CVE Vulnerability Catalog

In the Linux kernel, the drm/amdgpu driver has an error handling flaw in slot reset. If the device has not recovered after slot reset, it goes to the 'out' label where it may make decisions based on an uninitialized hive pointer and access an uninitialized list. The fix initializes the list and hive properly and releases the reset domain lock.

In the Linux kernel, the can: mcp251x driver has a deadlock in the error path of mcp251x_open. The free_irq() call is made while holding the mpc_lock mutex, which can deadlock if an interrupt has already occurred.

A logic bug was fixed in the Linux kernel's DRBD drbd_al_begin_io_nonblock() function. Under certain race conditions, lc_get_cumulative() could fail despite a prior check indicating success, logging "LOGIC BUG" without returning an error. This broke mutual exclusivity between resync and application I/O and could trigger BUG_ON(refcnt == 0) in lc_put().

In the Linux kernel, the libata (ATA) subsystem fails to cancel pending work after clearing deferred_qc. This can cause the work to run at an inappropriate time, triggering a WARN_ON() in ata_scsi_deferred_qc_work() and potentially disrupting NCQ command handling.

A bug was fixed in the Linux kernel's ice driver that caused a crash (NULL pointer dereference) during the ethtool offline loopback test. The crash occurred because libeth was not initialized for the rx ring in loopback VSIs. The fix treats ICE_VSI_LB VSIs more like normal PF VSIs by giving them a dummy q_vector, allowing the napi struct to be passed to libeth_rx_fq_create().

A bug was fixed in the Linux kernel's efi_free_boot_services() function, which freed EFI_BOOT_SERVICES_CODE and EFI_BOOT_SERVICES_DATA memory using memblock_free_late() instead of free_reserved_area(). With CONFIG_DEFERRED_STRUCT_PAGE_INIT=y enabled, the function was called before memory map initialization completed, causing a leak of approximately 140 MB of RAM on EC2 t3a.nano instances with only 512 MB of RAM.

A race condition exists in the Linux kernel when creating nvdimm objects in the CXL subsystem. If the nvdimm_bus object is not yet registered, __nd_device_register() can trigger a NULL pointer dereference, causing a kernel oops. The issue is reproducible during cxl-translate.sh tests and relates to probe ordering between cxl_acpi and cxl_pmem drivers.

In the Linux kernel, a fix was made in the CAN USB f81604 driver for a missing urb anchoring in the read bulk callback. When submitting a urb that uses the anchor pattern, it must be anchored before submission; otherwise, it could be leaked if `usb_kill_anchored_urbs()` is called. This logic is correctly implemented elsewhere in the driver, except in the read bulk callback, where it has now been added.

A vulnerability has been identified in the Linux kernel in the ioremap_prot() function, which may lead to memory read errors from the kernel level on arm64 systems with PAN enabled. The issue lies in returning a new user mapping that is inaccessible to the kernel.

In the Linux kernel, in the accel/amdxdna driver, if userspace issues an ioctl to destroy a hardware context that has already been automatically suspended, the driver may crash because the mailbox channel pointer is NULL for the suspended context. The fix checks the mailbox channel pointer in aie2_destroy_context() before accessing it.

In the Linux kernel, nci_transceive() takes ownership of the skb passed by the caller, but the -EPROTO, -EINVAL, and -EBUSY error paths return without freeing it. This leads to a memory leak detected by kmemleak.

In the Linux kernel, the drm/amdgpu/userq driver was fixed to prevent userspace from trivially triggering kernel warnings (WARN_ON). This occurs when userspace passes too small a num_fences value or when the required number legitimately grows between two calls to the userq wait ioctl. The WARN_ONs were removed because nothing is wrong with the kernel and userspace will simply get an errno reported back.

In the Linux kernel irdma driver, a kernel stack leak was found in irdma_create_user_ah(). The reserved field of the response structure is not zeroed before being sent to userspace, leaking 4 bytes of stack memory.

In the Linux kernel, the f81604 CAN USB driver improperly handles interrupt urb messages of incorrect length. The fix ensures such messages are properly detected and their data is not treated as valid.

In the Linux kernel, the cpufreq: intel_pstate driver was fixed for a crash during turbo disable. When the system is booted with nosmt or maxcpus kernel parameters limiting CPU count, writing to /sys/devices/system/cpu/intel_pstate/no_turbo causes a NULL pointer dereference because all_cpu_data[] is NULL for offline CPUs and the code dereferences it. The fix passes the CPU number to intel_pstate_update_max_freq() and uses all_cpu_data[] only for CPUs with a valid cpufreq policy.

In the Linux kernel, the NFC (NCI) subsystem's nci_close_device() did not complete any pending data exchange before closing the device. The data exchange callback (e.g. rawsock_data_exchange_complete) holds a socket reference, leading to a memory leak detected by kmemleak.

In the Linux kernel, a bug was fixed in the libie library where libie_fwlog_deinit() could be called during driver unload (e.g., ixgbe) even when firmware logging was never properly initialized. This led to a kernel oops and potential system destabilization. The fix checks if fwlog is supported before performing deinitialization.

In the Linux kernel, in the accel/amdxdna driver, mgmt_chann may be set to NULL if the firmware returns an unexpected error in aie2_send_mgmt_msg_wait(). This can later lead to a NULL pointer dereference in aie2_hw_stop(). The fix introduces a dedicated helper to destroy mgmt_chann and adds proper NULL checks before accessing it.

In the Linux kernel, the can: usb: etas_es58x driver did not anchor the urb in the read bulk callback before submitting it. If usb_kill_anchored_urbs() was called, this could leak the urb.

A vulnerability was found in the Linux kernel's MPTCP (Multipath TCP) endpoint management. It triggers a warning when removing an endpoint with both 'signal' and 'subflow' flags while the MPTCP subflow limit is set to 0. The issue stems from incorrectly marking the endpoint as used, leading to state inconsistency.