CVE Vulnerability Catalog

A vulnerability was found in the Linux kernel's bh1780 light sensor driver, causing a PM runtime reference count leak on the error path. The issue occurs because pm_runtime_put_autosuspend() is not called when a read operation fails, leading to improper power management state.

In the Linux kernel, KVM for arm64 was fixed where a failure in vgic_allocate_private_irqs_locked() caused an early exit from kvm_vgic_create(), leaving dist->rd_regions uninitialized. kvm_vgic_dist_destroy() would then attempt to free the uninitialized RD structures.

Aplikacja Password Pusher, służąca do komunikacji wrażliwych informacji w sieci, miała problem z bezpieczeństwem, który pozwalał na nieautoryzowane tworzenie przesyłek plikowych przez ogólny interfejs API JSON w określonych konfiguracjach. Problem ten został naprawiony w wersjach 1.69.3 i 2.4.2.

SEPPmail Secure Email Gateway before version 15.0.4 exposes server environment variables through an unauthenticated endpoint in the new GINA UI, allowing remote attackers to obtain sensitive system information.

A WARN_ON() is triggered in the Linux kernel ice (PTP) driver when the controlling PF is unavailable. In VFIO passthrough setups only a PF without the source timer may be passed through, so adapter->ctrl_pf is never initialized and ice_get_ctrl_ptp() returns NULL. The fix replaces WARN_ON() with an informational message and returns -EOPNOTSUPP.

In the Linux kernel, the perf/x86/intel/uncore subsystem has bugs in die ID initialization and lookup. In some cases, uncore_device_to_die() may return -1, leading to skipped UBOX devices or incorrect error handling. The fix uses uncore_pcibus_to_dieid(), which works regardless of NUMA being enabled.

In the Linux kernel, btrfs qgroup ioctls do not reserve transaction space for quota tree updates or the delayed refs they generate. This can cause a transaction abort with -ENOSPC when running delayed refs, particularly under heavy qgroup creation on a nearly full filesystem.

In the Linux kernel, BPF was fixed where check_mem_access() allowed direct access to PTR_TO_BUF pointers marked PTR_MAYBE_NULL, bypassing the NULL check. In map iterator context, ctx->key and ctx->value are NULL in stop callbacks, causing a kernel NULL dereference.

A vulnerability has been identified in the Linux kernel related to the load_segments() function, which invalidates the GS base relied upon by KCOV. When CONFIG_KCOV is enabled, calls to instrumented C code can lead to kernel crashes in an endless loop.

In the Linux kernel, the iwlwifi (mvm) driver was fixed where the 6E-related MCC_ALLOWED_AP_TYPE_CMD was sent to devices without 6E support. The firmware mistakenly advertises support for this command even on AX201, causing a firmware crash.

A vulnerability in the Linux kernel affects zero_vruntime tracking in the fair scheduler. Due to a previous fix (b3d99f43c72b), when two tasks perform yield, the virtual runtime counter can overflow within a single tick, leading to system instability. The fix forces an update at the end of every slice to prevent this.

A vulnerability related to the eDP issue in the drm/amd/display module has been fixed in the Linux kernel, which required adding a function hook check before use.

W jądrze Linuxa naprawiono podatność związaną z inwersją blokady między mutexami spi_lock i buf_lock w sterowniku spidev. Problem ten mógł prowadzić do zakleszczeń z powodu różnego porządku nabywania blokad w różnych ścieżkach kodu.

In the Linux kernel, the drm/amdgpu driver was fixed for a synchronization bug in amdgpu_dma_buf_move_notify caused by ticket usage that made page table updates appear correct when they were not. In a two-GPU scenario with a shared buffer, this could lead to a page fault.

In the Linux kernel KVM (AMD SVM) support, a user-triggerable WARN in svm_set_nested_state() was removed; it could be trivially triggered from userspace by modifying CPUID after setting CR3. The warning provided no meaningful protection and only polluted kernel logs.

In the Linux kernel, the dm (device-mapper) driver incorrectly checks blk_should_fake_timeout despite not implementing its own timeout handling. When an io-timeout-fail error is injected into a dm device, the request is leaked and never completed, causing tasks to hang indefinitely.

In the Linux kernel, ACPI processor was fixed for a NULL pointer dereference in acpi_processor_errata_piix4(), where the dev pointer was overwritten by the result of a second device lookup. If the second lookup failed, dev became NULL and the dev_dbg() call dereferenced NULL.

A vulnerability has been identified in the Linux kernel related to the call of the generic_handle_irq() function in a non-interrupt context. This issue occurs when resuming the system from suspend on Tegra platforms, leading to a warning in the logs.

For the i.MX8MQ platform, there is a hardware limitation: the g1 VPU and g2 VPU cannot decode simultaneously; otherwise, it will cause bus errors and produce corrupted pictures, even potentially lead to system hang. The fix ensures g1 and g2 operate alternately by sharing the same v4l2_m2m_dev.

A hang in the Linux kernel when stopping RAID arrays with metadata through dm-raid was fixed. When a dm-raid managed device tree is suspended top to bottom and the top-level RAID device is removed, the dm-raid destructor calls md_stop(), which tries to flush the write-intent bitmap to already suspended metadata devices, causing an indefinite block. The fix prevents bitmap flushing in the destructor context while still allowing it during suspend.