CVE Vulnerability Catalog

In the Linux kernel USB mdc800 driver, mdc800_device_read() submits a download URB and waits for completion. If a timeout occurs, the function returns without killing the URB, leaving it active, and a subsequent read() resubmits the same URB, triggering a warning in usb_submit_urb(). The fix checks the wait_event_timeout() return value and kills the URB on timeout.

A vulnerability in the Linux kernel related to the lifecycle of the network device has been fixed, where the network device outlived its parent gadget device during disconnection, leading to sysfs link issues and null pointer dereference problems.

In the Linux kernel, a race condition exists in the Ceph module during asynchronous unlink. The i_nlink counter is decremented before receiving completion from the MDS, which can lead to an underrun and trigger a WARNING in drop_nlink. The issue affects only the async path and can be triggered by concurrent operations from other clients or the operation's own completion.

In the Linux kernel, the Ceph subsystem's ceph_mdsc_build_path() did not free the "path" pointer obtained by __getname() on error paths. If ownership of this pointer is not passed to the caller via path_info.path, the function must free it before returning. The fix adds __putname() calls on those error paths.

In the Linux kernel on PowerPC, perf_callchain_user_64 retrieves the user callchain without checking whether current->mm is still alive. If mm has already been released, this leads to a NULL pointer dereference and kernel panic, triggerable for example by a BPF profiling program (such as profile.py from bcc-tools). The fix adds a NULL check for current->mm and moves storing the top-level stack entry into the generic perf_callchain_user.

In the Linux kernel, the hisi_sas driver has a bug causing a NULL pointer dereference during user_scan(). The sas_user_scan() function scans channels 1 through max_channel, but hisi_sas supports only one channel (max_channel = 1), leading to a NULL pointer dereference in sas_find_dev_by_rphy() and a kernel Oops.

In the Linux kernel TIPC protocol, a user can set conn_timeout to any value via setsockopt(TIPC_CONN_TIMEOUT), including values below 4. When a SYN is rejected with TIPC_ERR_OVERLOAD, the retry path in tipc_sk_filter_connect() performs a modulo operation by (conn_timeout / 4), which for values 0-3 results in division by zero and a kernel oops/panic. The fix clamps conn_timeout to a minimum of 4.

A Linux kernel vulnerability was fixed in the kprobes mechanism that caused a kernel crash (page fault) when removing or loading modules if ftrace had previously been killed by an error (ftrace_kill). The issue stemmed from incorrect handling of the kprobe_ftrace_disabled flag in kprobes_module_callback. The fix checks this flag in __disarm_kprobe_ftrace() and skips all ftrace-related operations.

In the Linux kernel intel_pstate cpufreq driver, update_cpu_qos_request() attempts to initialize the 'freq' variable by dereferencing 'cpudata' before validating 'policy'. On systems booted with "nosmt", all_cpu_data[cpu] is NULL for SMT sibling threads, causing a NULL pointer dereference when update_qos_requests() is called. The fix defers the 'freq' assignment until after policy and driver_data are validated.

In the Linux kernel, the drm/amdgpu driver's amdgpu_userq_signal_ioctl does not check upper bounds on input values, which can lead to out-of-memory (OOM) conditions. The fix adds a check against AMDGPU_USERQ_MAX_HANDLES to prevent OOM.

In the Linux kernel drm/amdgpu/userq driver, amdgpu_userq_wait_ioctl fails to drop references to syncobj and timeline fence when aborting the ioctl due to an output array being too small. This leads to a reference leak.

In the Linux kernel, the drm/amdgpu driver's amdgpu_userq_wait_ioctl does not check upper bounds on input values, which can lead to out-of-memory (OOM) conditions. The fix adds a check against AMDGPU_USERQ_MAX_HANDLES to prevent OOM.

In the Linux kernel drm/xe/sync driver, the allocation failure path fails to release the user fence reference when dma_fence_chain_alloc() fails. This results in a memory leak.

In the Linux kernel drm/xe/sync driver, xe_sync_entry_parse() can allocate references (syncobj, fence, chain fence, or user fence) before hitting a later failure path. Several of those paths returned directly, leaving partially initialized state and leaking refs. The fix routes these error paths through a common free_sync label and calls xe_sync_entry_cleanup(sync).

In the Linux kernel nfsd, nfsd_nl_listener_set_doit() uses get_current_cred() without a corresponding put_cred(), causing a credential reference leak. Since the function runs in process context (sendmsg()) and current->cred does not go away, the fix replaces get_current_cred() with current_cred().

In the Linux kernel drm/amd driver, when GPU initialization fails due to an unsupported hardware block, IP blocks may have a NULL version pointer. During cleanup in amdgpu_device_fini_hw, amdgpu_device_set_pg_state and amdgpu_device_set_cg_state iterate over all IP blocks and access adev->ip_blocks[i].version without NULL checks, leading to a NULL pointer dereference. The fix adds NULL checks in both functions.

In the Linux kernel, the drm/amd driver was fixed to handle additional cleanup paths that dereferenced a NULL version pointer on unsupported hardware. Appropriate NULL checks were added.

A bug was fixed in the Linux kernel's x86/apic handling where, upon resuming from s2ram, firmware may re-enable x2apic mode even though the kernel disabled it during boot. This causes a mismatch: the kernel continues using the xapic interface while the hardware is in x2apic mode, leading to hangs. The fix in lapic_resume() disables x2apic when the kernel expects it to be disabled (x2apic_mode = 0).

In the Linux kernel, a flaw in btrfs allows a user without CAP_SYS_ADMIN to repeatedly snapshot a previously received subvolume until the BTRFS_UUID_KEY_RECEIVED_SUBVOL item overflows in a leaf. This triggers a transaction abort and turns the filesystem into read-only mode.

In the Linux kernel, btrfs was fixed where the set received ioctl could fail due to item overflow, aborting the transaction and turning the filesystem read-only. The flaw does not require admin privileges (CAP_SYS_ADMIN), only subvolume ownership, so a malicious user could exploit it.