CVE Vulnerability Catalog

In the Linux kernel, the watchdog: rzv2h driver's clk_get_rate() can return 0, leading to a division by zero. The vulnerability causes a kernel panic.

In the Linux kernel, the wifi: rsi driver's rsi_hal_load_key() performs a memset with an incorrect offset when a key is removed (data == NULL). Since set_key is a struct rsi_set_key pointer, the subscript is scaled by sizeof(struct rsi_set_key) (160 bytes), so the memset writes 144 zero bytes about 2.4 KB past the end of the skb data buffer, corrupting unrelated heap objects.

In the Linux kernel, ieee80211_set_bitrate_mask() lacked a check for the IEEE80211_SDATA_IN_DRIVER flag before calling the driver. When the interface was running but not yet added to the driver (e.g., during bringup or teardown), an ioctl SIOCSIWRATE call triggered a WARN in driver-ops.h. The fix adds an IN_DRIVER check and returns -ENETDOWN.

In the Linux kernel SMB client, parse_posix_sids() computes sidsbuf_end using the server-supplied out_len without validating it against the actual received iov length. A malicious server can provide an inflated out_len, enabling out-of-bounds reads into adjacent kernel memory.

In the Linux kernel drm/virtio driver, virtio_gpu_user_framebuffer_create() returns NULL instead of an ERR_PTR() error pointer. This leads to a NULL pointer dereference in drm_mode_addfb2().

In the Linux kernel s390 boot code, append_ipl_block_parm() may pass a zero size to the IPL parameter conversion helpers when the command line occupies the entire COMMAND_LINE_SIZE buffer. This results in a write outside the command line buffer.

In the Linux kernel, a bug was fixed in the icmp_send tracepoint where TP_fast_assign() unconditionally called udp_hdr(skb) before checking whether the packet is UDP. This triggered a DEBUG_NET_WARN_ON_ONCE warning when accessing an uninitialized transport header (transport_header = ~0U), as __icmp_send() can be invoked from paths such as link failures, ARP errors, forwarding, or AF_PACKET.

A vulnerability in the Linux kernel's iptunnel handling causes a stale transport_header offset during tunnel decapsulation of GSO packets. This leads to a negative offset and subsequent KASAN fault or page fault in qdisc_pkt_len_segs_init(). The issue occurs when encapsulated GSO packets are forwarded at L2 by a bridge or HSR instead of being delivered to the local IP stack.

In the Linux kernel s390 kdump handling, set_os_info_reipl_block() dereferences reipl_block_actual, which remains NULL for IPL types without a re-IPL parameter block (e.g., HMC FTP boot, QEMU direct kernel boot). This can lead to a NULL pointer dereference.

In the Linux kernel s390 stand-alone dump handling, dump_reipl_run() unconditionally dereferences reipl_block_actual, which remains NULL for IPL types without a re-IPL parameter block. This can lead to a NULL pointer dereference and put the dumper into disabled wait.

A bug was fixed in the Linux kernel lockdep mechanism that caused a DEBUG_LOCKS_WARN_ON(1) warning in hlock_class() due to an invalid class_idx. The issue arose because class_cache[] entries in lockdep_map structures could still point to zapped lock classes, leading to incorrect matching or warnings. The fix adds validation of class_cache entries and safely refreshes them.

In the Linux kernel platform/x86 x86-android-tablets module, gpio_secondary_fwnode_init() drops the device reference at the end of each iteration, while devm_add_action_or_reset() saves the pointer without incrementing its reference count. This can lead to a use-after-free during driver teardown.

In the Linux kernel on PowerPC, arch_exit_to_user_mode_prepare() restored user memory access permissions (KUAP) too early, before platform-specific exit routines completed. This caused the kernel to run with user memory access unblocked, triggering a warning in interrupt_exit_user_prepare() when CONFIG_PPC_KUAP_DEBUG was enabled. The issue was fixed by removing the KUAP restore from that hook.

In the Linux kernel on PowerPC, __replay_soft_interrupts() overwrote irq_soft_mask with IRQS_DISABLED (0x1) when replaying a pending interrupt, stripping the IRQS_PMI_DISABLED (0x2) bit. This triggered a WARN_ON in arch/powerpc/kernel/irq_64.c:75, observed early in boot on a POWER10 pseries guest. The fix replaces local_irq_disable() with hard_irq_disable().

In the Linux kernel, recv(0, MSG_PEEK) in blocking mode triggered a busy-wait in unix_stream_read_generic() when the last skb in the queue was a MSG_OOB skb. This affects AF_UNIX sockets. The fix makes the function return 0 immediately, matching TCP behavior.

In the Linux kernel IPv4 handling, a UDP length overflow occurs with PMTU discovery and a very large interface MTU. When IP_MTU_DISCOVER is set to IP_PMTUDISC_PROBE and a packet is sent over a netdev with MTU larger than IP_MAX_MTU + 20, the UDP length can exceed the 16-bit field and trigger a WARN in udp_set_len_short. This affects the IPv4 networking stack in the kernel.

In the Linux kernel Bluetooth driver btintel_pcie, there is an off-by-one bounds check error for tx_handle. Valid indices are 0..txq->count-1, but the guard in btintel_pcie_msix_tx_handle() only checked '> txq->count', allowing an index equal to txq->count. The fix changes the guard to '>= txq->count'.

In the Linux kernel drm/xe driver, a race condition occurs during VM teardown when the runtime PM reference is dropped asynchronously while stale page faults are still queued. The page-fault worker may call guc_ct_send_locked() on an already-suspended device, tripping an assertion and kernel warning. The fix holds a runtime PM reference across the entire pagefault queue worker.

In the Linux kernel x86/amd_node code, a divide-by-zero occurs on virtualized systems. The number of nodes is unrelated to the number of roots, and on Xen PVH dom0 roots_per_node can be 0, causing a crash in a modulo operation. The fix sets roots_per_node to 1 in this case and prints a firmware bug warning for non-virtualized systems.

In the Linux kernel drm/amdgpu driver, during resume from GPU reset, the gfx idle work may invoke switch_power_profile before the reset completes. This causes register access without releasing the GPU reset semaphore, leading to an assertion error and stack trace. The fix skips switch_power_profile during GPU reset.