CVE Vulnerability Catalog

In the Linux kernel, in the IIO chemical atlas-sensor driver, the driver requests its hardware data-ready IRQ with devm_request_threaded_irq(); its threaded handler queues an irq_work, atlas_work_handler(), that calls iio_trigger_poll(data->trig). Since the IRQ is devm-managed, free_irq() runs after atlas_remove() without flushing that irq_work, so a pending irq_work can run after the unwind has freed atlas_data/indio_dev and the trigger, causing a use-after-free when atlas_work_handler() dereferences data->trig.

In the Linux kernel, KVM nVMX does not flush vpid02 on first use because last_vpid is not reset when vpid02 is freed on VMXOFF. This can lead to the use of stale TLB entries from a previous lifetime of the VPID, associated with a different vCPU or VM.

In the Linux kernel, KVM nVMX may execute INVVPID on a different physical CPU than the one L2 is running on. This can lead to TLB entries not being invalidated on the correct CPU if L1 migrates between CPUs.

In the Linux kernel KVM (x86/mmu) subsystem there is a use-after-free in the rmap aging path. If a writer populates the rmap between the lock's read and the iterator's re-read, the lockless aging path walks the newly installed rmap without holding its lock. This can cause a writer to free the pte_list_desc chain via kmem_cache_free() while the walk is in progress, resulting in a slab use-after-free.

A flaw exists in the Linux kernel's KVM x86 Hyper-V synthetic timer emulation. When a guest or userspace sets the timer COUNT to a value close to U64_MAX, the deadline calculation can overflow and cause the timer to fire immediately, resulting in a CPU livelock and RCU stall reports.

In the Linux kernel, KVM for s390 has an issue with not holding srcu when importing watchpoint data. __import_wp_info() reads guest memory, which requires holding kvm->srcu to avoid a race with memslot updates, potentially leading to use-after-free.

In the Linux kernel, KVM for s390 has a memory corruption vulnerability due to reinjecting CK machine checks. Channel-subsystem damage machine checks should not be forwarded to the guest, and reinjecting them can lead to kfree of a stack variable.

In the Linux kernel, KVM for s390 has an issue with reading gmap->asce without holding mmu_lock in the keyop operation. Other functions read this field inside the mmu_lock read-side, but keyop does not, which can lead to using a stale value and memory corruption.

In the Linux kernel, vgic_v3_save_pending_tables() in KVM arm64 iterates over dist->lpi_xa without holding a reference to the vgic_irq structures, relying only on temporary RCU coverage. A concurrent path can free the LPI, leading to a dangling pointer dereference after the RCU grace period. The fix re-fetches each LPI via vgic_get_irq() and drops it with vgic_put_irq().

In the Linux kernel, vgic_its_save_ite() in KVM arm64 unconditionally dereferences ite->collection, which can be NULL after a MAPC with V=0. A guest issuing MAPD, MAPTI, then MAPC(V=0) can cause a host kernel oops when the VMM issues KVM_DEV_ARM_ITS_SAVE_TABLES for migration. The fix saves a zeroed entry, which is read back as invalid on restore.

In the Linux kernel, range-based TLB invalidation (TLBI Range) in KVM arm64 can encode large ranges in few bits, making it easy for a guest to cause an overflow if the hypervisor naively adds the range to the base address. The fix caps the range to the limit dictated by the address bit determining the VA range, and for IPA invalidation further ignores the upper range.

In the Linux kernel, the vector[] variable declared on the stack in dmsintc_inject_irq() in KVM for LoongArch is sometimes used without initialization. The fix initializes this variable to avoid using uninitialized data.

In the Linux kernel, kvm_arch_prepare_memory_region() in KVM for LoongArch computes arch flags for a memslot only for KVM_MR_CREATE and KVM_MR_MOVE, returning early for KVM_MR_FLAGS_ONLY. Since the generic code allocates a zeroed memslot, after a KVM_MR_FLAGS_ONLY update the arch flags are cleared, potentially causing guest memory to be mapped to wrong host pages. The fix carries arch flags over from the old memslot for KVM_MR_FLAGS_ONLY.

In the Linux kernel, pch_msi_set_irq() in KVM for LoongArch passes e->msi.data directly to eiointc_set_irq() as the IRQ number without checking it against EIOINTC_IRQS. The MSI data comes from userspace (KVM_SET_GSI_ROUTING or KVM_SIGNAL_MSI), and a value >= 256 causes out-of-bounds reads and writes, allowing kernel memory corruption. The fix rejects MSI data outside the EIOINTC IRQ space.

In the Linux kernel for LoongArch, the BPF subsystem had a bug in jump offset calculation for tail calls. The old macro-based method could lead to incorrect branch offsets and soft lockups under extra JIT passes. The fix calculates the offset directly on the absolute target and adds a guard for null image.

In the Linux kernel for LoongArch, the acpi_package_ids[] array can overflow on virtual machines with many sockets. With a typical one-core-per-socket configuration, the number of sockets can reach 256, causing the array to overflow. The fix increases the array size to the maximum of MAX_PACKAGES and KVM_MAX_VCPUS.

In the Linux kernel on LoongArch, the rethook trampoline saved and restored the percpu base register ($r21) in its frame. If the task migrated to another CPU while the handler ran, the stale percpu base was restored, causing incorrect this_cpu_*() accesses and corruption of scheduler and timer state.

In the Linux kernel for LoongArch, there is a vulnerability related to break 11 handling in the context of Kprobes. A user can issue the same break instruction, causing kprobe_singlestep_handler() to be called without an active probe, leading to preempt count underflow. This may result in incorrect socket attribution to the root cgroup, bypassing BPF policies.

In the Linux kernel's CEC subsystem, there is an issue with delayed work during an interrupted transmit. If the wait for transmission is interrupted by a signal, cancel_delayed_work_sync() may run before the CEC kthread arms the work, leading to freeing data with pending work. The fix uses disable_delayed_work_sync() to cancel and disable the work, preventing re-arming.

In the Linux kernel's CEC subsystem for the Extron DA HD 4K Plus device, there is a lack of input validation that could lead to overflowing the msg.msg[] buffer when malformed data is received. The fix adds a sanity check.