CVE Vulnerability Catalog

The Linux kernel has a NULL pointer dereference vulnerability in the SCTP implementation when completing a stream reconfiguration request that has not yet been transmitted. When a request is already published in asoc->strreset_chunk but has no assigned transport (chunk->transport == NULL), stopping the reconf timer dereferences NULL and panics the kernel. It can be triggered locally by an unprivileged process or remotely via a crafted RECONF packet.

In the Linux kernel, a cached SCTP RECONF chunk may contain more than one request parameter. A duplicate response can process the same ADD_OUT request again, rolling back the outcnt counter twice and potentially underflowing it. The fix tracks outstanding request types as bits and ignores later responses.

In the Linux kernel, the charger-manager (power: supply) driver has a use-after-free vulnerability. Regulators are freed (regulator_put) before sysfs entries are unregistered (power_supply_unregister), and sysfs entries are registered before regulators are acquired, allowing a race condition and access to freed handles.

In the Linux kernel, in the power: supply: cros_usbpd-charger driver cros_usbpd_charger_probe() reads two port counts from the EC and uses num_charger_ports as the loop bound when populating the fixed-size ports[] array of 8 entries. Without validation against EC_USB_PD_MAX_PORTS, a malfunctioning or malicious EC can report up to 255, causing a slab out-of-bounds write. The fix rejects a port count larger than the array can hold.

In the Linux kernel, in the power: supply: cros_usbpd-charger driver the probe iterates based on the raw charger port count returned by the embedded controller. The only check is against the number of USB PD ports also defined by the EC, so a malicious EC could return an inaccurate count (up to 255), causing an out-of-bounds write and memory corruption. The fix limits port counts to EC_USB_PD_MAX_PORTS.

In the Linux kernel, in the power: supply: lp8727 driver lp8727_release_irq() cancels pchg->work before freeing the IRQ, so an IRQ delivered in between can re-arm the work through the threaded handler. After .remove returns, the devm layer frees pchg while lp8727_delayed_func() may still run and dereference it. The fix frees the IRQ first, then cancels the work.

In the Linux kernel, the qcom_battmgr driver's qcom_battmgr_sc8280xp_strcpy() copies firmware strings without guaranteeing a terminator when the firmware does not use Pascal-style strings. Fields model_number, serial_number, and oem_info may lack a null terminator, causing out-of-bounds reads when printed to userspace.

In the Linux kernel, the rt9455 power supply driver contains a use-after-free bug. During driver removal (rt9455_remove), delayed works are cancelled in the wrong order — batt_presence_work can queue max_charging_time_work after it has been cancelled, causing a dereference of the freed rt9455_info structure. The issue also occurs in the probe error path when rt9455_hw_init() fails after the IRQ has been requested.

In the Linux kernel on s390, the MVIY_PERCPU() macro generates an assembler macro invocation with whitespace-separated quoted arguments, which older binutils (before 2.39) misparse, skipping the mviy instruction. As a result, the interrupted per-CPU sequence is not marked in lowcore and the exception return path cannot repair the per-CPU address register after migration.

In the Linux kernel, the s390/dasd driver's dasd_default_erp_postaction() copies timing and device state from the finished ERP request back to the original request but drops proc_bytes. A partially completed request (an ESE read of a not-yet-allocated track returns fewer bytes than requested) that is then recovered through the ERP chain loses its partial-completion length, so __dasd_cleanup_cqr() sees proc_bytes == 0 and completes the whole request instead of requeueing the remainder, silently returning zeroed data for the part that was never read.

In the Linux kernel, the iommu/msm driver's msm_iommu_probe() adds its devm-managed IOMMU object to qcom_iommu_devices before adding the IOMMU sysfs device and registering it with the IOMMU core. If iommu_device_sysfs_add() or iommu_device_register() fails, the object remains on qcom_iommu_devices while the driver core releases the devm allocation, leaving a dangling list entry that later list walks may dereference.

In the Linux kernel, the iommu/tegra241-cmdqv driver's tegra241_vintf_init_vsid() programs the guest-provided vSID into SID_MATCH, whose VIRT_SID field spans bits [20:1] with bit 0 as the match-enable flag, so the hardware matches only a 20-bit Stream ID. The bound check rejects only virt_sid > UINT_MAX, admitting a value far wider than the field; the write "virt_sid << 1 | 0x1" then drops every bit above 20, so a virt_sid of 0x80000000 lands as SID_MATCH = 0x1, a valid match on vSID 0, aliasing the wrong Stream ID. Because vdev->virt_id is guest-controlled, a VMM can trigger it.

In the Linux kernel, the IOMMUFD selftest TRIGGER_IOPF borrows an attach handle from group->pasid_array without synchronizing against PASID detach, so a concurrent iommu_report_device_fault() can dereference a freed handle, causing a UAF. The fix adds an iopf_rwsem in mock_dev for synchronization.

In the Linux kernel, isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() use the user-provided level as an index into perf_levels[] without validation, allowing out-of-bounds reads. The fix adds bounds checks and rejects disabled SST-PP levels.

In the Linux kernel, isst_if_clos_assoc() validates socket_id with '>' instead of '>=', allowing indexing past the sst_inst[] array; additionally, a missing NULL check for unbound packages leads to a NULL dereference. The fix rejects socket_id >= topology_max_packages() and NULL sst_inst.

In the Linux kernel, the mmc via-sdmmc driver does not cancel carddet_work on device removal; already queued work can run after the host is freed, causing a use-after-free. The fix cancels carddet_work after freeing the IRQ and before cancelling finish_bh_work.

In the Linux kernel, the mmc via-sdmmc driver registers and enables the card-detect interrupt before mmc_add_host(); if mmc_add_host() fails, the interrupt stays registered and runs against the freed host, causing a use-after-free. The fix adds a probe-error path that disables and frees the interrupt and cancels carddet_work.

In the Linux kernel, the panasonic-laptop driver has an out-of-bounds write past the pcc->sinf[] array. The function acpi_pcc_retrieve_biosdata() writes a sentinel value at index equal to the SINF package count, which when num_sifr equals that count results in a one-element overflow (a silent 4-byte heap overflow). This occurs on hardware where HKEY.SQTY returns 37 and HKEY.SINF()'s package has 38 elements.

In the Linux kernel, the platform/chrome sensorhub driver did not validate the EC-reported sensor number (in->sensor_num) in cros_ec_sensorhub_ring_handler(). A value equal to or greater than sensor_num caused an out-of-bounds read and write of the batch_state[] array.

In the Linux kernel, the platform/x86/amd/pmc driver's amd_stb_s2d_init() discarded the return values of several S2D SMU commands and the S2D_PHYS_ADDR_LOW/HIGH values. On failure the physical address was left uninitialized and passed to devm_ioremap(), potentially mapping physical address 0.