CVE Vulnerability Catalog

In the Linux kernel, pcie_failed_link_retrain() calculates the previous link speed from the Link Control 2 register without masking out non-speed bits when retraining fails. This causes PCI_SPEED_UNKNOWN to be returned and triggers a WARN splat in pcie_set_target_speed(). The fix masks out non-speed bits in PCIE_LNKCTL2_TLS2SPEED() and PCIE_LNKCAP_SLS2SPEED().

A vulnerability was found in the Linux kernel's JBD2 filesystem in the jbd2_log_do_checkpoint() function. The function does not explicitly call cond_resched(), which can lead to a soft lockup during prolonged checkpoint list processing.

W jądrze Linuxa rozwiązano podatność polegającą na usunięciu ostrzeżenia WARN_ON_ONCE() z funkcji flush_cache_vmap. Ostrzeżenie to czasami było wywoływane.

In the Linux kernel crypto acomp subsystem, type punning causes a CFI failure when control flow integrity is enabled. The fix makes the workspace ("stream") free function use a consistent type and calls it through a function pointer of that same type.

In the Linux kernel, a bug in mremap causes a WARN when userfaultfd is registered on a VMA spanning at least one PMD and then mremap() is called. The warning occurs during recovery from a failed page table move due to a page table allocation error. The code ultimately behaves correctly (recursion), but the warning is undesirable.

In the Linux kernel iio: adc: rzg2l_adc driver, driver data is set after runtime PM is enabled. When the ADC device, which supplies another device, is repeatedly unbound and bound, runtime PM callbacks may run before drvdata is set, causing a crash. The fix sets drvdata immediately after allocation.

A vulnerability in the Linux kernel causes a soft lockup in br_multicast_query_expired(). When multicast_query_interval is set to an extremely large value, a local variable overflows, causing the timer to expire immediately and creating an infinite loop.

In the Linux kernel drm/hisilicon/hibmc driver, when hibmc loading fails, the driver uses hibmc_unload to free resources, but mutexes in mode.config are not initialized, causing a NULL pointer access. The fix changes the goto statement to return because hibmc_hw_init() does not need to free anything.

In the Linux kernel pca9450 regulator driver, module testing produces a kernel dump because the restart handler is registered again ("notifier callback pca9450_i2c_restart_handler already registered"). The fix uses devm_register_sys_off_handler so the kernel manages resource release.

In the Linux kernel, the bnxt_en driver triggers a false lockdep warning during module removal (rmmod). The bnxt_free_ntp_fltrs() function calls netdev_assert_locked(), which incorrectly assumes the lock is held, even though in the bnxt_remove_one() path the netdev is already unregistered and the lock is not required. The fix replaces it with netdev_assert_locked_or_invisible(), which does not assert for an unregistered netdev.

In the Linux kernel net/mlx5 HWS driver, the error flow for complex rules rehash is incorrect. If moving rules fails, the kernel may enter a series of soft lock-ups or other problematic behavior instead of continuing. The fix corrects error handling: no polling before enqueue, abort rehash on timeout, continue on other errors, and return the first error code.

In the Linux kernel on LoongArch, the PLT/GOT relocation counting algorithm in module_frob_arch_sections() had O(n^2) complexity, causing very long module load times and a soft deadlock with large modules such as amdgpu. The fix sorts the relocation list, reducing complexity to O(n log n) and cutting amdgpu module load time from about 1411 ms to 45 ms.

A flaw was found in the Linux kernel ALSA subsystem (snd_timer) in the snd_utimer_create() function. When kasprintf() returns NULL, ida_free() is called on an unallocated id 0, triggering a kernel warning and potential instability.

In the Linux kernel netfilter subsystem (ctnetlink), reference counting was removed from expectation dumpers. The fix prevents a double refcount increment and memory leak that could occur during dump resumption.

In the Linux kernel, ACPI/APEI did not send SIGBUS to the current task when a synchronous memory error was not recovered. For errors such as invalid PA, unexpected severity, or no memory failure config support, the user process could trigger SEA again, potentially exceeding firmware thresholds or causing a kernel hard lockup. The fix force-kills the process if no memory_failure() work is queued.

In the Linux kernel, drm/amd/display added an early NULL check to prevent null pointer dereferences and enhance function robustness. It returns false if the value is invalid.

A vulnerability was found in the Linux kernel where file descriptor table allocations are not limited to INT_MAX. When sysctl_nr_open is set to a very high value (e.g., 1073741816 by systemd), processes using file descriptors near this limit can trigger memory allocation attempts exceeding INT_MAX, causing a warning in mm/slub.c and potential system overload.

In the Linux kernel mm/smaps, smaps_hugetlb_range() handles PTE entries without holding the ptl lock, which can race with page migration and lead to a BUG_ON in pfn_swap_entry_to_page(). The fix holds the ptl lock in smaps_hugetlb_range().

In the Linux kernel, the gfs2 filesystem did not set .migrate_folio in gfs2_{rgrp,meta}_aops, causing a warning during page migration in xfstests. The fix adds this function to eliminate dmesg warnings.

In the Linux kernel on ARM Rockchip, trampoline code for secondary CPUs was written to SRAM while secondary cores were powered on, sometimes causing a kernel hang during SMP initialization. The fix moves SRAM initialization to when all secondary CPUs are powered down.