CVE Vulnerability Catalog

In the GPIO EIC (External Interrupt Controller) driver for Spreadtrum SoCs, a regular spinlock (spinlock_t) is used in the irq_startup path. On PREEMPT_RT systems, spinlock_t becomes a sleeping lock, causing a 'sleeping function called from invalid context' error.

In the Linux kernel, the GPIO SCH driver has a locking issue in the IRQ startup path. The sch_irq_unmask() function uses a regular spin_lock, which on PREEMPT_RT systems becomes a sleeping lock, causing a bug when called from a non-sleepable context. The fix replaces the lock with raw_spinlock_t, suitable for IRQ context.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the HID logitech-dj driver during DJ_SHORT report validation. The issue occurs when a crafted HID descriptor contains only padding output items, leaving maxfield as zero, and the code dereferences field[0] in the error path.

In the Linux kernel, the io_uring subsystem has a file reference leak in the NOP operation. When a NOP request is submitted with the IOSQE_FIXED_FILE flag but without IORING_NOP_FIXED_FILE, the file is acquired via fget() and never released, causing a memory leak. The fix decides file acquisition based on the REQ_F_FIXED_FILE flag, as in other operations.

In the Linux kernel, the io_uring/io-wq subsystem has an issue with handling the exit flag (IO_WQ_BIT_EXIT) for linked work items. Despite a previous fix, the exit flag was checked only once before processing an entire chain of linked tasks, allowing work to continue after exit began. The fix moves the check inside the loop, covering all linked items.

In the Linux kernel, the shrinker mechanism has a bug where RCU lock is held while calling the ->count_objects() callback in shrinker_debugfs_count_show(). The zswap_shrinker_count() function may sleep via css_rstat_flush(), which is not allowed in an RCU critical section. The fix removes rcu_read_lock()/rcu_read_unlock(), as they are unnecessary.

In the Linux kernel, the shrinker debugfs mechanism has a NULL pointer dereference bug. The shrinker_debugfs_add() function creates "count" and "scan" debugfs files for every shrinker, assuming each implements both count_objects() and scan_objects(). However, some shrinkers (e.g., xen-backend) only set count_objects(), leaving scan_objects() as NULL, causing a kernel panic when writing to the "scan" file.

A NULL pointer dereference vulnerability in the Linux kernel's lookup_swap_cgroup_id() function on swapless hosts. The function fails to verify that the swap type is registered, causing a system crash when accessing a corrupted PTE entry.

In the Linux kernel, the swap_reclaim_full_clusters() function lacks a cond_resched() call, which can lead to a softlockup on large systems with many CPUs and a large swap device. During heavy reclaim of full swap clusters, the loop may run too long without yielding the CPU, causing a softlockup.

In the Linux kernel Bluetooth btmtksdio driver, there is an infinite loop in the btmtksdio_txrx_work() function. The bug is due to incorrect use of time_is_before_jiffies() in the loop condition. After the 5-second timeout expires, the condition becomes always true, causing an infinite loop and locking the SDIO host.

In the Linux kernel Bluetooth subsystem, a null pointer dereference was found in hci_abort_conn(). The issue occurs when hdev->sent_cmd is NULL while req_status is HCI_REQ_PEND, potentially causing a system crash.

In the Linux kernel Bluetooth ISO driver, iso_conn_big_sync() can cause a NULL pointer dereference because after releasing the socket lock, the connection may be torn down, and the function reads conn->hcon without re-checking conn validity.

In the firmware_loader subsystem, a device reference leak was found. The firmware_upload_register() function fails to release the device reference on error after initialization, causing a reference count imbalance.

In cpufreq, a race between suspend and CPU hotplug operations during system reboot was found. The cpufreq_suspend() function lacks synchronization with hotplug, which can lead to a null pointer dereference.

In procfs, several functions lack exec_update_lock protection for ptrace_may_access(). Functions do_task_stat(), proc_pid_wchan(), proc_map_files_lookup(), proc_map_files_readdir(), proc_ns_get_link(), and proc_ns_readlink() perform access checks without proper locking.

In POSIX CPU timers, a PID reference leak was found in do_cpu_nanosleep(). On error after timer creation, the function does not release the PID reference, causing a leak.

On s390 architecture, support for DCACHE_WORD_ACCESS was reverted due to exception handling issues with pages donated to the Ultravisor. The load_unaligned_zeropad() function can cause an infinite exception loop.

In HFS and HFSPlus filesystems in the Linux kernel, the hfs_bnode_read function can return early without writing to the output buffer, leaving it uninitialized. Callers like hfs_bnode_read_u16 use the result unconditionally, leading to KMSAN uninit-value reports.

In the Linux kernel's nilfs2 filesystem, a vulnerability was found due to missing validation of segment numbers before starting segment cleaning operations. Invalid user-supplied segment numbers cause thread blocking while printing warnings, leading to system hangs.

In the MediaTek JPEG driver (mtk-jpeg) in the Linux kernel, the mtk_jpeg_release function calls cancel_work_sync even for variants that do not use the workqueue, causing a WARN_ON warning. The fix limits the call to platforms with a defined workqueue callback.