CVE Vulnerability Catalog

In the ring-buffer, rb_meta_subbuf_idx() can return a sub-buffer index one too high, leaving subbuf_ids[0] NULL which is dereferenced in __rb_map_vma() when userspace maps trace_pipe_raw. Incorrect indices are also written to metadata, causing the previous boot's trace to be rejected.

In the ring-buffer, ring_buffer_map_get_reader() treats a NULL result from rb_get_reader_page() as an error and emits a false warning when the mmap reader catches up with a writer still committing events. This state is normal and should not be reported as an error.

In the scsi bsg subsystem, bsg-lib allocates a 96-byte reply buffer while struct ufs_rpmb_reply is 104 bytes. When an Advanced RPMB command returns an EHS, ufshcd_advanced_rpmb_req_handler() writes 8 bytes past the end of the buffer.

In the Linux kernel, the scsi: st driver has a use-after-free race between st_remove() and st_open(). st_remove() removes the idr entry only after dropping the reference, so a concurrent st_open() can find the freed structure and call kref_get() on it.

In the Linux kernel, the xen/scsifront driver's scsifront_do_response() only bounds-checks rqid from above and does not verify the shadow[] slot is populated. A malicious or buggy backend can return a response with an in-range but not in-flight rqid, causing a NULL pointer dereference.

In the Linux kernel, libiscsi only bounds-checks the task index from parse_pdu_itt from above, so a negative index passes and reads before session->cmds[]. The be2iscsi driver can supply such an index from an unsolicited NOP-In.

A vulnerability in the Linux kernel libiscsi module allows a remote iSCSI target to supply an arbitrary ITT value in a Reject PDU without validation. This can cause a NULL pointer dereference, a refcount underflow, or silent completion of an in-flight SCSI command as successful.

In the Linux kernel, libiscsi's __iscsi_complete_pdu() resolves a task from the ITT index in management responses (Logout, Login, Text, TMFunc, NOP-In) and only validates that the index is in bounds. A malicious or faulty target can name an unused pool slot where task->conn is NULL, causing a NULL pointer dereference and kernel oops after a single unsolicited NOP-In or Text Response.

In the Linux kernel, drm/amd/display functions allocate_usb4_bandwidth_for_stream() and allocate_usb4_bandwidth() use ASSERT(stream->sink) before dereferencing stream->sink->link. Since ASSERT is compiled out in production builds, a NULL stream->sink causes a NULL pointer dereference.

In the Linux kernel's drm/amdgpu driver, amdgpu_debugfs_gpr_read() drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label and drops the reference a second time, causing a runtime PM usage count underflow or stealing a reference held by someone else.

In the Linux kernel's drm/amdgpu driver, amdgpu_gem_userptr_ioctl() returns -ENOMEM immediately when amdgpu_hmm_range_alloc() fails and skips the cleanup path. This leaks the GEM object, the bo->parent reference on the VM root, and the MMU notifier registration.

In the Linux kernel's drm/amdgpu driver, amdgpu_gem_object_close() detaches the user queue eviction fence from the BO before checking bo_va->ref_count. Closing any handle of a BO removes the fence even when the file still has another handle and GPU mappings, allowing the BO to be evicted without suspending the user queues.

In the Linux kernel's drm/exec module, detecting contention causes a reference to the contended object to be grabbed and the object pre-locked. If the object was about to be destroyed, drm_exec holds the last reference but the object never enters the array of locked objects, so no dma_fence slot is reserved, potentially triggering a warning or BUG_ON().

In the Linux kernel's drm/i915/dmc driver, for DMC firmware header version 3 the firmware load address is stored in dmc_info->start_mmioaddr and used by dmc_load_program(). Unlike the MMIO address table, the load address is not validated, potentially leading to use of an invalid address.

In the Linux kernel's drm/xe driver, xe_bo_set_purgeable_shrinker() unconditionally transfers pages between the shrinkable and purgeable counts. When the purgeable state of a pinned BO changes (e.g., userspace madvising DONTNEED on a VMA of a BO pinned as a scanout buffer), one count underflows and the other remains permanently inflated after unpin.

In the Linux kernel's sched_ext module, a deferred reenqueue can read a freed user DSQ. The request stays on its CPU's deferred list until run_deferred() takes it, and the RCU callback freeing the DSQ assumes the grace period flushed it, but a run_deferred() starting after the grace period began can detach the request right before the callback looks and read the freed DSQ's id.

In the Linux kernel's tracing module, predicate_parse() adds two to nr_preds to reserve terminal TRUE and FALSE entries and uses that increased value as the limit for parsed predicates. If the initial count is smaller than the number actually parsed, the program can fill the allocation and subsequent accesses can go past its end.

In the Linux kernel's tracing module, predicate_parse() uses the first operator stack entry before processing any opening parentheses. A push increments top before writing, and the existing check still permits the write when top already points to the last allocated entry, potentially accessing beyond the operator stack.

In the Linux kernel, a flaw in ftrace causes tracing_set_tracer() to set current_trace_flags to NULL when switching to a tracer with no flags (e.g., hwlat, irqsoff, wakeup). If the ring buffer still holds function_graph entries from the previous tracer, printing them (e.g., via cat trace) dereferences the NULL pointer and crashes the kernel.

A bug was fixed in the Linux kernel tracing subsystem regarding hist trigger timestamps for buffered events. When an event file has a filter and the hist trigger is not yet attached, the event is written to a temporary per-CPU buffer without incrementing the committing counter, causing a WARN_ON_ONCE in ring_buffer_event_time_stamp. The fix uses tracing_event_time_stamp() in hist_field_timestamp() to record the current timestamp instead of warning.