CVE Vulnerability Catalog

In the Linux kernel, the scsi qla2xxx driver's qla24xx_report_id_acquisition() function has a use-after-free because the virtual port is used after dropping the vport_slock without taking a reference. Concurrent qla24xx_deallocate_vp_id() can free the port, leading to memory corruption.

In the Linux kernel, the scsi qla2xxx driver's qla_nvme_fcp_abort() and qla_nvme_ls_abort() functions call INIT_WORK() before schedule_work(), which on repeated aborts of the same command can corrupt the workqueue list and lead to crashes or a looping worker.

In the Linux kernel scsi: qla2xxx driver, the queue count derived from the MSI-X vector count (msix_count - 1) is stored in a u8 field, causing truncation. With 257 MSI-X vectors the result 256 truncates to 0, and in target mode a further decrement underflows 0 to 255. When the count is 0, the allocation returns ZERO_SIZE_PTR, which is not NULL, so the check passes and the pointer is dereferenced, corrupting memory or crashing the kernel.

In the Linux kernel scsi: qla2xxx driver, qla84xx_put_chip() drops the last reference to ha->cs84xx and frees it via __qla84xx_chip_release() without clearing ha->cs84xx. During teardown it ran before scsi_remove_host(), which removes the 84xx_fw_version host sysfs attribute. A concurrent read of that attribute in the window between the two calls executes qla24xx_84xx_fw_version_show(), which dereferences the freed ha->cs84xx, resulting in a use-after-free.

In the Linux kernel, the scsi: qla2xxx driver's qla2x00_status_entry() allowed non-SCSI SRB entries into the SCSI fast path, where sp->u.scmd.cmd was dereferenced. An unexpected STATUS_TYPE IOCB for a non-SCSI handle could yield a garbage pointer and a wild pointer dereference.

In the Linux kernel, the scsi: qla2xxx driver's qla2xxx_delete_qpair() deleted the request queue before the response queue, leaving a window where the response MSI-X interrupt could dereference the freed rsp->req. This results in a use-after-free.

In the Linux kernel, the scsi: qla2xxx driver's qla24xx_report_id_acquisition() format-1 path called qla_update_host_map() without holding vport_slock, allowing races with concurrent host_map updates and btree corruption.

In the Linux kernel, the f2fs filesystem's redirty_blocks() could run an extra cleanup loop iteration when read_cache_folio() failed before pinning any folios, causing folio_put_refs(folio, 2) to drop one reference too many. This led to "BUG: Bad page state" on later drop_caches or reclaim.

In the Linux kernel, f2fs F2FS_IOC_MOVE_RANGE checks the source range but not the destination end before updating i_size. A source hole can expose this: __clone_blkaddrs() skips NULL_ADDR entries and returns success, so the caller can still extend the destination inode with unchecked pos_out + len.

In the Linux kernel, f2fs stores recovery filenames as a length plus a fixed-size i_name buffer that is not NUL-terminated, but recover_inode() and recover_dentry() print it with %s. For a 255-byte filename, recovery logging can read past i_name into the following raw inode fields.

In the Linux kernel, a race condition exists in the f2fs file system's f2fs_get_read_data_folio() function, which calls f2fs_folio_put() before folio_nr_pages() when invalidating a large folio from the page cache. This allows a concurrent truncate or folio split to shrink or free the folio before the invalidate range is computed, leading to stale xarray entries and bad page state.

In the Linux kernel, f2fs when a node block is corrupted due to checksum mismatch or inconsistent footer info, the dirty flag of the node folio needs to be cleared in order to persist inconsistent node data to storage. This operation is missing in the error path.

In the Linux kernel, f2fs_sanity_check_node_footer() is not passed the correct folio->index value, causing it to check the same nid incorrectly. This can lead to improper node consistency verification in the f2fs filesystem.

In the Linux kernel, panthor_fw_read_build_info() in the drm/panthor driver validates the metadata range using 32-bit addition (hdr.meta_start + hdr.meta_size), which can wrap and let an out-of-bounds range pass. It also reads the "git_sha: " prefix without checking metadata length, and meta_size == 0 can underflow the NULL terminator index.

In the Linux kernel, panthor_init_cs_iface() and panthor_init_csg_iface() in the drm/panthor driver validate firmware control interface offsets using 32-bit arithmetic and the size of host wrapper structures, so the arithmetic can wrap before the bounds check and the checked size does not match the actual mapped firmware control interface.

In the Linux kernel, there is a race between a partial drm_dev_register() failure and an ioctl. If registration fails after a minor is registered, userspace may have entered a drm_dev_enter() critical section, and since the unplugged flag was never set, the ioctl proceeds while the error path tears down device resources.

In the Linux kernel DRM/AMD Display subsystem, the per-plane degamma LUT size is not validated, potentially leading to divide-by-zero or out-of-bounds read. The issue affects the AMD_PLANE_DEGAMMA_LUT property, only available when built with AMD_PRIVATE_COLOR.

In the Linux kernel DRM/AMDGPU VCN subsystem, an integer overflow was found in the buffer count check of the dec_msg message. A crafted value can bypass the bounds check and cause an out-of-bounds read.

A flaw in the Linux kernel's drm/ttm subsystem occurs when ttm_pool_restore_and_alloc() successfully completes the restore process via ttm_pool_restore_commit(), but fails to drop tt->restore afterward. As a result, subsequent backup/restore flows incorrectly perceive the restore as complete while shmem handles remain installed in tt->pages, leading to a stack trace and potential memory corruption.

In the Linux kernel DRM/AMDGPU subsystem, an out-of-bounds access to the adev->isolation[] array was found for rings not assigned to a partition. The index AMDGPU_XCP_NO_PARTITION (value ~0) causes access beyond the array, triggering UBSAN warnings.