CVE Vulnerability Catalog

In the Linux kernel's io_uring/napi subsystem, there was no cap on the maximum polling time when no events were found, which could trigger kernel complaints about a stuck task due to missing conditional rescheduling. A 10 ms limit has been added to prevent this issue.

In the Linux kernel, a vulnerability was found in the nilfs2 filesystem where nilfs_ioctl_mark_blocks_dirty() fails to reject a zero bd_oblocknr value. An attacker can send a crafted ioctl request with bd_oblocknr set to 0, bypassing the dead block check and calling nilfs_bmap_mark() on a non-existent block, triggering a WARN_ON(ret == -ENOENT).

In the Linux kernel, the WARN_ON_ONCE in wbt_init_enable_default() was removed because both failure paths (wbt_alloc() returning NULL under memory pressure and wbt_init() returning -EBUSY) are expected. Replaced with plain if-checks and added pr_warn() for diagnostics.

In the Linux kernel, a vulnerability was found in the mt76 driver for mt7925 chipsets, where a NULL pointer dereference could occur in the mt7925_tx_check_aggr() function. The missing NULL check for 'sta' before dereferencing it may lead to a system crash.

In the mt76 Wi-Fi driver for MT7921/MT7922 chipsets, configuring a station with an AID above 20 causes a firmware crash. The issue occurs in AP mode and can be triggered by a modified hostapd version.

A NULL pointer dereference vulnerability was found in the Linux kernel's AMD GPU driver (drm/amd/ras) in the ras_core_ras_interrupt_detected() function. The issue occurs when ras_core is NULL and the code attempts to access the dev field in the error path.

In the Linux kernel, a vulnerability was found in the AMD GPU driver (drm/amd/ras) where the ras_core_get_utc_second_timestamp() function can cause a NULL pointer dereference. The issue occurs when the ras_core pointer is NULL and the function tries to access the dev field in an error message. The patch adds an early NULL check and returns 0 if the pointer is invalid.

In the Linux kernel, a vulnerability was found in the padata mechanism where the CPU offline callback was placed in a section that does not allow errors. It has been moved to the ONLINE section where errors are permitted to prevent warnings and potential issues.

In the Linux kernel drm/amd/display driver, a NULL pointer dereference vulnerability was found in dc_dmub_srv_log_diagnostic_data() and dc_dmub_srv_enable_dpia_trace(). Incorrect condition ordering can cause a NULL dereference during error logging, leading to a system crash.

In the Linux kernel, a vulnerability was found in the IOMMU driver for RISC-V architecture on the invalidation path. When gather->end reaches ULONG_MAX, an overflow causes an infinite loop. Additionally, incorrect length calculation (moving +1 to the other side of <) may lead to operational errors.

In the Linux kernel, a vulnerability was found in the FUSE filesystem where fuse_dentry_revalidate() may be called with a dentry having uninitialized ->d_time field. The issue was discovered by KMSAN and could lead to reading uninitialized memory.

In the Linux kernel, a vulnerability in the SoC Tegra CBB subsystem uses an incorrect base address when looking up the target timeout for an error occurring on a different fabric, causing a kernel page fault and potential system crash.

In the Linux kernel, an off-by-one vulnerability was found in the OCFS2 filesystem's dlm_match_regions() function. The local-vs-remote region comparison loop uses '<=' instead of '<', causing it to read one entry past the valid range of the qr_regions array. Other loops in the same function correctly use '<'.

In the Linux kernel, the max77705 driver leaks memory by not destroying the workqueue on remove() and has a flawed resource release order. Interrupt handlers registered via devm may schedule work on a freed workqueue, leading to use-after-free.

In the Linux kernel pinctrl subsystem (pinconf-generic), a vulnerability was found due to incomplete validation of the 'pinmux' property in the device tree. The pinconf_generic_parse_dt_pinmux() function assumes the 'pinmux' property is not empty when present, which can cause the allocator to return a special value instead of NULL, leading to a crash when accessing invalid memory.

In the Linux kernel's hvc_iucv driver, an off-by-one vulnerability was found in the number of supported devices. When the hvc_iucv_devices counter reaches 8, the code may access hvc_iucv_table[8], which is out of bounds (the array has 8 elements indexed 0-7).

A bug in the Linux kernel's USB Type-C PS883X driver causes an Oops when unbinding the device. The issue is due to missing i2c_set_clientdata() in the probe function, leading to a NULL pointer dereference in the remove function.

A vulnerability in the Linux kernel's SCSI sg driver allows a soft lockup by setting a negative value for the def_reserved_size parameter via sysfs. The issue stems from missing validation when the parameter is modified directly through /sys/module/sg/parameters/def_reserved_size.

In the Linux kernel, a vulnerability in the F2FS filesystem was found where f2fs_sbi_show() reads extension_list, extension_count, and hot_ext_count without holding sb_lock. Concurrent modification via sysfs can lead to inconsistent reads, potentially causing out-of-bounds access or displaying stale data.

In the Linux kernel, the EIP93 crypto driver's eip93_hmac_setkey() function allocated a temporary ahash transform using the CRYPTO_ALG_ASYNC mask, which excludes async algorithms. Since EIP93 algorithms are inherently async, the lookup always failed, leaving digest fields uninitialized and causing a NULL pointer dereference and kernel panic.