CVE Vulnerability Catalog

In the XFS filesystem in the Linux kernel, the xfs_exchmaps_estimate_overhead function adds bmbt and rmapbt overhead to a local resblks variable, but the final UINT_MAX check still tests req->resblks, the value before overhead was added. The check should apply to the computed value that is later used.

In the XFS filesystem in the Linux kernel, the xfs_dqinode_metadir_create() function does not free allocated transaction and update state when xfs_metadir_create() fails, causing a memory leak. The fix routes the error path through xfs_metadir_cancel() and releases the inode reference.

In the Linux kernel BPF mechanism for ARRAY_OF_MAPS with the BPF_F_INNER_MAP flag, the verifier incorrectly elides lookup result nullness for constant keys, using the template max_entries instead of the concrete inner map. The fix does not elide nullness for maps marked with BPF_F_INNER_MAP.

In the Linux kernel's USB Kalmia network driver, there is an out-of-bounds read vulnerability. The kalmia_rx_fixup() function incorrectly calculates the USB packet length, which can lead to reading beyond the allocated 14000-byte buffer.

In the Linux kernel's cdnsp USB driver, there is a memory leak during stream allocation. The cdnsp_alloc_stream_info() function does not free the stream context array (stream_ctx_array) if a stream ring allocation fails.

In the Linux kernel's dwc3 USB driver, there is a bug in the dwc3_readl() and dwc3_writel() calls within dwc3_ulpi_setup(). These functions are called with an incorrect argument (dwc3->regs instead of the dwc3 structure), which can lead to memory access errors.

In the Linux kernel's USB gadget composite driver, there is an out-of-bounds read vulnerability in the USB_DT_OTG handler. The list_first_entry() function never returns NULL, so the if (!config) check is dead, leading to reading from an invalid address when the configuration list is empty.

In the Linux kernel's USB gadget f_printer driver, there is a reference leak. The printer_open() function increments the reference count (kref) even on -EBUSY error when the device is already open, but VFS does not call release() for a failed open.

In the Linux kernel, the USB misc uss720 driver has a vulnerability where the parport is not unregistered on probe failure. uss720_probe() registers a parport before reading the 1284 register, and if get_1284_register() fails, the registration is not undone, leading to resource leaks and potential use of a freed pointer.

In the Linux kernel, the USB mtu3 driver has a vulnerability where DMA mapping is not unmapped on queue failure. mtu3_gadget_queue() maps the request before checking if the QMU GPD ring can accept a transfer, and if mtu3_prepare_transfer() fails, the request is returned with -EAGAIN without unmapping the DMA, leaving the DMA mapping active.

In the Linux kernel, the USB serial keyspan_pda driver has an information leak vulnerability. The write() callback should return the number of accepted characters, but the keyspan_pda implementation returns the number of submitted characters if the write urb is not in use. If this number is larger than the number of passed characters, the line discipline continues writing data from beyond the tty write buffer, leading to information leak.

In the Linux kernel, the USB serial digi_acceleport driver has a vulnerability where reception is broken after throttle. If the port is closed while throttled, the read urb is never resubmitted and the port will not receive further data until the device is reconnected. The fix clears throttle flags and submits the urb when opening the port.

In the Linux kernel, the USB serial digi_acceleport driver has a hard lockup vulnerability on disconnect. If submitting the OOB write urb fails persistently (e.g., during disconnect), the driver loops indefinitely with interrupts disabled. The fix adds error checking for urb submission when sending OOB commands.

A memory leak was found in the Linux kernel's USB ULPI driver on registration failure. The allocated device name is never freed, causing a memory leak.

A NULL pointer dereference in the Linux kernel's usbip vudc driver in vep_dequeue(). The vrequest->udc field is uninitialized, causing a crash when cancelling FunctionFS AIO requests.

A DMA fence object leak in the Linux kernel's USB gadget f_fs driver. The double reference to dma_fence is not properly managed, causing memory leak.

In the Linux kernel's USB gadget f_fs driver, the epfile->in field is initialized too late, causing incorrect DMA direction for early ioctl calls.

Missing condition to skip sync_blockdev() on surprise removal in the Linux kernel's bdev_mark_dead() function. This can cause a hang waiting for writeback.

NULL pointer dereference in the Linux kernel's mt7921 and mt7925 WiFi drivers in CSA beacon handlers. After station disconnection, the new_ctx pointer can be NULL.

In the Linux kernel, the NVMe over RDMA target subsystem has a reference leak in the queue connect path. The function nvmet_rdma_queue_connect() does not release the ndev reference when the host queue backlog is exceeded.