CVE Vulnerability Catalog

A vulnerability was found in the Linux kernel's DSA shutdown sequence. Two issues were identified: a use-after-free in the lan9303 driver due to dev_get_drvdata() calls after shutdown, and a race condition when zeroing conduit->dsa_ptr during packet reception. The fix closes the conduit interface before zeroing pointers, preventing access to the driver after shutdown.

An integer overflow vulnerability was discovered in the Linux kernel's BLKSECDISCARD operation. Passing crafted values (sector 512 and a near-maximum uint64_t sector count) causes an infinite loop in blkdev_issue_secure_erase(), leading to system overload and hang.

In the Linux kernel, the drm/xe/hdcp component lacks a validity check for the GSC structure. When xe_gsc is not initialized during HDCP capability check, a null pointer error occurs.

In the Linux kernel, the net: stmmac driver allows port_transmit_rate_kbps to be set to 0, which when tc-cbs is disabled leads to a zero-division error in div_s64. This can cause a system crash.

In the Linux kernel, a buffer overflow vulnerability was resolved in dcn401_stream_encoder_create in the drm/amd/display driver. The stream_enc_regs array has four elements, and an eng_id index of 5 causes an out-of-bounds access.

A vulnerability was found in the Linux kernel's ext4 filesystem. If the default hash version is set to DX_HASH_SIPHASH but the casefold feature is not enabled, mounting the filesystem fails.

In the Linux kernel, a bug exists in ACPI battery hook handling. When a battery hook returns an error while adding a new battery, it is automatically unregistered, but the hook provider is unaware and later calls battery_hook_unregister() on the already unregistered hook, causing a crash.

A vulnerability exists in the Linux kernel's qdisc_pkt_len_init() function related to handling UFO GSO packets. A malicious IPv4 SKB_GSO_UDP packet with specific parameters (gso_size=3, skb->len=28) causes an underflow and zeroes out pkt_len, leading to a kernel crash (NULL pointer dereference) in the fq_codel queue.

In the Linux kernel, a vulnerability was resolved in qdisc_pkt_len_init() which lacked sufficient sanity checks for GSO packets. A user can provide a malicious GSO packet of 80 bytes total length, leading to an underflow in qdisc_skb_cb(skb)->pkt_len.

In the Linux kernel, the net/ncsi module's work function can run after the ncsi device structure is freed, leading to use-after-free or kernel panic. The fix disables the work before freeing the structure.

In the Linux kernel, a vulnerability was resolved in sctp_listen_start where sk_state is not set back to CLOSED if autobind fails. This leads to a NULL pointer dereference of bind_hash on subsequent sctp_inet_listen calls, causing a crash (KASAN: null-ptr-deref).

In the Linux kernel, a vulnerability in the wifi ath9k_htc driver involves using skb_trim() to reset length before resubmit, which can cause issues with uninitialized length. It was changed to __skb_set_length().

In the Linux kernel, rcu_tasks_need_gpcb accesses a non-existent percpu rtpcp variable when built with CONFIG_FORCE_NR_CPUS=y, causing a kernel panic (page fault). The fix uses the maximum possible CPU number instead of nr_cpu_ids.

In the Linux kernel, dcn20_validate_apply_pipe_split_flags dereferences a NULL pointer because it does not check if the merge pointer is non-NULL. The fix passes a valid pointer to avoid the NULL dereference.

In the Linux kernel, in the DRM subsystem for AMD Display, null pointer checks were added before using certain pointers. Previously, these pointers were null-checked earlier in the same function, indicating they might be null, and using them again without checks caused issues. This fixes three FORWARD_NULL issues reported by Coverity.

In the Linux kernel, the drm/amd/display module reuses pointers (such as dc->clk_mgr) without re-checking them for NULL, even though they were checked earlier in the same function. Coverity reported 10 FORWARD_NULL issues, which were fixed by adding the missing null checks.

In the Linux kernel, a vulnerability in the drm/amd/display driver was resolved by checking null pointers before multiple uses. Pointers such as stream_enc and dc->bw_vbios were previously null checked in the same function but are used multiple times in subsequent code without rechecking.

In the Linux kernel, dcn201_acquire_free_pipe_for_layer has a potential NULL pointer dereference when head_pipe is NULL. The fix adds a check to ensure head_pipe is not NULL and returns NULL to prevent the dereference.

In the Linux kernel, the dcn32_acquire_idle_pipe_for_head_pipe_in_layer function in the drm/amd/display module has a potential NULL pointer dereference when head_pipe is NULL. The fix adds a check and returns NULL to prevent the crash.

In the Linux kernel, the dcn401_init_hw function in the drm/amd/display driver has a potential null pointer dereference. The issue can occur when dc->clk_mgr or dc->clk_mgr->funcs is null. The fix adds a check to ensure these pointers are not null before accessing their functions.