CVE Vulnerability Catalog

In the Linux kernel, the thunderbolt subsystem processes hotplug events in a workqueue that may run after the domain has been removed by tb_domain_remove(). This can lead to a use-after-free (UAF) when the driver is unloaded while a device is being plugged in. The fix takes a domain reference before scheduling the hotplug handler.

In the Linux kernel, the net/mlx5 HWS driver has an issue when destroying a table that has a miss table created by mlx5hws_table_set_default_miss. The miss table keeps the table pointing to it in a list. When such a table is deleted, it is not removed from the miss table list, leaving a node with garbage data.

In the Linux kernel, the drm/amd/ras CPER ring overflow handling trusts the parsed entry size from the current ring contents. Corrupt CPER data can produce an entry size that does not advance the read pointer, causing the recovery loop to spin while holding the CPER ring mutex and hang the worker writing the next CPER record. The fix detects a no-progress rptr update and resets the CPER ring to an empty state.

In the Linux kernel, the arm_scmi SENSOR_UPDATE notification parser derived the expected reading count from the sensor description but did not verify that the received payload contained those entries before parsing them. Truncated update notifications could therefore be parsed past the end of the payload. The fix rejects truncated notifications before reading the variable array.

In the Linux kernel, the arm_scmi BASE_ERROR_EVENT notification parser used the report count encoded in error_status without checking whether the received payload contained all reported entries. Truncated payloads could therefore be copied past the end of the buffer. The fix rejects truncated payloads before copying the report array.

In the Linux kernel, the wifi mac80211 function ieee80211_rx_mgmt_deauth() read the deauth reason code before checking that the fixed field was actually present in the received frame. The fix validates the deauth frame length first and only then reads the reason code.

In the Linux kernel, the wifi libertas driver's lbs_hard_start_xmit() in monitor mode cast skb->data to a radiotap TX header, skipped that header, and copied the 802.11 destination address from offset 4 without checking the minimum frame length. The generic length check only rejected zero-length and oversized skbs, so a short monitor frame could be read past the end of the skb data. The fix requires enough bytes for the radiotap TX header and the destination address field.

In the Linux kernel, the wifi iwlwifi mvm scheduled scan built the probe request before iwl_mvm_scan_fits(), so oversized IEs could be copied into the fixed preq buffer before length validation. The fix moves iwl_mvm_build_scan_probe() after the fits check and advertises max_sched_scan_ie_len using iwl_mvm_max_scan_ie_len() so userspace limits account for driver-inserted DS/TPC bytes.

In the Linux kernel on arm64, a vulnerability exists in kprobes handling during single-stepping. A kprobe hit in KPROBE_HIT_SS state was incorrectly treated as unrecoverable, potentially losing interrupt state and leaving interrupts permanently disabled. The fix allows safe reentry in this state and saves/restores saved_irqflag in struct prev_kprobe.

In the Linux kernel, the wifi mac80211_hwsim function hwsim_tx_info_frame_received_nl() cast the HWSIM_ATTR_TX_INFO payload to a struct hwsim_tx_rate * and unconditionally read IEEE80211_TX_MAX_RATES entries (8 bytes) from it. The policy only bounded the attribute from above and the op set GENL_DONT_VALIDATE_STRICT, so a short or zero-length attribute was accepted and the loop read past the payload. The fix requires the exact length in the policy so a malformed attribute is rejected before the handler runs.

In the Linux kernel, the drm/gma500 xfer_read() waited for the HDMI I2C transaction to reach I2C_TRANSACTION_DONE but ignored both timeout and signal returns from wait_for_completion_interruptible_timeout(). If the interrupt never advanced the transaction state, the loop could wait forever. The fix returns -ETIMEDOUT when the completion wait expires, propagates interrupted waits, and makes the I2C master_xfer callback return the first transfer error instead of reporting a successful message count.

A bug was fixed in the Linux kernel's IMA (Integrity Measurement Architecture) subsystem that attempted to change file extended attributes (xattr) on a read-only filesystem during early boot. On ext4 this triggered a journaling transaction and a kernel warning. The fix detects the file state early and returns an error instead of attempting the disallowed operation.

In the Linux kernel MMC core, validation for the host-provided max_segs field was missing. If a host driver sets an excessively large value, the unsigned short field may be truncated to zero, causing kmalloc(0) to return ZERO_SIZE_PTR, which then leads to invalid memory access in sg_init_table() and a kernel crash (Oops).

In the Linux kernel, the 8250 serial port driver did not recognize the UPIO_AU (type 4) UART type, causing a warning and unsupported UART type during probe on MIPS Alchemy systems. The fix adds recognition of UPIO_AU in set_io_from_upio() without further action, since parameters are already set up in au_platform_setup().

In the Linux kernel, the chips-media wave5 media driver did not range-check dec_output_info data, which could lead to an out-of-bounds write (buffer overflow of inst->frame_buf). The fix adds a range check for that data.

In the Linux kernel, an unnecessary rcu_barrier() call was removed from br_multicast_dev_del() in the network bridge module. This call originated from a time when call_rcu() was used in br_multicast.c, but since kfree_rcu() is now used, the barrier is no longer needed and causes excessive RTNL pressure. This led to task stalls waiting on mutexes, as reported by syzbot.

In the Linux kernel, the ntfs3 filesystem did not handle set_blocksize failures; because it uses buffer_heads which do not handle block sizes larger than PAGE_SIZE well, mounting could hit BUG_ON in folio_set_bh. The fix handles these failures.

In the Linux kernel, the isofs filesystem did not handle set_blocksize failures; because it uses buffer_heads which do not handle block sizes larger than PAGE_SIZE well, mounting could hit BUG_ON in folio_set_bh. The fix handles these failures.

In the Linux kernel, the irqchip/gic-v5 driver performed the priority drop only in irq_eoi(), together with interrupt deactivation. Since all interrupts share the same priority, long-running processing could block signaling of new interrupts. The fix moves the priority drop to occur immediately after acknowledging an interrupt in the main GICv5 handler.

In the Linux kernel, the irqchip/gic-v4 driver advertised VLPI support even when no ITS controller was probed. With kvm-arm.vgic_v4_enable=1 on a system lacking an MSI device tree node and GICv4, a NULL pointer dereference (gic_domain) caused a panic. The fix sets vLPI support to false at init time if the host has no ITS.