CVE Vulnerability Catalog

A race condition in the Linux kernel's CoreSight TMC-ETR driver occurs when sysfs and perf modes are used simultaneously, triggering a WARN_ON() when hardware is enabled while the buffer is already initialized by perf mode.

In the Linux kernel pinctrl driver for Canaan K230, a NULL pointer dereference occurs during device tree parsing. The k230_pinctrl_parse_functions() function attempts to access the device pointer via info->pctl_dev->dev, but info->pctl_dev is initialized only after DT parsing completes, causing a crash.

In the Linux kernel PCI P2PDMA subsystem, the p2pmem_alloc_mmap() function uses an incorrect warning condition. After changing the initial page refcount from 1 to 0, the condition VM_WARN_ON_ONCE_PAGE(!page_ref_count(page)) falsely triggers a warning when the page has a refcount of 0.

In the Linux kernel, a patch for ASoC fsl_xcvr that attempted to add a missing lock in fsl_xcvr_mode_put() was reverted. The original patch caused a deadlock and hung task because the function is already called with the lock held.

In the Linux kernel, a potential NULL pointer dereference was found in the wpcm_fiu_probe() function of the SPI wpcm-fiu driver. platform_get_resource_byname() can return NULL, causing a crash when passed to resource_size(). The fix moves the fiu->memory_size assignment after the error check for devm_ioremap_resource() to prevent the issue.

In the Linux kernel, the linehandle_create() function has a NULL pointer dereference after calling retain_and_null_ptr(lh). A debug print tries to read from the already nulled pointer, causing a crash.

In the Linux kernel on ARM32 platforms, when SP804 is not registered as sched_clock, read_current_timer() calls sp804_read on an uninitialized sched_clkevt, causing a kernel Oops.

In the Linux kernel, the LOCALIO mechanism (NFS loopback optimization) is vulnerable to recursive deadlock during direct reclaim. Page cache allocations can trigger nfs_writepages, causing a deadlock.

In the Linux kernel fsl-edma DMA driver, the fsl_edma_remove() function manually disables clocks that are already automatically managed by devm_clk_get_enabled(). This triggers warnings on driver removal about attempting to disable an already disabled clock.

In the Linux kernel, the AppArmor module has a vulnerability where DFA (Deterministic Finite Automaton) tables from kernel or userspace are not guaranteed to be 8-byte aligned, causing unaligned memory accesses on various architectures. This triggers warnings and potential kernel panics.

In the Linux kernel, in the regulator core, the error path of regulator_resolve_supply() lacked proper locking, causing a lockdep warning. The fix uses regulator_put() instead of _regulator_put() and adds appropriate locking.

In the Linux kernel, in the octeontx2-af driver, a bug causes the PF driver to crash during kexec booting. During a kexec reboot, hardware state persists, and the PF driver may incorrectly assume AF is ready, leading to a crash.

In the Linux kernel, in the ath12k wifi driver, a bug occurs where stale link mappings in ahvif->links_map are not cleared. When arvif initialization in non-AP STA mode fails before creation, a stale entry remains, potentially triggering a WARN_ON when the same link ID is used.

In the Linux kernel, the Qualcomm GFX3D clock driver crashes when determining the clock rate due to a missing parent field in the parent request map. This regression was introduced by a change in the divider algorithm that now requires proper parent mapping.

In the Linux kernel, the amdgpu display driver had a NULL pointer dereference vulnerability in the amdgpu_dm_hpd_init() function. The code assumed dc_link was always valid, leading to a crash when setting up HPD interrupts for connectors without a valid link.

In the Kimi AI v1.0 web interface, the 'Preview' feature fails to sanitize or encode HTML/JavaScript payloads generated by the AI model. When a user switches to the 'Preview' tab, the malicious payload is rendered directly into the DOM, leading to arbitrary JavaScript execution in the victim's browser session.

The Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 responds to version.bind CHAOS TXT queries, disclosing the DNS resolver software version (unbound 1.22.0), aiding targeted attacks against known vulnerabilities.

The firmware of the Mercusys AC12G (EU) V1 router contains hardcoded WiFi driver credentials, including a RADIUS shared secret, WPS test key, and default PSK.

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes an undocumented /agileconfigreset endpoint that returns internal buffer contents to unauthenticated attackers on the adjacent network.

The Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized internal buffer contents when receiving HTTP POST requests to undefined paths, exposing server state to unauthenticated adjacent network attackers.