CVE Vulnerability Catalog

In the Linux kernel, a vulnerability was found in the mt76 driver for mt7925 chipsets, where a NULL pointer dereference could occur in the mt7925_tx_check_aggr() function. The missing NULL check for 'sta' before dereferencing it may lead to a system crash.

In the mt76 Wi-Fi driver for MT7921/MT7922 chipsets, configuring a station with an AID above 20 causes a firmware crash. The issue occurs in AP mode and can be triggered by a modified hostapd version.

A NULL pointer dereference vulnerability was found in the Linux kernel's AMD GPU driver (drm/amd/ras) in the ras_core_ras_interrupt_detected() function. The issue occurs when ras_core is NULL and the code attempts to access the dev field in the error path.

In the Linux kernel, a vulnerability was found in the AMD GPU driver (drm/amd/ras) where the ras_core_get_utc_second_timestamp() function can cause a NULL pointer dereference. The issue occurs when the ras_core pointer is NULL and the function tries to access the dev field in an error message. The patch adds an early NULL check and returns 0 if the pointer is invalid.

In the Linux kernel, a vulnerability was found in the padata mechanism where the CPU offline callback was placed in a section that does not allow errors. It has been moved to the ONLINE section where errors are permitted to prevent warnings and potential issues.

In the Linux kernel drm/amd/display driver, a NULL pointer dereference vulnerability was found in dc_dmub_srv_log_diagnostic_data() and dc_dmub_srv_enable_dpia_trace(). Incorrect condition ordering can cause a NULL dereference during error logging, leading to a system crash.

In the Linux kernel, a vulnerability was found in the IOMMU driver for RISC-V architecture on the invalidation path. When gather->end reaches ULONG_MAX, an overflow causes an infinite loop. Additionally, incorrect length calculation (moving +1 to the other side of <) may lead to operational errors.

In the Linux kernel, a vulnerability was found in the FUSE filesystem where fuse_dentry_revalidate() may be called with a dentry having uninitialized ->d_time field. The issue was discovered by KMSAN and could lead to reading uninitialized memory.

In the Linux kernel, a vulnerability in the SoC Tegra CBB subsystem uses an incorrect base address when looking up the target timeout for an error occurring on a different fabric, causing a kernel page fault and potential system crash.

In the Linux kernel, an off-by-one vulnerability was found in the OCFS2 filesystem's dlm_match_regions() function. The local-vs-remote region comparison loop uses '<=' instead of '<', causing it to read one entry past the valid range of the qr_regions array. Other loops in the same function correctly use '<'.

In the Linux kernel, the max77705 driver leaks memory by not destroying the workqueue on remove() and has a flawed resource release order. Interrupt handlers registered via devm may schedule work on a freed workqueue, leading to use-after-free.

In the Linux kernel pinctrl subsystem (pinconf-generic), a vulnerability was found due to incomplete validation of the 'pinmux' property in the device tree. The pinconf_generic_parse_dt_pinmux() function assumes the 'pinmux' property is not empty when present, which can cause the allocator to return a special value instead of NULL, leading to a crash when accessing invalid memory.

In the Linux kernel's hvc_iucv driver, an off-by-one vulnerability was found in the number of supported devices. When the hvc_iucv_devices counter reaches 8, the code may access hvc_iucv_table[8], which is out of bounds (the array has 8 elements indexed 0-7).

A bug in the Linux kernel's USB Type-C PS883X driver causes an Oops when unbinding the device. The issue is due to missing i2c_set_clientdata() in the probe function, leading to a NULL pointer dereference in the remove function.

A vulnerability in the Linux kernel's SCSI sg driver allows a soft lockup by setting a negative value for the def_reserved_size parameter via sysfs. The issue stems from missing validation when the parameter is modified directly through /sys/module/sg/parameters/def_reserved_size.

In the Linux kernel, a vulnerability in the F2FS filesystem was found where f2fs_sbi_show() reads extension_list, extension_count, and hot_ext_count without holding sb_lock. Concurrent modification via sysfs can lead to inconsistent reads, potentially causing out-of-bounds access or displaying stale data.

In the Linux kernel, the EIP93 crypto driver's eip93_hmac_setkey() function allocated a temporary ahash transform using the CRYPTO_ALG_ASYNC mask, which excludes async algorithms. Since EIP93 algorithms are inherently async, the lookup always failed, leaving digest fields uninitialized and causing a NULL pointer dereference and kernel panic.

In the Linux kernel, a vulnerability was found in the reset driver for Amlogic T7 SoCs. Missing reset operations cause a null pointer dereference in the kernel, potentially leading to system crashes. Currently, reset is not used on this SoC.

A use-after-free vulnerability was found in the Linux kernel's enetc network driver, related to DMA buffer handling in the NTMP mechanism. The bug can lead to silent memory corruption when a freed DMA buffer is reused by hardware.

In the Linux kernel, a vulnerability was found in the airoha network driver. Early initialization of the ndesc variable in airoha_qdma_init_tx_queue() causes a NULL pointer dereference in airoha_qdma_cleanup_tx_queue() when queue entry list allocation fails.