CVE Vulnerability Catalog

In the Linux kernel, the drm/msm/dpu driver has a mismatch between voltage and frequency during runtime resume. Calling dev_pm_opp_set_rate(dev, 0) drops the MMCX rail to MIN_SVS while the core clock remains at highest frequency, potentially causing instability or system crash.

In the ASoC audio driver for Qualcomm platforms (qdsp6), the widget type is not checked before accessing private data. A virtual widget may lack an associated DSP graph, leading to incorrect memory access.

In the Linux kernel, the PCI driver for Tegra194 has a CBB timeout caused by DBI register access before core power-on. When PERST# is deasserted twice, pci_epc_deinit_notify() and dw_pcie_ep_cleanup() are called before reset_control_deassert(), causing a timeout.

In the GFS2 filesystem of the Linux kernel, a NULL pointer dereference can occur in gfs2_log_release() during unmount when sdp->sd_jdesc is NULL. The previous patch missed this case.

In the Linux kernel, the efi/capsule-loader module has an incorrect sizeof in phys array reallocation, leading to a potential heap buffer overflow on 32-bit PAE systems.

In the Linux kernel, a vulnerability was found due to incorrect class initialization ordering in the fwctl driver. When the CXL module is loaded before fwctl, the fwctl class registration is not yet complete, causing the knode_class initialization to be skipped. On device removal, a NULL pointer dereference occurs.

In the Linux kernel, the OCFS2 filesystem has a vulnerability due to missing input validation before caching in the OCFS2_IOC_GROUP_ADD operation. An attacker can trigger a BUG_ON in ocfs2_set_new_buffer_uptodate(), causing a system crash.

A vulnerability in the Linux kernel causes an out-of-bounds read in the hash_algo_name array during IMA initialization. The issue occurs when the TPM 2.0 module supports a hash algorithm (e.g., SHA3-256) not yet defined in the kernel, leading to memory access errors and potential system crash.

A deadlock vulnerability was found in the Linux kernel's hid_post_reset() function in the HID USB driver. The issue occurs when a USB device includes both a HID component and a storage/UAS component that are reset together. Memory allocations in hid_pre_reset() and hid_post_reset() may perform blocking I/O, leading to a deadlock on the mutex held during device reset.

A deadlock vulnerability was discovered in the Linux kernel's BPF sockmap mechanism during AF_UNIX socket iteration. The issue occurs when bpf_iter_unix_seq_show() takes the fast path of lock_sock_fast() and the iter program attempts to update a sockmap, causing recursive locking of the same slock-AF_UNIX lock.

A vulnerability was found in the Linux kernel's sockmap mechanism for AF_UNIX sockets. During connect(), the socket state is set to TCP_ESTABLISHED before the peer socket is assigned, allowing a race condition with sockmap updates that leads to a NULL pointer dereference.

In the Linux kernel, a vulnerability in the BPF subsystem causes a NULL pointer dereference in map_kptr_match_type() when a scalar register is stored into a kptr slot. The code accesses reg->btf without first checking if the register has a BTF type, leading to a crash.

In the Linux kernel, a memory leak was found in the i3c driver for Renesas platforms. The xfer structure allocated by renesas_i3c_alloc_xfer() was never freed in the renesas_i3c_i3c_xfers() function.

In the Linux kernel's NTFS3 filesystem (ntfs3), a vulnerability was found involving the use of an uninitialized 'lcn' variable in the ntfs_iomap_begin() function. The issue occurs when the block length (len) is zero, causing 'lcn' to be used before initialization.

In the Linux kernel USB Type-C driver, an error pointer dereference was found. The function does not properly check the partner registration result, which can lead to ERR_PTR dereference and potential system crash.

In the NTFS3 file system in the Linux kernel, a bug was found where the run load for VCN0 is missing in the attr_data_get_block_locked() function. This can lead to incorrect reads and trigger a WARN_ON(1) warning.

In the Linux kernel's NTFS3 filesystem, a vulnerability was found where the volume label is not properly null-terminated after UTF-16 to UTF-8 conversion. The ntfs_fill_super() function fails to add a trailing NUL, potentially causing out-of-bounds read when the label is displayed via ntfs3_label_show().

In the Linux kernel, the dell-wmi-sysman driver for x86 platforms has a vulnerability where firmware-provided strings are aggregated into fixed 512-byte buffers using strcat() without checking remaining space. This could lead to a buffer overflow if the combined strings exceed the buffer size.

In the Linux kernel, an integer overflow vulnerability was found in the sbc_execute_unmap() function of the SCSI target subsystem. The lack of protection against LBA + range wrapping on 64-bit overflow can lead to incorrect bounds checking.

In the Linux kernel, the ccu_mix driver for Spacemit SoCs has an inverted condition in ccu_mix_trigger_fc() that skips frequency change triggering. This causes kernel panics during cpufreq scaling.