CVE Vulnerability Catalog

In the Linux kernel, a vulnerability was found in the AppArmor module where the per-CPU counter in aa_get_buffer can underflow. When the hold counter reaches zero while count is non-zero, it wraps to UINT_MAX, preventing buffer return to the global list and causing starvation on other CPUs and excessive memory allocations.

In the Linux kernel, a resource leak was found in the SCA3000 IIO driver. The sca3000_probe() function does not release the IRQ (spi->irq) registered via request_threaded_irq() when iio_device_register() fails.

In the Linux kernel, a memory leak was detected in the svs_enable_debug_write() function in the MediaTek SVS driver. The buffer allocated by memdup_user_nul() is not freed if kstrtoint() fails.

In the Linux kernel, a vulnerability was found in the PCI/P2PDMA mechanism. When vm_insert_page() fails in p2pmem_alloc_mmap(), the per-CPU pgmap reference is not released, causing memunmap_pages() to hang forever when trying to remove the PCI device.

In the Linux kernel HID intel-ish-hid driver, a NULL pointer dereference vulnerability was found in the ishtp_bus_remove_all_clients function. The issue occurs during a warm reset when the cl->device pointer may be NULL, leading to a kernel panic.

In the Linux kernel, a vulnerability was found in the arch_set_shadow_stack_status() function for ARM64 architecture. The alloc_gcs() function returns an error-encoded pointer on failure, not NULL. The previous NULL check failed to detect errors, which could lead to using an invalid GCS address.

In the Linux kernel, a vulnerability was found in the mfd: arizona driver where the wm5102_clear_write_sequencer() function may return an error, bypassing the cleanup sequence and causing a regulator resource leak. Regulators remain enabled, leading to resource exhaustion.

In the Linux kernel PHY driver for i.MX8QM HSIO, a NULL pointer dereference vulnerability was found. During probe, the refclk_pad pointer is set to NULL if the 'fsl,refclk-pad-mode' property is not defined in the device tree. The function imx_hsio_configure_clk_pad() uses this pointer unconditionally, which could lead to a system crash.

In the Linux kernel, a vulnerability was found in the netfilter packet filtering mechanism, specifically in red-black tree based sets (nft_set_rbtree). The issue is the lack of checking for partially overlapping intervals in anonymous sets, which can lead to incorrect filtering rule behavior.

A memory leak was detected in the Linux kernel in the pqi_report_phys_luns() function of the smartpqi driver for SCSI controllers. When encountering an unsupported data format or failing to allocate the rpl_16byte_wwid_list buffer, the function returned an error without freeing the previously allocated rpl_list buffer, leading to memory leaks.

In the Linux kernel, a vulnerability in the st33zp24 TPM driver was found where the locality is not released after a get_burstcount() error. When get_burstcount() returns -EBUSY due to timeout, st33zp24_send() exits without proper cleanup.

In the Linux kernel, memory leaks were found in XDR decoding functions in the auth_gss module of the SUNRPC protocol. The gssx_dec_ctx(), gssx_dec_status(), and gssx_dec_name() functions allocate memory via gssx_dec_buffer() but fail to free it when a subsequent decode operation fails, leading to memory leaks. The leak in gssx_dec_ctx() is particularly critical because the caller initializes buffer length fields to non-zero values, forcing memory allocation.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the wm97xx power supply driver. The issue occurs when an interrupt (IRQ) is registered before the power_supply structure is initialized, potentially leading to the use of an uninitialized pointer in the power_supply_changed() function.

In the Linux kernel, a reference leak was detected in the pcs_add_gpio_func() function in the pinctrl-single driver. The of_parse_phandle_with_args() function increments the reference count for the gpiospec.np node, but the loop iterating through all handles never releases these references, leading to a memory leak. The issue was detected by a static analysis tool and confirmed during code review.

In the Linux kernel, the MCTP I2C driver did not initialize the event handler read buffer, causing uninitialized stack data to be returned. For i2c-aspeed and i2c-npcm7xx drivers this led to leakage of uninitialized values.

In the Linux kernel's NTFS3 filesystem, an infinite loop vulnerability was found when processing the range [valid : pos). If the valid value cannot be read correctly and remains the same, a process hang may occur, as reported by syzbot. A check was added to detect unchanged valid values and return -EINVAL.

A memory leak was found in the Linux kernel in the dw_i3c_master_i2c_xfers() function of the i3c dw driver. When pm_runtime_resume_and_get() fails, the allocated xfer structure is not freed, causing a memory leak.

In the Linux kernel, a vulnerability in the ext4 filesystem was found related to incorrect zeroing of allocation ranges when splitting a large unwritten extent. Under certain conditions, when the extent splitting operation fails due to lack of space, stale data may remain in the written range, compromising data integrity.

In the Linux kernel, a vulnerability was found in the csiostor driver where a null pointer rn is dereferenced in the error exit path via the CSIO_INC_STATS macro. The fix adds a new error return label after the macro usage.

In the Linux kernel, a vulnerability in the ATA subsystem (libata-scsi) can cause non-NCQ command starvation. When a device is under constant NCQ command load, non-NCQ commands may be repeatedly deferred, potentially preventing their execution entirely.