CVE Catalog

A vulnerability in the Linux kernel's DRM/MSM component can lead to null pointer dereferences. This issue arises when the 'aspace' variable is used without first checking its value, which can remain null in the absence of IOMMU, as seen on the msm8974 platform. The vulnerability has been addressed by ensuring that 'aspace' is properly validated before use.

A vulnerability in the Linux kernel's Advanced Linux Sound Architecture (ALSA) component allows for a null pointer dereference in the PCM (Pulse Code Modulation) subsystem. The issue arises because the pointer to the substream is dereferenced before it is checked for nullity, leading to potential instability. Although the PCM_RUNTIME_CHECK macro calls BUG_ON to handle such cases, it is still necessary to perform a pointer check before assigning the card pointer.

A vulnerability has been identified in the Linux kernel's networking component, specifically within the skb_checksum_help() function. This issue arises from the presence of two BUG() calls, which can lead to a crash. The syzbot tool has reported the ability to trigger these BUG() calls, indicating a flaw that needs to be addressed. The current BUG() calls could be replaced with WARN_ON_ONCE() to allow skb_checksum_help() to return an error code instead. However, it's important to note that syzbot will still cause a crash until the underlying issue is resolved.

A denial-of-service vulnerability has been identified in the Linux kernel's MediaTek VCodec decoder driver. When the driver is removed, it can cause a kernel crash if the driver supports sub-device mode. This occurs because a certain parameter is null, leading to a crash when the module is unloaded.

A vulnerability in the Linux kernel's HDMI driver for the DRM MSM subsystem can lead to a null pointer dereference. This issue arises because the code does not properly check the return value of the 'platform_get_resource_byname()' function. If this function returns NULL, it can cause a null pointer dereference, potentially leading to a system crash or other unintended behavior.

A null pointer dereference vulnerability has been identified in the Linux kernel's MTD raw NAND Cadence driver. The issue arises in the 'cadence_nand_dt_probe()' function when 'platform_get_resource()' returns NULL, leading to a potential dereference of a null pointer. This vulnerability can be mitigated by rearranging the code to use the resource after it has been properly mapped, and by utilizing 'devm_platform_get_and_ioremap_resource()' to streamline the resource handling.

A logic error in the Linux kernel's handling of the RT5645 audio component can lead to a use-after-free vulnerability. This issue arises in the ASoC (ALSA System on Chip) layer when the RT5645 device is removed. The removal function, rt5645_i2c_remove(), incorrectly manages the order of operations by first canceling a work item related to jack detection and then deleting a timer associated with button checks. This flawed sequence can cause the timer's callback function to reschedule the canceled work, creating a potential use-after-free scenario. The vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's NVMe PCI component can lead to a NULL pointer dereference. This issue arises in the 'nvme_alloc_admin_tags' function, where the 'admin_q' variable may be set to an error state (typically due to insufficient memory) if the 'blk_mq_init_queue' call fails. When this error is propagated up the stack, it can trigger the 'nvme_remove_dead_ctrl' function, which checks only if the 'admin_q' is non-NULL. This oversight allows the function to attempt to quiesce a queue that doesn't exist, resulting in a bad or NULL pointer dereference.

A null pointer dereference vulnerability has been identified in the Linux kernel's Rockchip Video Output Processor (VOP) driver. This issue arises in the 'vop_bind()' function, where 'platform_get_resource()' may return NULL. If this occurs, calling 'resource_size()' will lead to a null pointer dereference. The vulnerability can be exploited by moving the 'resource_size()' call after 'devm_ioremap_resource()', which checks the resource for NULL before accessing it.

A vulnerability in the Linux kernel's DRM MSM MDP5 component can lead to a NULL dereference error. This issue arises in the 'mdp5_pipe_release' function, which does not currently check for errors when acquiring the modeset lock. As a result, 'mdp5_pipe_release' may encounter a NULL dereference if 'mdp5_get_global_state' returns a deadlock error. The vulnerability has been addressed by modifying 'mdp5_pipe_release' to check for errors and propagate them appropriately.

A use-after-free vulnerability has been identified in the Linux kernel's Direct Rendering Manager (DRM) subsystem, specifically within the Qualcomm Snapdragon MSM graphics driver. This vulnerability occurs during the runtime resume process, where a hardware configuration pointer is improperly set to NULL. As a result, the system attempts to access freed memory, leading to a kernel paging request error. The issue has been addressed in the official Linux kernel repository.

A vulnerability in the Linux kernel's DRM MSM MDP5 component allows for improper deadlock detection when acquiring the modeset lock. The issue arises because the 'mdp5_mixer_release' function does not currently check for error codes indicating a deadlock, which could lead to a null dereference. The vulnerability has been addressed by modifying 'mdp5_mixer_release' to properly check for and propagate error codes.

A null pointer dereference vulnerability has been identified in the Linux kernel's MTD (Memory Technology Device) subsystem, specifically within the Intel Rawnand driver. The issue arises in the 'ebu_nand_probe()' function when 'platform_get_resource()' returns NULL. This oversight can lead to a null pointer dereference by improperly using the 'res' variable before it is validated. The vulnerability has been addressed by rearranging the code to ensure 'res' is only used after 'devm_ioremap_resource()' has confirmed its validity, thus preventing the null pointer dereference.

A refcount leak vulnerability has been identified in the Linux kernel's ASoC Freescale driver, specifically within the 'imx_sgtl5000_probe' function. The issue arises because the 'of_find_i2c_device_by_node' function takes a reference, and error paths do not properly release this reference, leading to a memory leak.

A null pointer dereference vulnerability has been identified in the Linux kernel's V3D graphics driver. This issue arises when the 'perfmon' pointer is null, leading to a warning after the pointer has already been dereferenced. The vulnerability has been addressed by ensuring that 'perfmon' is checked for nullity before being dereferenced.

A vulnerability in the Linux kernel's mt76 driver for the mt7915 chip can lead to a NULL pointer dereference. This issue occurs in the 'mt7915_mac_fill_rx_vector' function when the chip does not support dual-band simultaneous connectivity (dbdc) and the hardware indicates a band index of 1.

A vulnerability in the Linux kernel's Direct Rendering Manager (DRM) component can lead to a NULL pointer dereference. This issue occurs in the 'drm/msm/disp/dpu1' area, specifically during the uninitialization phase. If the eDP modeset initialization fails because the panel is not ready, and the probe defers during the DRM bind process, the system incorrectly clears hardware interrupts and dereferences a null pointer. This flaw can cause a kernel crash by handling a NULL pointer as a valid memory address.

A refcount leak vulnerability has been identified in the Linux kernel's ASoC MXS-SAIF component. The issue arises in the 'mxs_saif_probeof_parse_phandle()' function, which returns a node pointer with an incremented reference count. The vulnerability occurs because the function does not properly decrement the reference count when the pointer is no longer needed, leading to a memory management issue.

A refcount leak vulnerability has been identified in the Linux kernel's handling of the PFUZE100 regulator. The issue arises in the function responsible for parsing regulator nodes from device tree overlays, where a reference count is improperly managed. This leak can lead to memory management issues, as the reference count is not decremented when the node is no longer needed.

A refcount leak vulnerability has been identified in the Linux kernel's HDMI audio driver for i.MX platforms. The issue arises in the 'imx_hdmi_probeof_find_device_by_node()' function, where a device reference is taken but not properly released. This leak occurs because the function 'devm_kzalloc()' can fail, leaving the reference unreturned, which could lead to memory management issues.

A use-after-free vulnerability has been identified in the Linux kernel's mt76 wireless driver. This issue arises during the removal of a station, where a race condition allows a transmission (tx) status skb (socket buffer) to be added to the status tracking IDR (Index Descriptor Register) after it has already been cleaned up. As a result, the wcid (wireless context identifier) remains linked in the status poll list, potentially leading to memory corruption. The vulnerability can be exploited by manipulating ongoing transmission activities to interfere with the status tracking process.

An array index out-of-bounds vulnerability has been identified in the Linux kernel's pvrusb2 media driver. The issue arises because the unit_number is initialized to -1 and, if the initialization table walk fails, this value remains unchanged. The code then uses this unvalidated value for array indexing, leading to potential out-of-bounds access. The vulnerability was reported by Syzbot.

A refcount leak vulnerability has been identified in the Linux kernel's ASoC Samsung component. The issue arises in the 'aries_audio_probeof_parse_phandle()' function, which returns a node pointer with an incremented reference count. The vulnerability occurs because the function fails to properly decrement the reference count before returning, leading to a memory leak. This issue can be exploited if 'extcon_find_edev_by_node()' fails, as the missing 'of_node_put()' call allows the leaked reference to persist.

A kernel crash vulnerability has been identified in the Linux kernel's mt76 driver, specifically within the mt7921 PCI removal process. The issue arises from the mt7921 interrupt handler being called while the 'devm_free_irq' function is still processing. This premature freeing of the mt76 device leads to a NULL pointer dereference, causing a kernel crash. The vulnerability has been observed in Linux kernel version 5.15.14-1.fc32.qubes.x86_64.

A null pointer dereference vulnerability has been identified in the Linux kernel's SPI-FSL-QSPI component. This issue arises because the code does not properly check the return value of the 'platform_get_resource_byname()' function. If this function returns NULL, it can lead to a null pointer dereference, causing a potential crash or undefined behavior.

A use-after-free vulnerability has been identified in the Bluetooth subsystem of the Linux kernel, specifically within the handling of Synchronous Connection-Oriented (SCO) sockets. This issue arises when the same socket is connected twice in quick succession, creating a race condition that results in two SCO connection objects being generated, but only one being linked to the socket. If the socket is closed before the SCO connection is fully established, the timer for the unlinked SCO connection object fails to cancel. Consequently, as the socket is being deallocated, the timer's callback function attempts to access the now-freed socket, leading to a use-after-free condition. This vulnerability has been assigned a CVSS score of 7.8.

A refcount leak vulnerability has been identified in the Linux kernel's ASoC TI J721E-EVM component. The issue arises in the 'j721e_soc_probe_*of_parse_phandle()' function, where a node pointer is returned with an incremented reference count. If the pointer is not needed anymore, the reference count should be decremented using 'of_node_put()' to prevent the leak. The vulnerability has been addressed by adding the missing 'of_node_put()' call.

A vulnerability in the Linux kernel's handling of Micrel PHY drivers can lead to a NULL pointer dereference. This issue occurs when the .probe function is defined in the phy_driver structure without accompanying .driver_data. The absence of .driver_data triggers a NULL pointer dereference. The vulnerability has been addressed by allowing the .probe function to be used without .driver_data, adding NULL checks to prevent the dereference.

A vulnerability in the Linux kernel's rtw89 wireless driver can lead to out-of-bounds memory access. This issue arises because the hardware may report incorrect MAC IDs, which can overwrite memory. The vulnerability was identified by Undefined Behavior Sanitizer (UBSAN) as an array index out-of-bounds error in rtw89/phy.c, where an index of 188 exceeded the valid range for a specific array type. The problem occurs in the rtw89_core module during the reception of data, particularly when the driver processes information from the PCI interrupt.

A use-after-free vulnerability has been identified in the Bluetooth btmtksdio component of the Linux kernel. This issue arises when the system accesses socket buffer data after the Bluetooth Host Controller Interface (HCI) has processed the frame, leading to potential memory corruption.

A vulnerability in the Linux kernel's Btrfs file system has been addressed, which involved a leak of anonymous device references in the 'create_subvol()' function. This issue occurred when 'btrfs_qgroup_inherit()', 'btrfs_alloc_tree_block()', or 'btrfs_insert_root()' failed, leading to a failure to release the anonymous device. The vulnerability has been resolved by reorganizing the error handling in the 'create_subvol()' function.

A memory leak vulnerability has been identified in the Linux kernel's thermal cooling device registration process. This issue arises in the thermal/core component when the __thermal_cooling_device_register() function is called. If the device_register() function fails, the thermal_cooling_device_destroy_sysfs() function needs to be invoked to free the allocated memory. The vulnerability was discovered during a fault injection test, which revealed an unreferenced object, indicating a memory leak.

A vulnerability in the Linux kernel's Direct Rendering Manager (DRM) subsystem can lead to a memory leak. This issue arises in the 'mdp5_crtc_cursor_set()' function, where the 'drm_gem_object_lookup' call can cause a memory leak if 'msm_gem_get_and_pin_iova' fails. The vulnerability is present in several versions of the Linux kernel.

A refcount leak vulnerability has been identified in the Linux kernel's SCMI regulator implementation. The issue arises because the function 'of_find_node_by_name()' returns a node pointer with an incremented reference count, which is not properly decremented after use. This oversight can lead to a memory management issue, where the reference count does not accurately reflect the actual usage, potentially causing resource leaks.

A use-after-free vulnerability has been identified in the Linux kernel's block I/O throttling mechanism. When a bio (block I/O) operation is throttled, the BIO_THROTTLED flag is set after the throttling timer is initiated. This can lead to a use-after-free condition if the bio completes before it is submitted, causing a memory access violation. The vulnerability was detected by the Kernel Address Sanitizer (KASAN), which reported a read of freed memory by a process handling I/O operations.

A use-after-free vulnerability has been identified in the Linux kernel's implementation of the ztailpacking feature within the erofs filesystem. This vulnerability arises because the tail pcluster may not represent a complete filesystem block when ztailpacking is applied, leading to a buffer copy overflow. The issue was highlighted by a Kernel Address Sanitizer (KASAN) report, which indicated that the vulnerability could be exploited during the decompression of data, potentially causing memory corruption.

A refcount leak vulnerability has been identified in the Linux kernel's IMX SC thermal driver. The issue arises because the function 'of_find_node_by_name()' returns a node pointer with an incremented reference count, which is not properly decremented after use. This oversight can lead to a memory management issue, where the reference count of a node is not correctly managed, potentially causing resource leaks.

A refcount leak vulnerability has been identified in the Linux kernel's DRM MSM A6XX component. The issue arises in the 'a6xx_gpu_initof_parse_phandle()' function, which returns a node pointer with an incremented refcount. The 'a6xx_gmu_init()' function then passes this node to 'of_find_device_by_node()' and 'of_dma_configure()'. While 'of_find_device_by_node()' takes a reference to the node, 'of_dma_configure()' does not require the node after use. The vulnerability can be exploited by failing to release the node reference properly, leading to a refcount leak.

A memory leak vulnerability has been identified in the Linux kernel's advertisement message handling. When a gateway receives an advertisement message, it extracts relay information that should be freed after processing. However, the current advertisement handler fails to release this information, leading to a memory leak.

A vulnerability in the Linux kernel's power management devfreq subsystem for the RK3399 DMC has been addressed. The issue was caused by not properly disabling an event device when removing it, leading to an unbalanced enable count. This could cause problems when unbinding the device from its driver.

A vulnerability in the Linux kernel's Broadcom thermal driver could lead to a NULL pointer dereference. The issue arises in the 'sr_thermal_probe' function, where 'platform_get_resource()' may return NULL. The vulnerability has been addressed by adding proper checks to prevent potential NULL dereferencing.

A vulnerability has been identified in the Linux kernel's Direct Rendering Manager (DRM) subsystem for the MSM (Mobile Station Modem) graphics driver. The issue arises in the IRQ (interrupt request) management, where the function 'msm_drm_uninit()' attempts to free an IRQ that was never requested. This situation occurs because 'msm_drm_uninit()' is called during error handling for 'msm_drm_init()', which can lead to a warning about freeing an already-free IRQ. The vulnerability is present in Linux kernel version 5.18.0-rc5-next-20220506-00033.

A refcount leak vulnerability has been identified in the Linux kernel's ARM Versatile platform. The issue arises in the 'dcscb_init' function, where the 'of_find_compatible_node' function returns a device_node pointer with an incremented reference count. The vulnerability can lead to a memory leak, as the increased reference count is not properly decremented before the function exits. This flaw has been addressed by adding a missing 'of_node_put' call to release the reference, preventing the leak.

A vulnerability in the Linux kernel bonding driver has been addressed, which involved inadequate Read-Copy-Update (RCU) protection. The issue arose in the 'bond_ethtool_get_ts_info' function, which can be called via 'setsockopt' without the necessary RCU lock, potentially leading to race conditions. This vulnerability was highlighted by syzbot, a kernel fuzzer that discovered the missing RCU protection could be exploited through socket options, creating a risk of improper synchronization and data handling.

A double free vulnerability has been identified in the Linux kernel's OCXL (OpenCAPI Express Layer) component. The issue arises in the 'ocxl_file_register_afuinfo_release' function, which is called during device unregistration when the reference count of 'info->dev' is zero. This situation creates an unnecessary double free condition, as 'ocxl_afu_put()' and 'kfree()' are called redundantly. The vulnerability has been addressed by modifying the error handling path to include a call to 'free_minor()' before returning, preventing the double free scenario.

A refcount leak vulnerability has been identified in the Linux kernel's PCI subsystem for Mediatek devices. The issue arises in the mtk_pcie_subsys_powerup() function, where the of_find_compatible_node() function returns a node pointer with an incremented refcount. The vulnerability occurs because the refcount is not properly released after use. The missing of_node_put() call has been added to address this issue.

A null pointer dereference vulnerability has been identified in the Linux kernel's power management domain handling. The issue arises in the 'ti_sci_pm_domains' component, where the memory allocation function 'devm_kcalloc' may fail, leading to a null pointer being dereferenced later in the code. This vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's DPAA2 Ethernet driver can lead to a use-after-free issue. The vulnerability arises because the TCP Segmentation Offload (TSO) header was DMA-unmapped before the virtual address was retrieved, resulting in an invalid address being used in a memory deallocation call. This issue has been addressed by modifying the order of operations to retrieve the virtual address before unmapping the DMA.

A vulnerability in the Linux kernel's handling of the ARM SCMI base protocol enumeration has been addressed. The issue arose because the validation of the number of protocols returned by the BASE_DISCOVER_LIST_PROTOCOLS command was flawed. The check used a sum of unsigned integers that could overflow, potentially allowing the validation to be bypassed if the returned value was sufficiently large. The vulnerability has been fixed by improving the validation process to avoid such overflow issues.

A vulnerability in the Linux kernel's AF_RXRPC implementation can lead to a NULL pointer dereference. The issue arises in the listen() handler, which allows setting the backlog up to 32. However, due to the preallocation circular buffers requiring one slot to be a dead slot, this can cause an oops error when the socket is closed. The problem occurs because the preallocation function allocates one too many calls, and the discard function cannot remove them, leading to a kernel NULL pointer dereference when the socket is released.