CVE Vulnerability Catalog

In the Linux kernel, the net/mlx5 LAG path calls mlx5_ldev_add_debugfs() even when __mlx5_lag_dev_add_mdev() returns success despite no valid LAG context. Debugfs entries (such as the members file) are then created referencing the ldev pointer, risking NULL pointer dereferences.

In the Linux kernel, a bug was fixed in the net/mlx5 driver's handling of switchdev mode rollback on failure. Before the patch, rolling back to legacy mode unregistered the uplink netdev and left it unregistered, causing a kernel BUG during subsequent vport representor unload.

A vulnerability in the Linux kernel's BPF subsystem allowed attaching sleepable kprobe.multi programs to atomic/RCU contexts. The bpf_kprobe_multi_link_attach() function lacked validation of the sleepable flag, enabling sleepable helpers like bpf_copy_from_user() to be called from non-sleepable context, causing a kernel splat.

In the Linux kernel, the drm/xe/pxp driver's pxp_start function does not clear the restart flag after jumping back. As a result, the jump is repeated every time the end of the function is reached.

In the Linux kernel, the drm_compat_ioctl path takes a user-controlled pointer and dereferences it into a table of function pointers, a classic Spectre pattern. The fix calls array_index_nospec() on the index into the function pointer list.

W jądrze Linuxa zidentyfikowano podatność w sterowniku ctxfi, który nieprawidłowo zakładał, że funkcja daio_device_index() zawsze zwraca poprawną wartość. Wprowadzono odpowiednie sprawdzenie błędów, aby obsłużyć potencjalne problemy z tą funkcją.

The refactoring of the xfi driver changed the assignment of atc->daios[] in atc_get_resources(), now looping over all enum DAIOTYP entries, including SPDIF1, which is a special type used only for the hw20k1 CTSB073X model and has no definition for hw20k2. This caused a kernel crash on hw20k2. The fix skips the incorrect SPDIF1 type in the parser loop.

In the Linux kernel's drm/i915/dsi driver, horizontal timing values are no longer adjusted based on the compression ratio in command mode, matching Bspec and the Windows driver. The fix also resolves a divide-by-zero on some machines where the adjusted htotal became so small that line_time_us was 0.

In the Linux kernel, the drm/amdgpu driver has a size mismatch: AMDGPU_VA_RESERVED_TRAP_SIZE is hardcoded to 8 KB, while KFD_CWSR_TBA_TMA_SIZE is defined as 2 * PAGE_SIZE. On 64K page-size systems this becomes 128 KB, exceeding the reserved area and causing a kernel crash (NULL pointer dereference) when running rocminfo or rccl unit tests.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the USB cdns3 gadget driver's ep_queue function. When the endpoint is disabled or not configured, the ep->desc pointer can be NULL, causing a kernel crash when __cdns3_gadget_ep_queue() is called.

A vulnerability was found in the Linux kernel's bridge br_nd_send() function, which processes Neighbor Discovery (ND) options. Lack of option length validation may allow out-of-bounds read or use of a too-short source LLADDR option.

In the Linux kernel, vxlan_na_create() walks ND options according to lengths provided by the options themselves. A malformed option can make the parser advance beyond the computed option span or read a too-short source LLADDR payload.

In the Linux kernel, the ftgmac100 driver had a memory leak vulnerability during ring allocation on network interface open failure. The ftgmac100_alloc_rings() function did not free previously allocated resources (rx_skbs, tx_skbs, rxdes, txdes, rx_scratch) on error, causing memory leaks.

In the Linux kernel, a resource leak was found in gpiochip_add_data_with_key() on error paths. After commit aab5c6f20023, `gdev->dev.release` is unset, so the reference count to `gdev->dev` is not dropped on errors. The fix drops the reference and reorders code to prevent double-free.

A vulnerability has been identified in the Linux kernel that leads to a NULL pointer dereference in the eth_get_drvinfo function. The issue occurs when a userspace tool queries the interface while the device is detached.

In the Linux kernel's USB gadget f_ecm function, the net_device lifecycle was fixed: on function unbind the parent device was destroyed while the net_device survived, creating dangling sysfs symlinks. The fix uses device_move() to reparent the net_device between the gadget device tree and /sys/devices/virtual across bind and unbind cycles.

In the Linux kernel's USB gadget f_eem function, the net_device lifecycle was fixed: on function unbind the parent device was destroyed while the net_device survived, creating dangling sysfs symlinks. The fix uses device_move() to reparent the net_device between the gadget device tree and /sys/devices/virtual across bind and unbind cycles.

In the Linux kernel's USB gadget f_subset function, the net_device lifecycle was fixed: on function unbind the parent device was destroyed while the net_device survived, creating dangling sysfs symlinks. The fix uses device_move() to reparent the net_device between the gadget device tree and /sys/devices/virtual across bind and unbind cycles.

In the Linux kernel's USB gadget f_rndis function, the net_device lifecycle was fixed: on function unbind the parent device was destroyed while the net_device survived, creating dangling sysfs symlinks. The fix uses device_move() to reparent the net_device between the gadget device tree and /sys/devices/virtual across bind and unbind cycles, with a borrowed_net flag for legacy composite driver compatibility.

A vulnerability was detected in AcademySoftwareFoundation OpenImageIO up to 3.2.0.1-dev affecting unknown code in src/dds.imageio/ddsinput.cpp of the DDS Image Handler component. The manipulation results in an out-of-bounds write. The attack requires local access, and the exploit is now public and may be used. The patch is identified as 94ec2deec3e3bf2f2e2ff84d008e27425d626fe2.