CVE Vulnerability Catalog

In the Linux kernel's CEC subsystem, there is a serialization issue with delivering messages to the exclusive follower. cec_receive_notify() reads the follower pointer without the adapter lock, which can lead to a race with mode changes or release. The fix serializes the no-follower check and message delivery.

A vulnerability was found in the Linux kernel cx231xx media driver where format or standard changes (vidioc_s_fmt_vid_cap, vidioc_s_std) were rejected only when the video queue was busy, not the VBI queue. Since the VBI queue shares the same geometry (dev->width, dev->norm), an application could enlarge the width or switch to PAL while the VBI stream was running, causing a heap out-of-bounds write in cx231xx_do_vbi_copy().

In the Linux kernel media cx23885 driver, netup_ci_exit() frees a netup_ci_state while its work item netup_read_ci_status() may still be pending or running on the system workqueue. The worker obtains the state via container_of() and dereferences it, so it must not outlive the state.

In the Linux kernel media go7007 driver, go7007_snd_init() takes a v4l2_device reference for the ALSA side, but go7007_snd_remove() drops it immediately after calling snd_card_free_when_closed(). This is too early when a userspace process still has the capture PCM open, potentially leading to a use-after-free.

In the Linux kernel media i2c ov02a10 driver, ov02a10_check_hwcfg() calls fwnode_handle_put(ep) immediately after allocating and parsing the endpoint, but subsequently uses the same 'ep' handle in fwnode_property_read_u32(), leading to a use-after-free. Additionally, reading the optional 'ovti,mipi-clock-voltage' property overwrote the 'ret' variable, causing probe to fail entirely.

In the Linux kernel media i2c ov7740 driver, ov7740_remove() had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler that relies on that mutex, leading to a use-after-destroy kernel panic. Additionally, the driver called v4l2_ctrl_handler_free() and mutex_destroy() sequentially, then called ov7740_free_controls() which invokes both again, resulting in a double-free.

In the Linux kernel, the media platform mtk-mdp3 driver's mdp_probe() mishandles SCP device reference counting. The fallback path drops the reference obtained via __get_pdev_by_id() too early, and scp_put() later drops it again, resulting in a double reference release.

In the Linux kernel, the media rc sunxi-cir driver does not unregister the rc device on probe failures after rc_register_device() succeeds. Only rc_free_device() is called, leaving the registered rc device and its resources behind.

In the Linux kernel, the media rkvdec HEVC decoder's st_ref_pic_set_prediction() computes the reference RPS index as st_rps_idx - (delta_idx_minus1 + 1) using u8 operands. When delta_idx_minus1 + 1 exceeds the current index, the subtraction wraps and the array access at calculated_rps_st_sets[ref_rps_idx] reads far out of bounds.

In the Linux kernel, the rtl2832_sdr driver's rtl2832_sdr_start_streaming() function failed to release previously allocated DMA buffers and URB structures when allocation or submission of URBs failed. This led to a DMA memory leak and an out-of-bounds read of urb_list[] on the next streaming attempt, potentially passing garbage pointers to usb_free_urb().

In the Linux kernel, the media saa7164 driver's saa7164_dev_setup() adds the device to the global saa7164_devlist before requesting the PCI BAR memory regions. When get_resources() fails, the device remains on the list while the probe error path frees it, leaving a dangling entry.

In the Linux kernel, the VPE (Video Processing Engine) driver for TI platforms has a vulnerability due to missing synchronization between the FIFO overflow recovery worker and IRQ handling during stream teardown. This can lead to use-after-free of stream resources when an interrupt or worker runs after the stream is released.

In the Linux kernel, the media v4l2-ctrls module lacks validation of HEVC EXT SPS RPS counts. Decoder drivers may index beyond dynamic arrays if SPS values exceed HEVC limits (64 short-term sets, 32 long-term references) or exceed the DPB maximum.

In the Linux kernel, the media zoran driver double-frees a registered video_device. The zoran_exit_video_devices() function calls video_unregister_device() and then kfree() on the same object already freed by the zoran_vdev_release() callback.

In the Linux kernel, the scsi qla2xxx driver's qla_chk_edif_rx_sa_delete_pending() function dereferences a NULL pointer when the SCSI command has already been returned or aborted. This can lead to a kernel crash in interrupt context.

In the Linux kernel, the scsi qla2xxx driver's qla24xx_report_id_acquisition() function has a use-after-free because the virtual port is used after dropping the vport_slock without taking a reference. Concurrent qla24xx_deallocate_vp_id() can free the port, leading to memory corruption.

In the Linux kernel, the scsi qla2xxx driver's qla_nvme_fcp_abort() and qla_nvme_ls_abort() functions call INIT_WORK() before schedule_work(), which on repeated aborts of the same command can corrupt the workqueue list and lead to crashes or a looping worker.

In the Linux kernel scsi: qla2xxx driver, the queue count derived from the MSI-X vector count (msix_count - 1) is stored in a u8 field, causing truncation. With 257 MSI-X vectors the result 256 truncates to 0, and in target mode a further decrement underflows 0 to 255. When the count is 0, the allocation returns ZERO_SIZE_PTR, which is not NULL, so the check passes and the pointer is dereferenced, corrupting memory or crashing the kernel.

In the Linux kernel scsi: qla2xxx driver, qla84xx_put_chip() drops the last reference to ha->cs84xx and frees it via __qla84xx_chip_release() without clearing ha->cs84xx. During teardown it ran before scsi_remove_host(), which removes the 84xx_fw_version host sysfs attribute. A concurrent read of that attribute in the window between the two calls executes qla24xx_84xx_fw_version_show(), which dereferences the freed ha->cs84xx, resulting in a use-after-free.

In the Linux kernel, the scsi: qla2xxx driver's qla2x00_status_entry() allowed non-SCSI SRB entries into the SCSI fast path, where sp->u.scmd.cmd was dereferenced. An unexpected STATUS_TYPE IOCB for a non-SCSI handle could yield a garbage pointer and a wild pointer dereference.