CVE Vulnerability Catalog

In the Linux kernel, dcn20_program_pipe has a NULL pointer dereference when pipe_ctx->plane_state is NULL. The fix adds a check to ensure the pointer is not NULL before accessing it.

In the Linux kernel, a vulnerability was resolved in drm/amd/display: a NULL check was added for the function pointer in dcn401_set_output_transfer_func. Previously, set_output_gamma was checked for null but then dereferenced without a null check, potentially leading to a null pointer dereference. The fix ensures set_output_gamma is not null before calling it.

In the Linux kernel, a null check for the 'afb' variable was added in amdgpu_dm_update_cursor. Previously, 'afb' was assumed to be null at line 8388 but was used later without a null check, potentially leading to a null pointer dereference.

In the Linux kernel, the drm/amd/display driver has a NULL pointer access issue. The fix changes the order of the pipe_ctx->plane_state check to ensure it is not NULL before accessing it.

In the Linux kernel, the drm/amdgpu driver added an empty list check to avoid null pointer issues in some corner cases during list_for_each_entry_safe() iteration.

In the Linux kernel, the drm/msm/adreno driver has a NULL pointer dereference because msm_gpu->pdev is assigned too late. The fix assigns msm_gpu->pdev earlier to avoid NULL ptrs.

In the Linux kernel, a vulnerability in drm/amd/display involves initializing get_bytes_per_element's default to 1 to avoid division by zero. It fixes 10 DIVIDE_BY_ZERO issues reported by Coverity.

In the Linux kernel, the drm/amd/pm driver does not check if fw_info is NULL before using it, leading to a NULL pointer dereference. This can cause a system crash.

In the Linux kernel, ext4_find_extent() does not update *orig_path after reallocating and initializing the path, which can lead to a NULL pointer dereference or memory leak. This can cause a system crash.

In the Linux kernel, tpm_dev_transmit prepares the TPM space before attempting command transmission, but if the command fails no rollback of this preparation is done. This can result in transient handles being leaked if the device is subsequently closed with no further commands performed. The fix flushes the space in the event of command transmission failure.

In the Linux kernel, the media: mediatek: vcodec driver has a bug in the H264 stateless decoder that triggers a smatch warning and leads to a kernel crash when fb is NULL.

In the Linux kernel, a vulnerability was resolved in nfsd where if not enough buffer space is available but idmap_lookup triggers lookup_fn which calls cache_get and returns successfully, the corresponding cache_put is missed. This leads to a reference leak.

A deadlock vulnerability was found in the Linux kernel's EROFS filesystem caused by crafted images with overlapping pclusters. The issue leads to a task hang due to improper handling of managed folios and I/O submission ordering.

In the Linux kernel, the RDMA/hns driver has a bug where spin_unlock_irqrestore() is called with IRQs enabled while spin_lock_irqsave()/spin_lock_irqrestore() was held. This can lead to inconsistent lock state and potential system stability issues.

In the Linux kernel drm/xe driver, user binds map to engines that can fault, and faults depend on user binds completion, which can cause a deadlock. To avoid this, a reserved copy engine is used for user binds on faulting devices.

In the Linux kernel, a vulnerability in wifi mac80211 involves calling __dev_queue_xmit() with interrupts disabled, leading to a warning in __local_bh_enable_ip. A two-phase skb reclamation was implemented in ieee80211_do_stop().

In the Linux kernel, sock_hash_free() lacked a cond_resched() call, causing soft lockups when destroying large maps with many buckets. The fix adds cond_resched() to yield the CPU when needed.

In the Linux kernel, the CAN BCM (Broadcast Manager) module fails to clear the bo->bcm_proc_read pointer after removing a procfs entry. This leads to a warning and unnecessary remove_proc_entry() call when closing a socket that was not reconnected. The vulnerability is fixed by clearing the pointer in bcm_notify().

A vulnerability in the Linux kernel allows a possible NULL pointer dereference in the rt6_uncached_list_flush_dev() function in the IPv6 module. The flaw was introduced by accidentally removing a check for rt->rt6i_idev being NULL, leading to a kernel crash (general protection fault) during network interface operations, such as closing a tun device.

In the Linux kernel, blk_add_partition() initially used a single if-condition (IS_ERR(part)) to check for errors when adding a partition. This was modified to handle the specific case of -ENXIO separately, unintentionally leaving a path where md_autodetect_dev() could be called without confirming that part is a valid pointer. The fix separates the error handling logic, improving readability and explicitly handling specific error scenarios.