CVE Vulnerability Catalog

In the Linux kernel, gpiod_set_array_value_complex() returns immediately after a failed gpiochip_set_multiple() call, bypassing the freeing of possibly allocated bitmaps. This causes a memory leak on an unlikely but possible error path.

In the Linux kernel, the mxc GPIO driver installs the chained IRQ handler (mxc_update_irq_chained_handler()) before the IRQ domain, generic IRQ chip and port list entry are set up. An interrupt in that window causes a NULL dereference or access to an incomplete list, and failures in later probe steps leave a dangling handler pointing at freed memory.

In the Linux kernel, since SGMII/RGMII/SMII interrupt handling was removed, the stmmac dwmac1000 driver no longer reads GMAC_RGSMIIIS, so the RGMII status stays pending behind GMAC_INT_MASK. During stmmac_resume() the MAC reset clears the mask and the pending status storms the interrupt line, causing a soft lockup, watchdog reset or hang.

In the Linux kernel, __perf_pmu_remove() removes group leaders while iterating with perf_event_groups_for_cpu_pmu(), and perf_remove_from_context() takes the leader out of the rbtree so rb_next() returns NULL and the walk ends prematurely. Remaining groups stay in the source context and are torn down only when the CPU dies, running despite the PMU's interrupts and events being migrated to a new CPU.

In the Linux kernel, get_seg_reg_override_idx() had its local result variable shadowed by the loop counter declared in for_each_insn_prefix(). As a result, FS and GS segment overrides are ignored, and a CS override causes an infinite loop in the kernel during UMIP emulation, allowing any user to tie up CPUs until reboot.

In the Linux kernel firewire subsystem, a race condition exists in split transaction handling. Both the response handler and the timeout callback may process the same transaction entry, leading to a use-after-free on the transaction initiator side.

In the Linux kernel accel/rocket driver, rocket_remove() decrements num_cores before searching for the core slot, so the last core is never found and removed. This leaves stale state and leads to an out-of-bounds write to rdev->cores when cores are rebound on RK3588.

In the Linux kernel accel/rocket driver, sched_to_core() searches only up to rdev->num_cores, which is decremented when a core is unbound. Unbinding a non-last core leaves later cores outside the search, so sched_to_core() returns NULL for a core that is still bound and running jobs. Neither rocket_job_run() nor rocket_job_timedout() checks the result, leading to NULL pointer dereference (KASAN: null-ptr-deref).

In the Linux kernel ASoC SOF component (ipc4-topology), a shift-out-of-bounds occurs for aggregated ALH capture. When ch_count is smaller than device_count, step = ch_count / device_count truncates to 0, and GENMASK(step - 1, 0) underflows, triggering a UBSAN shift-out-of-bounds error.

In the Linux kernel autofs subsystem, a flaw was fixed where a delayed write to a replaced notification pipe returned -EPIPE and re-entered catatonic mode. This closed the replacement pipe and released the new daemon generation's wait queues, causing lookups to fail with ENOENT. The fix ensures catatonic mode is entered only when the failed pipe is still the current pipe.

A use-after-free flaw in the Linux kernel Unicode handling was fixed. generic_ci_d_hash() and generic_ci_d_compare() read sb->s_encoding and dereference the Unicode map during RCU pathwalk, while ext4, f2fs and tmpfs drop the map via utf8_unload() in ->put_super() when the last mount reference goes away. A lookup still inside such a filesystem can then read freed memory.

A race condition exists in the Linux kernel between watch_queue_set_size() and post_one_notification(). An unprivileged user can trigger a NULL pointer dereference in post_one_notification(), leading to a kernel panic.

A race condition exists in the Linux kernel's handling of KVM asynchronous page-not-present (#PF) events. If an NMI interrupts #PF handling and itself takes a kernel-mode #PF, it reads and clears the flags belonging to the interrupted event, causing a kernel panic reporting a host-injected async #PF in an interrupt-disabled region.

In the Linux kernel KVM SEV module, sev_gmem_post_populate() calls set_page_dirty() without holding the required lock, which can race with the page's mapping going away. The fix replaces the call with set_page_dirty_lock().

A flaw was fixed in the Linux kernel KVM (nVMX) where failure to load L2 state in the non-VM-Entry case (RSM emulation or KVM_SET_NESTED_STATE) left the vCPU's MMU pointer pointing at the nested MMU. This caused KVM to try running L1 with a nested MMU, leading to a NULL pointer dereference when the nested state was freed and KVM attempted to get the L1=>L2 EPTP.

A race condition in the Linux kernel fsnotify connector teardown was fixed. A new mark could be inserted before the current one, causing the walk to miss the replacement and detach the entire connector from the object. This led to igrab(NULL) and a null-ptr-deref when an unprivileged user read fdinfo.

In the Linux kernel, ext4_get_link() in RCU pathwalk mode reads data through sb->s_fs_info. ext4_put_super() frees the sbi and destroys extent status counters without waiting for a grace period, which can lead to a NULL dereference or use-after-free when the last mount reference disappears during a pathwalk.

A use-after-free vulnerability exists in the Linux kernel's eventfs mechanism. tracefs_d_revalidate() reads the ->is_freed field of an eventfs_inode during RCU pathwalk with only rcu_read_lock() held, while the object is freed after an SRCU grace period that does not wait for rcu_read_lock() sections. As a result, a walker can read already freed memory.

In the Linux kernel, create_ipc_ns() leaks resources: when mqueue/ipc sysctl setup or msg_init_ns() fails, the mqueue mount is dropped with a plain mntput() instead of kern_unmount(). Because the mount is long-term (MNT_NS_INTERNAL), the count drops to zero but the mount and mqueue superblock are never freed.

A use-after-free vulnerability exists in the Linux kernel's ntfs3 module. When the "nocase" mount option is used, dentry compare and hash functions access superblock private data in the RCU pathwalk, while ntfs_put_super() and ntfs3_kill_sb() free that data without an RCU delay. A lookup still inside the filesystem when the last mount reference is dropped causes a UAF.