CVE Vulnerability Catalog

In the Linux kernel, the drm/radeon driver's radeon_align_pitch() had a signed integer overflow during alignment round-up and the 'aligned * cpp' calculation. This could lead to returning an invalid pitch or creating a zero-sized dumb buffer.

In the Linux kernel, the wifi: rtw89 driver's AER handlers (io_error_detected and io_resume) retrieved the pointer stored by pci_set_drvdata() as a net_device, while it was actually an ieee80211_hw pointer. This caused operations on wrong offsets of the structure.

In the Linux kernel, the wifi: rtw88 driver's AER handlers (io_error_detected and io_resume) retrieved the pointer stored by pci_set_drvdata() as a net_device, while it was actually an ieee80211_hw pointer. This caused operations on wrong offsets of the structure.

A vulnerability in the Linux kernel's rtw89 WiFi driver causes an infinite loop during 6 GHz band scanning. A data type error for the scan index leads to CPU soft lockup and system panic.

In the Linux kernel, the rtw88 driver (PCIe) lacks validation of the data size received from firmware, which can lead to an out-of-bounds read from the DMA buffer. An attacker could exploit this to disclose kernel memory.

In the Linux kernel, the rtw89 driver lacks a bounds check on the mac_id field from firmware, which can lead to an out-of-bounds array access. An attacker could exploit this to leak kernel memory.

In the Linux kernel, the ath9k driver lacks a bounds check on the qid field from firmware, which can lead to an out-of-bounds array access. An attacker could exploit this to leak kernel memory.

A vulnerability in the Linux kernel's ath11k Wi-Fi driver can cause a kernel crash during reboot if it overlaps with firmware crash recovery (SSR). The issue is a NULL pointer dereference in the MHI teardown path while freeing DMA contexts. It affects PCI/MHI-based devices only.

In the Linux kernel, the OPP subsystem has a race between adding and looking up entries, which can lead to refcount corruption and premature free. An attacker could exploit this to crash the system.

In the Linux kernel, snp_filter_reserved_mem_regions() has an off-by-one error that can lead to a heap buffer overflow. An attacker could exploit this to execute code in the kernel.

In the Linux kernel, __snp_alloc_firmware_pages() lacks proper error checking for page allocation, which can lead to dereferencing an invalid pointer. An attacker could exploit this to crash the system.

In the Linux kernel, in the mlx5_ib driver, mlx5_ib_alloc_transport_domain() leaked the allocated transport domain when mlx5_ib_enable_lb() returned an error. The fix adds deallocation of TD on error, explicit return 0 in the no-loopback-capability branch, and moves lb mutex initialization to mlx5_ib_stage_init_init().

In the Linux kernel, in the RDMA/mlx5 driver, mlx5r_umr_update_xlt() leaked the XLT buffer and DMA mapping when mlx5_odp_populate_xlt() returned an error, and also left the emergency mutex locked. The fix breaks out of the loop to execute the common cleanup path.

In the Linux kernel, the irdma_copy_user_pgaddrs function has an out-of-bounds write vulnerability. The issue occurs when palloc->total_cnt is zero, causing the loop to potentially go beyond the fixed size of the pgaddrmem array (4 elements) in the lvl==0 case. This can lead to buffer overflow.

A use-after-free (UAF) vulnerability was found in the Linux kernel's ALSA OSS sequencer subsystem. The issue occurs when SysEx data is processed and the sequencer port is closed before the event is dispatched, leading to use of freed memory. The patch extends the refcounting mechanism to protect resources until the event is dispatched.

In the Linux kernel's ALSA SEQ MIDI subsystem, a use-after-free and NULL pointer dereference vulnerability was found. The issue stems from missing synchronization between the event processing path and MIDI output teardown, which can lead to system crashes.

In the Linux kernel, the nvmet-tcp module does not check the return value of nvmet_tcp_set_queue_sock(). If it fails, socket callbacks are not properly set, leading to queue and socket leakage.

In the Linux kernel, the nvme-pci driver has an out-of-bounds access in nvme_setup_descriptor_pools. On non-NUMA kernels, hctx->numa_node is -1, but the parameter is declared as 'unsigned', causing the index to become UINT_MAX and walk off the array, leading to a page fault.

In the Linux kernel, the gpu: host1x driver has been fixed to correctly check the return value of iommu_map_sgtable(). The function now returns ssize_t with negative values on error, not size_t with zero. Additionally, pin_job() was incorrectly assigning to 'int', which could cause overflows into negative values.

In the Linux kernel, the RDMA/rxe driver has been fixed for a TOCTOU heap overflow in get_srq_wqe(). The function reads num_sge from the shared receive queue buffer mapped into userspace, validates it, but then re-reads the same field to calculate memcpy size, allowing a concurrent thread to modify it and cause a heap buffer overflow.