CVE Vulnerability Catalog

In the Linux kernel's drm/amdgpu driver, amdgpu_debugfs_gpr_read() drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label and drops the reference a second time, causing a runtime PM usage count underflow or stealing a reference held by someone else.

In the Linux kernel's drm/amdgpu driver, amdgpu_gem_userptr_ioctl() returns -ENOMEM immediately when amdgpu_hmm_range_alloc() fails and skips the cleanup path. This leaks the GEM object, the bo->parent reference on the VM root, and the MMU notifier registration.

In the Linux kernel's drm/amdgpu driver, amdgpu_gem_object_close() detaches the user queue eviction fence from the BO before checking bo_va->ref_count. Closing any handle of a BO removes the fence even when the file still has another handle and GPU mappings, allowing the BO to be evicted without suspending the user queues.

In the Linux kernel's drm/exec module, detecting contention causes a reference to the contended object to be grabbed and the object pre-locked. If the object was about to be destroyed, drm_exec holds the last reference but the object never enters the array of locked objects, so no dma_fence slot is reserved, potentially triggering a warning or BUG_ON().

In the Linux kernel's drm/i915/dmc driver, for DMC firmware header version 3 the firmware load address is stored in dmc_info->start_mmioaddr and used by dmc_load_program(). Unlike the MMIO address table, the load address is not validated, potentially leading to use of an invalid address.

In the Linux kernel's drm/xe driver, xe_bo_set_purgeable_shrinker() unconditionally transfers pages between the shrinkable and purgeable counts. When the purgeable state of a pinned BO changes (e.g., userspace madvising DONTNEED on a VMA of a BO pinned as a scanout buffer), one count underflows and the other remains permanently inflated after unpin.

In the Linux kernel's sched_ext module, a deferred reenqueue can read a freed user DSQ. The request stays on its CPU's deferred list until run_deferred() takes it, and the RCU callback freeing the DSQ assumes the grace period flushed it, but a run_deferred() starting after the grace period began can detach the request right before the callback looks and read the freed DSQ's id.

In the Linux kernel's tracing module, predicate_parse() adds two to nr_preds to reserve terminal TRUE and FALSE entries and uses that increased value as the limit for parsed predicates. If the initial count is smaller than the number actually parsed, the program can fill the allocation and subsequent accesses can go past its end.

In the Linux kernel's tracing module, predicate_parse() uses the first operator stack entry before processing any opening parentheses. A push increments top before writing, and the existing check still permits the write when top already points to the last allocated entry, potentially accessing beyond the operator stack.

In the Linux kernel, a flaw in ftrace causes tracing_set_tracer() to set current_trace_flags to NULL when switching to a tracer with no flags (e.g., hwlat, irqsoff, wakeup). If the ring buffer still holds function_graph entries from the previous tracer, printing them (e.g., via cat trace) dereferences the NULL pointer and crashes the kernel.

A bug was fixed in the Linux kernel tracing subsystem regarding hist trigger timestamps for buffered events. When an event file has a filter and the hist trigger is not yet attached, the event is written to a temporary per-CPU buffer without incrementing the committing counter, causing a WARN_ON_ONCE in ring_buffer_event_time_stamp. The fix uses tracing_event_time_stamp() in hist_field_timestamp() to record the current timestamp instead of warning.

In the Linux kernel, do_tcp_getsockopt() for TCP_CONGESTION suffers a use-after-free. The icsk_ca_ops pointer is read without holding rcu_read_lock(), and with BPF struct_ops it may point to memory freed concurrently via setsockopt(TCP_CONGESTION).

In the Linux kernel, do_tcp_getsockopt() for TCP_CC_INFO suffers a use-after-free. The icsk_ca_ops pointer and get_info function pointer are dereferenced without rcu_read_lock(), and with BPF struct_ops they may point to freed memory.

In the Linux kernel cifs subsystem, cifs_do_truncate updates i_size without a valid file handle. When find_writable_file() returns null, the inode size is set to 0 even though the server file is unchanged, causing inconsistency.

In the Linux kernel dm-crypt, crypt_dec_pending reads io->error before atomic_dec_and_test, creating a race condition. As a result, a failed read or write may be incorrectly reported as successful.

In the Linux kernel dm-integrity, integrity_metadata can enter an infinite loop on discard when the tag size exceeds HASH_MAX_DIGESTSIZE and kmalloc fails. In that case max_blocks is zero and bi_size is never decremented.

In the Linux kernel, the mac802154 subsystem had a data race and NULL pointer dereference on local->assoc_dev. The pointer shared between the association path and the association-response worker was not synchronized, which could lead to use-after-free or NULL dereference. The fix replaces the pointer with a cached address protected by a dedicated spinlock.

In the Linux kernel net/iucv, iucv_sock_recvmsg() sends the AF_IUCV_FLAG_WIN flag without testing the transport, causing a NULL dereference and spurious disconnect on classic z/VM sockets. Sending under spin_lock_bh also causes a race and double use of window credit.

In the Linux kernel XFS, xfs_sync_sb_buf() holds sb/rtsb buffer locks across a synchronous xfs_trans_commit(), causing a deadlock if shutdown occurs during CIL push. The fix removes xfs_trans_bhold() calls and re-acquires buffers after commit.

In the Linux kernel XFS, the capability check uses has_capability_noaudit(), which tests real credentials instead of effective ones. This allows bypassing group quota limits by changing a file's gid to another group the user belongs to, e.g. via an NFS client.