CVE Vulnerability Catalog

In the Linux kernel, the EDAC/device_sysfs poll_msec sysfs store file uses simple_strtoul(), which accepts an unsigned long, while the target field poll_msec is an unsigned int. On 64-bit systems, a value greater than UINT_MAX is silently truncated when stored.

In the Linux kernel, the nvmet-rdma module has a resource leak. When pending disconnecting queues exceed the backlog limit, the connect path only drops the device reference and leaks the newly allocated queue and its IB resources.

In the Linux kernel, the drm/gud driver does not validate that the GUD_ROTATION_0 flag is present in the device's supported rotation bitmask. A device that omits this bit from GUD_PROPERTY_ROTATION triggers the WARN_ON in drm_plane_create_rotation_property().

In the Linux kernel, the printk subsystem incorrectly uses WARN_ON() to catch kthread_run() failure, since __kthread_create_on_node() returns -EINTR upon SIGKILL. This causes spurious kernel warnings under normal conditions.

In the Linux kernel, the accel/amdxdna driver's struct amdxdna_cmd_chain contains a flexible array annotated with __counted_by(command_count). Since the structure is stored in shared AMDXDNA_BO_SHARE memory, userspace can concurrently change command_count to zero, causing the bounds check to fail and triggering a kernel panic.

In the Linux kernel, the accel/amdxdna driver allows a command chain with command_count zero to pass the payload length check, and the fill loop does not run. On firmware without AIE2_NPU_COMMAND the request is rejected, but on firmware with aie2_get_npu_chain_msg_op() it reaches drm_clflush_virt_range(cmd_buf, 0), reading the byte before the buffer and faulting on the vmap guard page.

In the Linux kernel, the accel/amdxdna driver's amdxdna_cmd_set_error() takes a reference to the first BO of a command chain but fails to drop it on the mapping failure path, leaking the reference. The path is reachable when the BO handle is recycled by userspace after submission and a dma-buf without a vmap implementation is imported onto the same id.

In the Linux kernel, the drm/cirrus-qemu driver did not validate the BAR0 size during PCI probe. If a PCI device with BAR0 smaller than 4 MB (CIRRUS_VRAM_SIZE) was bound to the driver, the mapped VRAM was smaller than expected, allowing framebuffers larger than the mapped memory to be created and copied out of bounds, causing a supervisor write page fault.

In the Linux kernel, update_reparse_data() in the ntfs driver ignores the return value of set_reparse_index(). When index insertion fails, the code removes the just-written reparse data as cleanup but still returns 0, so symlink(2) reports success while no reparse data exists on disk.

In the Linux kernel, write_mft_record_nolock() in the ntfs driver maps the MFT record folio with kmap_local_folio(), but the pre_write_mst_fixup() and bio_add_folio() failure paths jump to the error label without unmapping it. Since kmap_local mappings are stack-ordered per task, leaking one corrupts the nesting for any outer mapping.

In the Linux kernel, ntfs_cluster_free_from_rl_nolock() in the ntfs driver adds a run's length to nr_freed whenever the error bookkeeping condition is false, which includes cases where ntfs_bitmap_clear_run() actually failed. Since a failed ntfs_bitmap_clear_run() rolls back its partial modifications, no bits were cleared for that run, yet its length still inflates vol->free_clusters.

In the Linux kernel, ntfs_sync_fs() in the ntfs driver unconditionally clears the dirty bit, whereas ntfs_put_super() and the remount-read-only path only clear it when NVolErrors(vol) is false. As a result, any sync() on a volume that recorded an error marks that volume clean, so no recovery is run.

In the Linux kernel, ntfs_dio_zero_range() in the ntfs driver returns either 0 or a negative errno from blkdev_issue_zeroout(); it never returns a positive value. The zeroing failure check in ntfs_attr_fallocate() therefore never fired, so a failed zeroing operation was silently ignored and newly allocated clusters were folded into initialized_size.

In the Linux kernel, is_boot_sector_ntfs() in the ntfs driver checks the boot sector's sectors_per_cluster field with a range test that rejects 0x81..0xf3 but accepts 0 and other non-power-of-two counts. A zero value reaches parse_ntfs_boot_sector(), where ffs(0) is 0, making the shift undefined.

A vulnerability in the Linux kernel BPF verifier allows it to incorrectly infer that a pointer is non-null. The bug occurs when comparing two pointers where one has a type without the PTR_MAYBE_NULL flag but can still be NULL at runtime. As a result, the verifier fails to catch a null pointer dereference, potentially leading to a crash or unauthorized code execution.

In the Linux kernel, ntfs_set_ea() in the ntfs driver unconditionally updates the HasEA flag based on ea_info_qsize in its exit path. When an error occurs before ea_info_qsize is updated, NInoClearHasEA() hides existing on-disk extended attributes (EAs) until the inode is evicted.

In the Linux kernel, the BPF verifier could incorrectly downgrade scalar zero spills to STACK_ZERO when part of the spilled bytes were already dead. This broke precision propagation chains and could lead to incorrect verification of BPF programs. The fix simply avoids converting zero spills to STACK_ZERO.

In the Linux kernel's stmmac network driver, stmmac_tso_xmit() failed to unmap DMA mappings created for the linear part and earlier fragments of an skb when mapping a subsequent fragment failed. This led to a DMA mapping leak. The fix releases descriptors and DMA mappings using stmmac_free_tx_buffer() and stmmac_release_tx_desc().

In the Linux kernel's scsi mpi3mr driver, mpi3mr_sas_port_add() does not check the NULL return value from sas_port_alloc_num() on memory allocation failure, leading to a NULL pointer dereference. Additionally, if sas_port_add() fails, the allocated port is not freed, leaking the sas_port structure. The fix adds a NULL check and calls sas_port_free().

In the Linux kernel's scsi mpi3mr driver, mpi3mr_sas_port_add() does not release the target device (tgtdev) reference in the out_fail error path if the reference was previously acquired by mpi3mr_get_tgtdev_by_addr(). This leads to a reference count leak and prevents the target device structure from being freed. The fix adds a tgtdev put in the out_fail path guarded by a NULL check.