CVE Vulnerability Catalog

In the Linux kernel, the sgi-gru driver removes dangerous page-table walks performed in interrupt context. The GRU TLB miss handler previously walked page tables without proper locking, potentially leading to races and security issues.

In the Linux kernel, the mt76 driver fixes handling of channel context switches with different bands in mt76_switch_vif_chanctx. Previously, rapid switches on different radios could cause incorrect behavior.

In the Linux kernel, the mt792x driver has a use-after-free vulnerability in mt76_rx_poll_complete due to a race condition. The wcid pointer may reference an already removed STA, causing invalid memory access.

In the Linux kernel, the wifi mt76 driver for mt7921 chips lacked PCIe AER error handling. When an AER error occurs and the bus hangs, register reads return 0xFFFFFFFF, corrupting the DMA queue state and causing an invalid memory access (q->desc[] or q->entry[]) and a system crash. The fix validates the DMA index read from hardware, checks the bus_hung flag before reset, rejects MCU messages while the bus is hung, and installs no-op bus operations after an unrecoverable AER error.

In the mt7915 driver, there is an underflow when calculating the number of spatial streams. If the MCS map has no supported streams, the function returns 255, which is written into the firmware's beamforming fields.

In the mt76 driver, there is a race in RXDMAD_C buffer recycling. These buffers come from page pools tied to a different NAPI, so direct recycling can race with the owning NAPI, leading to errors.

In the Linux kernel, mt7996_mac_reset_work() in the mt76 wifi driver (mt7996) parked the tx worker and disabled the RX/TX NAPIs before taking dev->mt76.mutex. Since mt76_worker_disable()/_enable() are plain kthread park/unpark, not refcounted, and __mt76_set_channel() toggles the same worker and the MT76_RESET bit under the mutex, an L1 SER racing a channel switch could leave the worker unparked and MT76_RESET cleared while the reset path resets the DMA rings, corrupting descriptors or tokens.

In the Linux kernel, btf_distill_func_proto() accepts function arguments up to 16 bytes, so a 128-bit scalar such as __int128 reaches the x86 trampoline with arg_size == 16. The current implementation assumes an __int128 argument only needs one register, so the register save area is under-allocated and save_args() overwrites adjacent stack slots.

In the mt76 wifi driver (mt7915), the TWT flow is added to dev->twt_list before sending the agreement to the firmware, but the error path leaves it linked while flowid_mask is never set. The flow slot can then be reused and memset while still on the list, corrupting twt_list, and station removal leaves a dangling entry behind.

In the mt76 wifi driver (mt7915), after mt7915_register_ext_phy() succeeded, a failure of the main PHY mt7915_init_debugfs() or mt7915_coredump_register() unwound through free_phy2, which called ieee80211_free_hw() on the ext PHY hw while it was still registered with mac80211, since mt76_unregister_device() only unregisters the main hw.

In the Linux kernel for arm64, the ptrace subsystem has an issue with keeping 'orig_x0' in sync with x0 on syscall entry. A previous fix failed to update 'orig_x0' during SECCOMP_RET_TRACE, allowing a tracer to modify the syscall argument without being subjected to seccomp or audit checking.

In the Linux kernel's cfg80211 there is a missing stop of PMSR measurements before tearing down P2P and NAN interfaces. Functions cfg80211_stop_p2p_device() and cfg80211_stop_nan() do not call cfg80211_pmsr_wdev_down(), which can leave stale requests in the driver and cause inconsistencies.

In the Linux kernel's coreboot driver there is a missing validation of table bounds. coreboot_table_probe() replaces the platform resource length with values supplied by firmware, which can lead to overflow in 32-bit size addition or mapping memory beyond the resource via a malformed table.

In the Linux kernel's PCI dwc ep driver, a vulnerability exists where the MSI path lacks a flush equivalent to the MSI-X path before unmapping the iATU entry. This can cause posted MSI writes to be dropped or misrouted when the iATU entry is unmapped.

In the Linux kernel's HID subsystem, a vulnerability exists where hid_device_io_start() allows reports to run concurrently with probe. If probe subsequently fails, __hid_device_probe() releases driver resources and clears hdev->driver without excluding those report callbacks, leading to use-after-free, e.g., in hidraw_report_event().

In the Linux kernel, blk-cgroup has a race between policy activation and blkg destruction. When switching an IO scheduler, blkcg_activate_policy() may race with concurrent blkcg deletion, leading to use-after-free and memory leak issues. Additionally, blkg_free_workfn() frees pd before removing the blkg from q->blkg_list, allowing allocation of a new pd for a blkg being destroyed.

In the Linux kernel, blk-cgroup's blkcg_activate_policy() can race with concurrent blkcg deletion when switching IO schedulers, leading to a use-after-free in rcu_accelerate_cbs. The issue occurs when a blkg is being destroyed while blkcg_activate_policy() tries to get a reference to it.

In the Linux kernel, the ublk module's import_ubuf() can fail if the address range provided by the userspace ublk server is outside the allowed user address space. In that case, an uninitialized struct iov_iter is passed to ublk_copy_user_pages().

In the Linux kernel, a vulnerability in the OCFS2 filesystem was found due to missing validation of inline extended attribute (xattr) bounds in the inode block. Corrupted metadata can lead to out-of-bounds memory access (use-after-free) during getxattr() or listxattr() calls.

In the Linux kernel, the ocfs2 filesystem's ocfs2_validate_xattr_block() checks the xattr block header but does not verify that a non-indexed block's xh_count and entry offsets fit inside the block. Indexed buckets likewise reach list/get consumers without an entry-bounds check, leading to use-after-free in ocfs2_xattr_list_entries().