CVE Vulnerability Catalog

In the Linux kernel, the iio: pressure: bmp280 driver has an out-of-bounds access in sampling frequency lookup. bmp280_write_sampling_frequency() indexes the flattened table as a two-dimensional array and uses num_sampling_freq_avail as the number of rows, leading to incorrect indexing.

In the Linux kernel, the iio: pressure: rohm-bm1390 driver ignores the cached error value and unconditionally returns 0. After stopping the measurement, it should return the cached 'ret' value so the user knows the read failed and the data is garbage.

In the Linux kernel, the iio: proximity: aw96103 driver's firmware parser reads a length from the binary header and uses it to walk six-byte register/value entries. A truncated firmware image can make the parser read beyond the copied firmware buffer, and a value smaller than the four-byte count field underflows, producing a very large length.

In the Linux kernel, in the iio: proximity: pulsedlight driver, when pm_runtime_set_active() fails in probe(), execution jumps to error_unreg_buffer which only calls iio_triggered_buffer_cleanup() and does not unregister the already-registered iio device. As a result, devm frees indio_dev but the iio core still has it registered, leaving sysfs/chardev nodes pointing at freed memory.

In the Linux kernel, iio_trigger_notify_done_atomic() defers ->reenable() into trig->reenable_work on the system workqueue, and the worker dereferences the owning trigger via container_of(). Since nothing cancels this work before iio_trig_release() frees the trigger, a worker armed by the last in-flight IRQ can outlive the free and touch freed memory.

In the Linux kernel, perf events with exclude_kernel=1 can be opened without kernel perf access, but exclude_kernel does not suppress text-poke sideband records. Every PERF_RECORD_TEXT_POKE is marked PERF_RECORD_MISC_KERNEL and contains a raw kernel instruction address, allowing an unprivileged task to reveal the runtime kernel text base despite KASLR.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority and contains no vulnerability description.

In the Linux kernel, in KVM: s390, under some circumstances the page of nested guest memory being shadowed may not be present at all in the parent guest gmap. dat_entry_walk() will not find any leaf entry and return -ENOENT, which is erroneously propagated all the way to userspace.

In the Linux kernel, in KVM: s390, kvm_s390_set_irq_state() performs the Store status operation without the required kvm->srcu or slots lock, unlike kvm_s390_inject_vcpu(). This missing synchronization can lead to concurrency issues.

In the Linux kernel, in KVM: s390, dat_cond_set_storage_key() may receive NULL as oldkey from some callers. Calling page_cond_set_storage_key() will then dereference that NULL pointer.

In the Linux kernel, in KVM: s390 there is a race window between dat_entry_walk() and large_crste_to_phys() in dat_cond_set_storage_key() and dat_set_storage_key(): a large page could be split concurrently and large_crste_to_phys() might be called with a crste that does not designate a large page, leading to crashes. Similar issues were present in dat_get_storage_key() and dat_reset_reference_bit().

In the Linux kernel, in KVM: s390, _destroy_pages_crste() reads the crste without protection against multiple pointer dereferences, which can lead to a race.

In the Linux kernel, in s390/uv, when the system has more than 85 secrets, the uv_secret_list struct array only holds up to 85 items per page, resulting in an out-of-bounds read in find_secret_in_page if the targeted secret is in the next page or not stored at all.

In the Linux kernel, btf_struct_walk() contains a divide-by-zero bug. When an access goes past a struct whose last member is a flexible array and the element type has zero size (e.g. an empty struct), a divide-by-zero occurs at BPF program load time. This requires a PTR_TO_BTF_ID that is not MEM_ALLOC, such as a plain read of a local kptr stashed in a map from a sleepable program.

A bug in the Linux kernel's inet_csk_listen_stop() function causes cond_resched() to be called under BPF context (inside rcu_read_lock). When bpf_sock_destroy() destroys a listener socket that still has children in its accept queue, it triggers an invalid sleep and a kernel warning. The listener path was missed by the earlier has_current_bpf_ctx() guard.

In the Linux kernel, the HID winwing driver has a use-after-free in force feedback teardown. winwing_init_ff() passes driver private data allocated with devm_kzalloc() as the effect context to input_ff_create_memless(), and the force feedback core frees that pointer with kfree(), which is an invalid free leading to a double free and slab corruption. This triggers on unbind, rmmod, hot-unplug, and system suspend.

A vulnerability was fixed in the Linux kernel's __htab_map_lookup_and_delete_batch() function for BPF hash maps. The function lacked a rescheduling point, so a single BPF_MAP_LOOKUP_BATCH call could walk the entire map without yielding the CPU, causing soft lockups and holding a CPU for over 77 seconds on large maps (e.g., 16 million buckets).

A vulnerability was fixed in the Linux kernel in BPF sock_ops programs that read the rtt_min field. On the tcp_conn_request() path, sock_ops->sk points to a request_sock (non-full socket), but the code casts it to a tcp_sock and reads rtt_min past the end of the structure, exposing adjacent kernel memory.

A use-after-free (UAF) vulnerability exists in the Linux kernel's BPF memory allocator (alloc_bulk). It is caused by a lack of synchronization between concurrent consumption of ttrace lists (waiting_for_gp_ttrace and free_by_rcu_ttrace) and RCU Tasks Trace callbacks freeing memory. The fix introduces a raw spinlock to synchronize access to these lists.

A flaw was found in the Linux kernel on arm64 in BPF exception callback handling. The callback prologue failed to set the frame pointer (BPF_REG_FP), so register x25 retained the value from the subprogram that invoked bpf_throw(). As a result, a helper could receive a local variable address pointing into a dead stack frame and overwrite its own return address, causing a kernel panic.