parse_phandle() function, is returned with an incremented reference count. The driver fails to appropriately decrement this reference count in error scenarios, leading to a memory leak. This vulnerability affects several versions of the Linux kernel.

A reference counting vulnerability has been identified in the Linux kernel's MTD (Memory Technology Device) raw NAND Atmel controller. This issue arises in several error handling paths involving a refcounted object, 'nc->dmac'. In these paths, the function returns an error code without properly balancing the reference count of 'nc->dmac', which is increased by 'dma_request_channel()'. This oversight can lead to reference count leaks. The vulnerability has been addressed by ensuring the reference count is correctly decremented in the error handling paths.

A refcount leak vulnerability has been identified in the MIPS CDMM component of the Linux kernel. The issue arises because the of_find_compatible_node() function returns a node pointer with an incremented refcount, which is not properly released after use. This oversight can lead to a memory management issue, where the reference count of a node is not decremented as it should be, potentially causing resource leaks.

A memory leak vulnerability has been identified in the Linux kernel's MIPS architecture, specifically related to the management of page directory (PGD) entries. This issue arises when the system allocates more than one page for the PGD table, such as in 64-bit systems with 4KB page sizes and without 48-bit virtual address support. The generic PGD free function, introduced in a previous commit, only frees one page, leading to a memory leak when multiple pages are used. The leak can be detected by monitoring available memory while executing a command that generates file listings.

A memory leak vulnerability has been identified in the Linux kernel's BPF sockmap implementation, specifically within the 'tcp_bpf_sendmsg' function. This issue arises when the socket message is full, and 'sk_msg_alloc' returns an 'ENOMEM' error. In such cases, 'tcp_bpf_sendmsg' waits for memory to become available. However, if partial memory has already been allocated, a memory leak occurs. The vulnerability has been addressed by trimming the allocated memory before waiting for more, and similar logic has been applied to other functions like 'tls_sw_sendmsg' that experience the same issue.

An integer underflow vulnerability has been identified in the Linux kernel's RDMA/irdma component. The issue arises in the 'irdma_sc_ceq_init()' function within the 'ctrl.c' file, where a subtraction operation could potentially underflow. This vulnerability is linked to the 'max_ceqs' value, which is derived from the firmware and could be zero, leading to the underflow condition.

A memory leak vulnerability has been identified in the Linux kernel's BPF sockmap implementation. During the teardown of a TCP connection, the 'tcp_bpf_sendmsg' function can inadvertently enqueue data onto the ingress message queue. This occurs while the teardown process is attempting to free the data, leading to a conflict. The issue arises because the 'sk_psock_queue_msg' function charges memory for the message, which must be released, creating a potential memory management problem.

A memory leak vulnerability has been identified in the Linux kernel's RDMA/mlx5 component. This issue arises in the event subscription error handling routine, where a failure in the second 'xa_insert()' call does not properly release the 'obj_event' memory. As a result, the unreleased memory creates a leak. The vulnerability has been addressed by correcting the error handling flow to ensure that the memory is freed, preventing the leak.

A vulnerability in the Linux kernel's BPF sockmap implementation can lead to improper memory management. During the teardown of a socket, the memory associated with sk_msg can be double uncharged, potentially allowing for use-after-free conditions. This issue arises when tcp_bpf_sendmsg is called while a socket is being torn down, leading to sk_msg_return uncharging the message memory, followed by sk_msg_free, creating a risk of freeing memory that is still in use.

A vulnerability in the Linux kernel's TCP BPF (Berkeley Packet Filter) message handling has been identified. This issue arises in the 'tcp_bpf_send_verdict' function, where the message size is not properly accounted for, leading to an incorrect charge of the message's socket buffer size. As a result, the 'sk_forward_alloc' allocation is not accurately updated, which can cause a warning related to stream queue management. The vulnerability is present in the BPF sockmap functionality of the Linux kernel.

A double free vulnerability has been identified in the Linux kernel's handling of AMD graphics processing unit (GPU) resets) on Display Core (DC) streams. This issue arises because the reset process clears link encoder assignments while freeing an extra reference held by the encoder interface. However, the backup state, which is created before the reset, still contains valid assignments. After the reset, the link encoder assignments need to be cleared again, but this process inadvertently leads to a double free, causing a null pointer dereference.

A vulnerability in the Linux kernel's Bluetooth subsystem, specifically within the hci_uart component, has been addressed. The issue stemmed from a missing NULL pointer check, which could lead to a general protection fault. The flaw occurred because the hu->serdev variable could be NULL, and passing &serdev->dev without proper validation could cause a crash.

A race condition has been identified in the Linux kernel's ibmvnic driver, specifically between the transmit and reset processes. This race can cause the transmit function to access a transmission descriptor that has already been freed, leading to a NULL pointer dereference. The issue arises when the transmit queue is restarted before a reset is fully completed, allowing a transmission to be processed with an invalid descriptor, which can cause a kernel crash.

A vulnerability in the Linux kernel's Bluetooth subsystem, specifically within the btmtksdio driver, has been addressed. The issue arose because the interrupt handler, btmtksdio_interrupt, was accessing an uninitialized pointer. This situation occurred when the Bluetooth device was powered on and interrupts were enabled before the driver had fully initialized its data. As a result, the interrupt handler could cause a kernel oops, a type of error that leads to a system crash.