CVE Vulnerability Catalog

A reference count leak in the Linux kernel's xfrm_state structure occurs because xfrm_dev_unregister() does not release the reference to struct net_device on the NETDEV_UNREGISTER event. The issue is triggered when the NETIF_F_HW_ESP bit is cleared after an xfrm state with hardware offload has been added, preventing the network device from being freed.

In the Linux kernel md/bitmap subsystem, a use-after-free race exists between bitmap_daemon_work() and __bitmap_resize(). The daemon iterates over bitmap->storage.filemap without locking while the resize path frees that storage, causing a General Protection Fault in write_page().

In the Linux kernel, the iommu/vt-d subsystem can hard-lock the host when a PCIe endpoint with ATS enabled is removed or loses its link while Intel IOMMU scalable mode is disabled or unsupported. The fix adds a device accessibility check (pci_device_is_present()) in the context flush path to skip inaccessible devices and avoid waiting for an ATS invalidation that cannot complete.

In the Linux kernel, the octeontx2-af: CGX driver has a memory leak of rx_fc_pfvf_bmap and tx_fc_pfvf_bmap bitmaps, which are allocated in cgx_lmac_init() but never freed in cgx_lmac_exit(). Unbinding and rebinding the driver triggers a kmemleak.

In the Linux kernel, the pegasus USB driver filled URBs with hardcoded endpoint pipes (1 for RX, 2 for TX, 3 for status interrupts) without verifying endpoint descriptors. A malformed USB device can present these endpoints with transfer types differing from what the driver assumes.

A vulnerability in the Linux kernel related to error handling during initialization in the HID: hid-pl module has been resolved. Errors must be reported to avoid dereferencing a NULL pointer when FF is first used.

A vulnerability in the Linux kernel related to the lack of error checking for the kcalloc() function in parse_thread_groups() has been resolved. The absence of this check could lead to a NULL pointer dereference.

In the Linux kernel, a change that added pci_rescan_remove_lock locking when enabling/disabling SR-IOV has been reverted. It caused a deadlock by recursively acquiring the same lock, e.g. when disabling VFs during PCI device removal. This revert alone does not fully fix the original issue; a follow-up fix will be provided.

A vulnerability has been identified in the Linux kernel related to manipulating the 'mfd_of_node_list'. A mutex has been added to ensure safety during access and modification of this list, preventing potential crashes.

In the Linux kernel, the HID: magicmouse driver lacks a check for msc->input being NULL, potentially leading to a crash. Fake USB devices can send their own report descriptors for which the input_mapping() hook is not called, leaving msc->input as NULL.

In the Linux kernel, ASoC: SOF: Intel: hda has a NULL pointer dereference when the playback/capture widget is not set due to a mismatch between DAI links in the machine driver and the topology. This can lead to a kernel crash.

In the Linux kernel, the HID: logitech-hidpp driver lacks a check for maxfield in hidpp_get_report_length(), potentially leading to a crash when a report has no fields. Fake USB gadgets can send HID report descriptors without valid fields, causing a kernel crash.

A vulnerability has been identified in the Linux kernel related to the missing resource unmapping in the snd_cx23885_hw_params() function. An error path has been added to call cx23885_alsa_dma_unmap() to release resources acquired by cx23885_alsa_dma_map().

In the Linux kernel, the dm-verity module incorrectly handles dm_bufio_client_create() failure. If either call in verity_fec_ctr() fails, a later call to dm_bufio_client_destroy() with an ERR_PTR() argument causes a crash.

W jądrze Linuxa rozwiązano podatność związaną z dereferencją wskaźnika null w module drm/amd/pm. Problem ten występuje podczas inicjalizacji RAS, gdy SMU jest wyłączone.

In the Linux kernel, the iommu/vt-d subsystem skips ATS/dev-IOTLB invalidation only for PCIe devices marked as disconnected, but not for devices whose link went down due to faults. In such cases, qi_flush_dev_iotlb can cause a hard system lockup, for example while releasing a VFIO group after a VM fails to connect to a PCIe device.

A vulnerability has been identified in the Linux kernel that occurs when booting the second-stage kernel via kexec with a limiting command line. The issue is that the IMA buffer from the previous kernel may fall outside the addressable RAM, leading to a page fault.

In the Linux kernel pstore (ram_core) subsystem, persistent_ram_vmap() does not properly check the result of vmap(). When vmap() returns NULL and offset is non-zero, adding offset_in_page(start) causes a non-NULL pointer to be returned despite the failed mapping. As a result, persistent_ram_buffer_map() incorrectly reports success, and subsequent access to prz->buffer may dereference an invalid address and cause crashes.

In the Linux kernel fbcon subsystem, con2fb_acquire_newinfo() does not check the return value of fbcon_open(). If fbcon_open() fails, the info->fbcon_par pointer remains NULL and is later dereferenced. The fix adds a check for the return value to avoid this.

In the Linux kernel, try_to_free_buffers() can be called on folios with no buffers attached when filemap_release_folio() is invoked on a folio belonging to a mapping with AS_RELEASE_ALWAYS set but no release_folio operation defined. This causes drop_buffers() to be called on a folio with no buffers, leading to a null pointer dereference.