CVE Vulnerability Catalog

In the Linux kernel, in the AMDGPU driver, there is a reference count leak of a dma_fence object in the error path of amdgpu_cs_fence_to_handle_ioctl(). When info->in.what falls into the default case, the function returns -EINVAL without decrementing the reference count, leading to memory leaks.

W jądrze Linuxa zidentyfikowano podatność związana z wyciekiem pamięci w module drm/amd/display. Problem został rozwiązany poprzez dodanie zwolnienia zasobów w ścieżce obsługi błędów.

In the Linux kernel, in the AMDKFD driver, there is a deadlock during SVM range restore work when a process exits. kfd_process_notifier_release flushes svm_range_restore_work, which can deadlock with deferred_list work when mmput releases the last user and calls exit_mmap.

A vulnerability in the Linux kernel's ath11k PCI driver causes a system crash during suspend when the board file is not found. The issue arises from asynchronous driver initialization not completing before the suspend handler runs. The fix adds a check for the ATH11K_FLAG_QMI_FAIL flag during both suspend and resume.

In the Linux kernel, the ath11k driver for Qualcomm Wi-Fi cards has a vulnerability causing a system crash during 'rmmod ath11k_pci' when amss.bin is missing. The issue is due to using mhi_async_power_up(), which does not check errors, instead of the safer mhi_sync_power_up().

In the Linux kernel, a memory leak in the mpi3mr SCSI driver was fixed. Memory segments of the operational reply queue were not freed when unloading the driver.

A vulnerability in the Linux kernel's ath11k driver causes a deadlock when flushing the management transmit queue. This prevents management frames from being sent within 5 seconds, leading to errors and frame drops.

In the Linux kernel, in the HISI SAS driver for v3 hardware, there is an issue with the order of freeing IRQ vectors. If the driver fails to request the channel IRQ or fatal IRQ during probe, it frees the IRQ vectors before freeing the IRQs, leading to a kernel BUG.

In the Linux kernel, a crash in monitor mode with the mt76 SDIO driver was fixed. The RXD size was increased from 128 to 256 to avoid nonlinear buffer issues.

In the Linux kernel, an inode reference leak in ceph_get_snapdir() was fixed. The reference was not released in error handling cases.

In the Linux kernel, a memory leak in ceph_readdir was fixed when note_last_dentry returns an error. last_readdir is reset and a comment was added.

In the Linux kernel, vchiq_dump_platform_instances can dereference a NULL pointer because vchiq_get_state() may return NULL. The fix handles this case and avoids the NULL pointer dereference.

In the Linux kernel, an error handling issue in wfx_init_common() in the staging wfx driver was fixed. One error handler did not call ieee80211_free_hw(hw), potentially causing a memory leak.

In the Linux kernel, an issue in the staging vchiq_core driver was fixed where find_service_by_handle could return NULL for an invalid handle, leading to a NULL pointer dereference.

In the Linux kernel, a possible memory leak in MMU DR fini in the habanalabs driver was fixed. A copy-paste error caused a leak when host-resident shadow is NULL.

A vulnerability in the Linux kernel's AMD GPU driver (amdgpu/drm) affects the dcn30_internal_validate_bw function. Missing FPU protection during swath width calculations (CalculateSwathWidth) can lead to a general protection fault, causing system crashes during prolonged WebGL Aquarium usage, especially with DRM debug logs enabled.

In the Linux kernel, the aqc111 USB driver has out-of-bounds access vulnerabilities in the aqc111_rx_fixup() function. A malicious or defective USB device can trigger out-of-bounds reads of the metadata array, corruption of data in cloned SKBs, and construction of a packet with a tail beyond the buffer end. The fix is not described in this description.

In the Linux kernel, a vulnerability in the zoran driver (media: staging: media: zoran) was fixed where the buffer number was miscalculated in zoran_reap_stat_com when tmp_dcim=1. This led to a NULL pointer dereference later. The fix corrects the calculation and adds a check to prevent recurrence.

In the Linux kernel, a vulnerability in the zoran driver (media: staging: media: zoran) was fixed by moving the videodev allocation. Code was moved out of zr36057_init() into new functions handling zr->video_dev, which eases code reading and fixes a zr->video_dev memory leak.

The Booknetic plugin contains a Cross-Site Request Forgery (CSRF) vulnerability. This affects versions before 5.10.4.