CVE Vulnerability Catalog

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: check link is beaconing for color change. When trying to do a color change, validate that the link is beaconing first, to avoid calling the driver with an invalid link.

In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: use vb2_video_unregister_device on driver removal. The driver uses vb2_fop_release() as its file release operation, so vb2_video_unregister_device() should be used instead of video_unregister_device() during driver removal. This ensures that the vb2 queue is properly disconnected before the video device is unregistered.

In the Linux kernel, the drm/amdgpu driver lacked a limit on ATOM command table nesting depth. A cap of 32 levels with an execute_depth counter and returning -ELOOP when exceeded was added.

In the Linux kernel, the net: thunderx driver's cavium_ptp_get() acquires a reference to the PTP PCI device, but if initialization fails afterward the reference is leaked. A common error path was added to release the PTP reference before returning from probe failures.

In the Linux kernel, the ALSA seq oss snd_seq_oss_read() function had an inverted check for whether the next event fits in the userspace buffer. This caused valid events not to be copied or events larger than the read buffer to be copied.

In the Linux kernel, the dpaa2-switch driver's error path in dpaa2_switch_rx() incorrectly called dpaa2_switch_free_fd(), which is intended for Tx frame descriptors and expects an skb pointer. The fix moves dma_unmap_page() into dpaa2_switch_rx() and uses free_pages() or kfree_skb() depending on the error stage.

In the Linux kernel, the drm/amdkfd kfd_dbg_trap_enable() function did not unwind trap activation, debug_trap_enabled, an extra process reference, or the opened debug event file on copy_to_user failure. The fix deactivates the trap and undoes the rest of the enable setup before returning the error.

In the Linux kernel, the net: cpsw_new driver's cpsw_probe() registers devlink before registering CPSW ports. If cpsw_register_ports() fails, the error path does not unregister devlink, leaving its instance and parameters registered after a failed probe.

In the Linux kernel, the net: microchip: sparx5 driver's sparx5_tc_flower_psfp_setup() allocates PSFP resources before adding VCAP actions and does not unwind them on later failure. Error paths were added to release the stream filter, flow meter, and stream gate, and the flow-meter id return was corrected.

In the Linux kernel, the btrfs sb_write_pointer() function reads the superblock from the block device page cache via read_cache_page_gfp() without protection against block size changes. The fix takes the mapping invalidate lock around the read to serialize it against block size changes.

In the Linux kernel, the net: lan966x driver's lan966x_fdma_reload() did not restore rx->page_order and rx->max_mtu or the per-port XDP RXQ page pool registration when RX resource allocation for a new MTU failed. The fix saves and restores these fields and the old page pool registration before restarting RX.

In the Linux kernel, the drm/amdkfd set_queue_properties_from_criu() function did not call kfd_queue_acquire_buffers() after that function was split off from set_queue_properties_from_user(), so queue_properties buffer fields were not filled. The fix adds the proper call and correct cast types.

In the Linux kernel, the imx mailbox driver has a power management (pm_runtime) initialization and teardown ordering issue. Calling pm_runtime_enable() early before probe completes can lead to using the device in an incomplete state. The fix moves pm_runtime handling to devm and reorders mailbox controller registration.

In the Linux kernel, the imx mailbox driver has a race between interrupt handling (imx_mu_isr) and channel shutdown (imx_mu_shutdown). In a short window, the RX event may be re-enabled by the ISR after being disabled in shutdown, which on shared interrupt handlers can lead to a "nobody cared" message. The fix adds a shutdown field to signal channel teardown and serializes access with a lock.

In the Linux kernel, the md/raid5 subsystem compares the 32-bit bm_seq sequence counter in stripe batches without overflow safety. After the counter wraps, a newer value can appear smaller than an older one. The fix introduces a wrap-safe comparison.

In the Linux kernel, the ksmbd server has a flaw in lease break and acknowledgment state handling. When breaking level-II/read leases for writes and truncates, valid states containing WRITE_CACHING are skipped. The fix applies the acknowledged state directly and keeps the break pending on failed ACKs.

In the Linux kernel, the xen/gntalloc module's gntalloc_ioctl_alloc() allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above the limit cannot succeed, so the fix rejects them before calling kcalloc(). It also adds a subtraction-based check under gref_mutex and casts the count before page-size multiplication.

In the Linux kernel, the netfilter ipset subsystem does not properly mark RCU-locked areas. After incrementing the uref counter, there is no need to hold the RCU lock because the referenced hash table cannot disappear. The fix corrects RCU lock and spinlock usage in mtype_gc.

In the Linux kernel, the drm/amd/pm/si driver does not initialize the thermal work queue when DPM is disabled via the amdgpu.dpm=0 module parameter. Nevertheless, it attempts to schedule work on that queue. The fix prevents scheduling thermal work when the queue is not initialized.

In the Linux kernel, the ksmbd server's __smb_break_all_levII_oplock() waits for a lease break acknowledgment while holding ci->m_lock for read. A cifs.ko client reacts to a handle lease break by closing the deferred handle, which requires the lock for write and blocks, causing a wait of up to 35 seconds. The fix collects opinfos under the lock and then breaks them after releasing it, using references.