CVE Vulnerability Catalog

In the Linux kernel, trf7970a_startup() powers up the NFC device before applying the optional RX gain reduction. If the register read or write fails, it returns without undoing that power-up, leaving unbalanced VIN references and enable GPIOs.

In the Linux kernel, the Data-In branch of iscsi_tcp_hdr_dissect() in libiscsi_tcp copies the PDU's data segment into the command's scatterlist without checking whether the command was a read. A malicious iSCSI target can answer a WRITE command's ITT with a Data-In frame and overwrite pages the initiator was about to send.

In the Linux kernel, during UFS error recovery, ufshcd_err_handling_prepare() quiesces the entire tagset, including the pseudo SCSI device's request queue used by internal commands. This causes a deadlock because internal commands (e.g. NOP OUT UPIU) cannot be dispatched on the quiesced queue.

In the Linux kernel, perf_pmu_sched_task() passes NULL as pmu_ctx to pmu->sched_task() because it returns early when cpuctx->task_ctx is set. This leads to a NULL pointer dereference in armv8pmu_sched_task() and a kernel oops.

In the Linux kernel on s390, ccw_device_get_util_str() can receive NULL from chpid_to_chp() when the channel path registry entry is removed while the subchannel's PMCW still references that CHPID. The missing NULL check leads to a NULL pointer dereference.

In the Linux kernel on s390, the cmf measurement block address is an absolute address, but the associated schib_config and schib fields are not defined as dma64_t, preventing automatic detection of incorrect assignments. The missing virt_to_dma64() translation causes firmware to use a wrong address when storing extended format channel measurement data.

In the Linux kernel on s390, zpci_report_status() accesses the device's driver without holding the device lock when pdev is non-NULL. The missing lock can lead to an inconsistent state relative to the recovery process.

In the Linux kernel, the s390/vfio-ap module has three related bugs in handling KVM interrupts and page resources when a queue is removed from the host's AP configuration while assigned to a mediated device (mdev). The unhandled AP_RESPONSE_Q_NOT_AVAIL response code in vfio_ap_mdev_reset_queue() and apq_status_check() causes a leak of the KVM GISC registration and the pinned guest page holding the notification indicator byte (NIB). Additionally, vfio_ap_free_aqic_resources() fails to clear saved_isc when kvm is NULL, potentially leading to a double-free.

In the Linux kernel, KVM SEV does not free the "have run CPUs" cpumask during VM destruction if the VM is no longer in SEV mode (e.g. after intra-host migration). This leads to a memory leak.

In the Linux kernel, KVM SEV did not manually perform cache maintenance on the source VM during intra-host migration. After the source VM was destroyed, stale data could remain in CPU caches because KVM's memory reclaim flows would not trigger cache maintenance.

In the Linux kernel, KVM for arm64 had kvm_pkvm_ioctl_allowed() issue a WARN when the ioctl number was not found in vm_ioctl_caps[]. An ioctl call with an unknown number from userspace would taint a pKVM host and panic it when panic_on_warn was enabled.

In the Linux kernel, KVM for arm64 had the consolidation of breakpoint and watchpoint register accessors switch DBGBXVR<n> from trap_bvr() to trap_dbg_wb_reg(). Because DBGBXVR<n> uses Op2 value 1, an AArch32 guest access hit KVM_BUG_ON() and marked the VM dead.

A spurious warning in the Linux kernel KVM on arm64 was fixed, triggered by a benign race during stage 2 page table teardown. The warning occurred when concurrent release of mmu_lock set mmu->pgt to NULL, causing -EINVAL and a WARN_ON. The fix makes stage2_apply_range() no longer treat concurrent PGT teardown as an error.

In the Linux kernel, the KVM arm64 module contains a null pointer dereference vulnerability caused by a race during nested guest teardown. Concurrent invalidation of the MMU range and freeing of the stage 2 page tables can cause kvm->arch.mmu.pgt to become NULL and then be dereferenced. The issue is resolved by checking that the pgt pointer is non-NULL before use.

In the Linux kernel, KVM for arm64 had fix_host_ownership() walk only the linear-map alias of each memblock region. The per-CPU hypervisor stack, mapped in the private VA range for its guard page, had no such alias and was not covered by that walk.

In the Linux kernel, RISC-V KVM does not serialize IMSIC attribute operations against vCPU migration. kvm_riscv_aia_imsic_rw_attr() can snapshot stale physical CPU and HGEI data before a concurrent vCPU migration, so a GET or SET attribute may access the new owner's interrupt file.

In the Linux kernel, a race condition exists in the RISC-V KVM component during VM teardown. The non-Sstc hrtimer callback clears next_set before its final uses of the vCPU, and if teardown observes next_set as false while the callback is still running, kvm_riscv_vcpu_timer_cancel() skips hrtimer_cancel() and the vCPU can be freed before the callback completes. This results in a use-after-free detected by KASAN.

In the Linux kernel sched_ext scheduler, the SCX_RQ_IN_WAKEUP flag is derived from merged enqueue flags, including flags stashed for remote activation. move_remote_task_to_local_dsq() sets this flag on the destination rq without a following task_woken_scx(), leaving a reenqueue request pending that can point into freed per-cpu memory after the scheduler is disabled.

In the Linux kernel Bluetooth hci_conn, CIS hold ownership on reuse is incorrect. hci_bind_cis() takes the hold only after configuring a CIS, so BT_CONNECTED and BT_BOUND paths return a bare lookup result, and hci_connect_cis() assumes hci_conn_link() always takes a new CIS hold, which is not true for an existing link.

In the Linux kernel Bluetooth hci_sock, is_filtered_packet() reads the event code from skb->data[0] without checking the skb is nonempty, and reads the command opcode at offsets 3 or 4 without verifying the event is long enough. A malformed event from a controller or vhci device can cause an out-of-bounds read.