CVE Vulnerability Catalog

In the Linux kernel mtk-sd MMC driver, the queued request timeout work was not synchronously cancelled during device unbind. The timeout callback can keep using a freed mmc_host, which KASAN reports as use-after-free in msdc_request_done() and msdc_recheck_sdio_irq(). The fix adds cancel_delayed_work_sync() after mmc_remove_host().

In the Linux kernel sdhci-sprd MMC driver, probe enables runtime PM but the remove path does not perform the corresponding runtime PM cleanup. During removal, clocks managed by runtime PM callbacks may be disabled while the device is runtime-suspended. The fix resumes the device, disables runtime PM and drops the temporary reference before disabling clocks.

In the Linux kernel, packet_rcv_spkt() lacks the dev_has_header() check before calling skb_push() to restore the link layer header. For devices without a visible header (e.g. CAN), skb->mac_header remains at the 0xFFFF sentinel, producing a large negative length and triggering skb_under_panic() from softirq context, i.e. a full system panic. The flaw is reachable via a SOCK_PACKET socket with CAP_NET_RAW.

In the Linux kernel, smc_getname() dereferences smc->clcsock without holding clcsock_release_lock, allowing link-group termination to release the CLC socket concurrently. This results in a use-after-free (or NULL dereference if the pointer is cleared before the load) when getsockname() is called.

In the Linux kernel bridge subsystem, br_multicast_sg_del_exclude_ports() removes automatically added STAR_EXCL port groups by calling br_multicast_del_pg(), which for S,G entries calls back into the same function recursively. A large number of STAR_EXCL ports consumes one kernel stack frame per port and can hit the stack guard page.

In the Linux kernel, skb_copy_and_csum_bits() returns 0 after copying only the linear part when it reaches unreadable frags, leaving the rest of the caller's buffer unchanged. Since buffers (e.g., ICMP errors or driver TX bounce buffers) are not zeroed beforehand, unexpected memory contents may be sent over the wire.

In the Linux kernel sparx5 driver, sparx5_tc_matchall_replace() allocates a struct sparx5_mall_entry for every offloaded matchall filter and adds it to a list, but sparx5_tc_matchall_destroy() removes the entry without freeing it. This leaks memory for every deleted mirror and goto matchall filter.

In the Linux kernel axienet driver (net: xilinx), the dmaengine path pre-submits RX buffers and holds in-flight TX buffers whose SKBs are DMA-mapped and freed only in completion callbacks. On ndo_stop(), dmaengine_terminate_sync() aborts descriptors without running callbacks, so the driver frees only ring shells, leaking every SKB and its DMA mapping on each ifdown.

In the Linux kernel team subsystem, a nonzero dev_queue_xmit() result does not return ownership of the skb. When an override port's qdisc drops it, the queue override helper tries another port or the mode transmit op with the freed skb, leading to use-after-free.

In the Linux kernel team subsystem, bc_transmit() sends the original skb through the last txable port. When no port is txable, it returns false without consuming the skb, but team_xmit() still returns NETDEV_TX_OK, so AF_PACKET sends retain the skb and its socket write-memory charge.

A Linux kernel vulnerability was fixed in the openvswitch module that caused a soft lockup during netlink flow dumps. ovs_flow_cmd_dump() called ovs_flow_stats_get() for every flow, repeatedly releasing the lock via spin_unlock_bh() and running pending softirqs in the dumping thread's context, preventing preemption.

In the Linux kernel, optee_probe() called tee_device_register() on both the client and supplicant device before the rest of struct optee was initialized. This made the device reachable from user and kernel space before mutexes, completions, and the argument cache were initialized and while optee->ctx was NULL, leading to use of uninitialized mutexes and NULL pointer dereferences.

In the Linux kernel pwrseq-pcie-m2.c driver, of_regulator_bulk_get_all() allocates the consumers array and hands it to the caller, who is expected to free it. The driver never did, leading to a memory leak.

In the Linux kernel ltc3676 regulator, HRST (0x1e) and CLIRQ (0x1f) are write-only command strobes. Reading HRST triggers a hard reset of the chip and reading CLIRQ clears the interrupt. A plain register dump via regmap resets the board.

In the Linux kernel, of_regulator_bulk_get_all() returns an array where only the consumer is filled in, not the supply name. When such an array is passed to regulator_bulk_enable() and a supply fails to enable, the function dereferences uninitialized memory. The fix copies names into the array's own allocation and removes the fixed 64-byte stack buffer.

In the Linux kernel, the tps6594-regulator driver for TPS65224 BUCK2-4 passes 4 as n_linear_ranges while tps65224_bucks_2_3_4_ranges[] has only two entries. This causes an out-of-bounds read when looking up selectors above 0x45 during normal registration. The fix uses ARRAY_SIZE() so the count always matches the table.

In the Linux kernel, the scsi: ch driver in ch_readconfig() takes a reference to the scsi_device of each data transfer element and never drops it. After a drive is removed, its scsi_device can never be released, blocking reuse of the address and preventing module unload. The fix drops the reference right after printing the name and removes the unused dt[] array.

In the Linux kernel on RISC-V, with CONFIG_SHADOW_CALL_STACK enabled, handle_exception() decided whether to reload the shadow call stack pointer (gp) based on the user-writable tp register. By setting tp to the linear-map address of its own task_struct, a user task could make the kernel skip the gp reload, leading to an unprivileged kernel arbitrary-write and control-flow-hijack primitive.

In the Linux kernel, errata_probe_ghostwrite() only marks the CPU vulnerable at the early boot stage, which requires CONFIG_RISCV_ALTERNATIVE_EARLY. That option is currently selected only by ERRATA_THEAD_MAE, so with ERRATA_THEAD_GHOSTWRITE=y and ERRATA_THEAD_MAE=n the vulnerable state is never set and the mitigation does not apply. The fix selects RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE.

In the Linux kernel on RISC-V, futex helpers pass the raw user pointer to atomic operations without untagging, even though access_ok() checks the untagged address. With the tagged address ABI enabled (CONFIG_RISCV_ISA_SUPM), an unprivileged process can make FUTEX_WAKE_OP perform an atomic read-modify-write on an arbitrary kernel address. The fix untags the pointer before the atomic operation, as get_user()/put_user() already do.