CVE Vulnerability Catalog

A fix in the Linux kernel resolves a warning during core dump on RISC-V. The issue was using the wrong register note type for REGSET_CFI.

In the Linux kernel, a NULL pointer dereference occurs in the wm_adsp driver when removing firmware controls. The wm_adsp_control_remove() function attempts to clean up private data without checking if the priv pointer is NULL.

In the Linux kernel, a vulnerability in netfilter nf_conntrack causes nf_ct_helper_expectfn_unregister() to not remove pending expectations from the table, leaving a dangling pointer to freed module code. When the expected connection arrives, invoking this pointer results in a kernel crash.

A NULL pointer dereference vulnerability was found in the Linux kernel's ASoC SDCA driver during function unregistration. When a function registration fails partially or device cleanup races with probe deferral, func_dev entries may be NULL, causing a kernel oops with BUG message.

In the Linux kernel, the virtio-gpu driver has an issue during driver removal when KMS is disabled. DRM atomic and modesetting are not initialized, leading to access of uninitialized data and kernel crash.

In the Linux kernel for ARM64 in Rust code, a bug was found related to the LLVM uwtable module flag. Due to a rustc bug, the -Cforce-unwind-tables=y flag does not emit the uwtable annotation for the module, causing compiler-generated functions (e.g., asan.module_ctor) to lack the annotation. When CONFIG_UNWIND_PATCH_PAC_INTO_SCS is enabled, this leads to boot failures due to incorrect patching of paciasp/autiasp instructions.

In the Linux kernel, a false positive WARN was removed when marking a page as dirty while the VM is dying. The issue affected SEV-ES guests where KVM kept a writable mapping of a guest page after an exit to userspace and tried to unmap it during vCPU destruction, triggering a warning about missing active vCPU.

A fix in the Linux kernel for the pinctrl mcp23s08 driver. Initialization of mcp->dev and mcp->addr was too late, causing a NULL pointer dereference during regmap init.

In the Linux kernel for ARM architecture, there is an issue in __switch_to() related to KASAN VMAP stack shadow. The ldr instruction was used to read the stack shadow, which is byte-granular and may not be word-aligned, causing an alignment fault on ARMv5.

In the Linux kernel on ARM64, the pagetable_dtor() call was missing when freeing hot-removed page table pages, causing bad page states, PTL allocation leaks, and incorrect NR_PAGETABLE stats. The fix adds the missing call in free_hotplug_pgtable_page().

A use-after-free (UAF) vulnerability was found in the Linux kernel's may_decode_fh() function in the fhandle mechanism. The issue arises from reading the mount::mnt_ns field without proper locking, allowing a race condition during unmount and namespace deallocation. The fix adds rcu_read_lock() around the mnt_ns access.

In the i2c-imx driver in the Linux kernel, there is an inconsistency between clock and pinctrl state in runtime PM. During suspend, the clock is disabled before switching pinctrl state, and a pinctrl failure leaves the clock disabled, causing a crash on subsequent hardware access.

In the i2c-qcom-cci driver in the Linux kernel, there is a NULL pointer dereference in cci_remove(). When only one of two I2C masters is initialized, calling cci_halt() for the uninitialized master causes a kernel crash during device unbinding or driver removal.

In the Linux kernel, the airoha network driver lacks a NULL check for the result of of_reserved_mem_lookup(). This can lead to a NULL pointer dereference and system crash when a device tree entry is misconfigured.

In the Linux kernel bonding driver, a NULL pointer dereference occurs in bond_do_ioctl() because slave_dbg() is called before the NULL check for slave_dev. This can cause a system crash when a non-existent interface is specified.

In the Linux kernel NVMEM onie-tlv driver, an infinite loop occurs when encountering an unknown entry type (e.g., 0x41), causing a system hang.

In the Linux kernel, the mm/damon/lru_sort module has a vulnerability due to missing error handling for context allocation. The damon_lru_sort_enabled_store() function assumes allocation always succeeds, leading to a NULL pointer dereference on failure.

In the Linux kernel, the DAMON_RECLAIM module has a NULL pointer dereference bug. The damon_reclaim_enabled_store() function assumes that the damon_ctx allocation will always succeed, which can lead to using an uninitialized pointer.

In the Linux kernel mincore_swap() function, there is an ordering issue in entry checks. On builds without CONFIG_SWAP but with CONFIG_MIGRATION or CONFIG_MEMORY_FAILURE, migration/poison entries are incorrectly treated as swap, causing false warnings and incorrect results.

In the Linux kernel's slimbus qcom-ngd-ctrl driver, callbacks are registered before the NGD (Next Generation Device) is created. When remoteproc starts in parallel with driver probing, callbacks operate on uninitialized data, causing system crashes.