CVE Vulnerability Catalog

In the Linux kernel, a memory leak was found in the iosm WWAN driver in the ipc_imem_init() function. Memory allocated in ipc_protocol_init() is not freed on error paths, potentially leading to resource exhaustion.

In the Linux kernel, a vulnerability was found in the Phonet/PEP subsystem where pep_do_rcv() calls sk_receive_skb() for a child socket without disabling bottom halves (BH). This causes a lock inconsistency (SOFTIRQ-ON-W vs IN-SOFTIRQ-W), potentially leading to a deadlock in the network receive path.

In the Linux kernel, a bug in cfg80211_merge_profile() in the cfg80211 subsystem causes loop variables not to advance when reassembling split Multi-BSSID non-transmitted BSS profiles. This results in repeated copying of the same data, potentially leading to excessive CPU usage.

In the Linux kernel tracing module, a vulnerability was found where map->ops->elt_free() is called even when map->ops->elt_alloc() failed. This can lead to incorrect memory deallocation or other errors.

In the Linux kernel, a PM reference leak was found in the Tegra I2C driver. The function fails to call pm_runtime_put() after a mutex lock failure, preventing the device from entering runtime suspend.

In the Linux kernel, the SPI QUP driver has an error pointer dereference after a DMA setup failure. The driver falls back to PIO mode but fails to clear DMA channel pointers, potentially causing a dereference of an error pointer or a double release on subsequent errors or driver unbind.

In the Linux kernel, a vulnerability was found in the ep93xx SPI driver. After a DMA setup failure during probe, the driver falls back to PIO mode but fails to clear DMA channel pointers, leading to an error pointer dereference on subsequent probe errors or driver unbind.

In the SPI driver for Spreadtrum (sprd) SoCs, an error pointer dereference occurs after a DMA setup failure. The driver falls back to PIO mode, but on late probe errors it may attempt to release an invalid DMA pointer or release a channel twice, leading to a crash.

In the Linux kernel, a vulnerability was found in the KHO (Kexec HandOver) mechanism. The kho_fill_kimage() function incorrectly added KHO metadata to crash kernel images, causing a page fault during memory initialization when the crash kernel tried to access KHO scratch areas outside its reserved region.

In the Linux kernel, a vulnerability was found in the arm_ffa driver where the driver registration function did not check if the FF-A ID table (id_table) was NULL. This missing validation could lead to a NULL pointer dereference during driver-to-device matching on the bus.

In the Linux kernel, the ARM Integrator platform driver has an initialization bug. The `intcp_init_early` function calls `syscon_regmap_lookup_by_compatible`, which allocates memory before the memory management subsystem is initialized, causing a crash (NULL pointer dereference) or -ENOMEM error. The fix moves the early initialization code to the standard machine initialization.

In the Linux kernel, a bug was found in the Btrfs filesystem tracepoint for btrfs_sync_file(). Calling dput() in an atomic context causes a sleep, leading to a kernel splat. The issue occurs when tracing is enabled during write operations on Btrfs.

In the Linux kernel, a vulnerability in the kprobes test causes all tests to fail and the kernel to crash when run twice, due to leftover data in static kprobe variables not being cleared between test runs.

In the TI ICSSM PRUETH network driver in the Linux kernel, a reference leak of the eth_ports_node device tree node occurs in the probe function. The leak happens on the error path after a failed of_property_read_u32() call, where the node is not released before returning.

A vulnerability was found in the Linux kernel's netfs subsystem, where the zero point update in netfs_release_folio() incorrectly used local i_size instead of remote_i_size when the local file size exceeds the server's EOF. This caused read operations to fail with short reads when accessing beyond the actual server file size.

A vulnerability was found in the Linux kernel's netfs mechanism regarding incorrect partial invalidation of a streaming-write folio. The netfs_invalidate_folio() function incorrectly modifies the dirty region by moving it forward by the start instead of the end of the invalidation region, leading to improper tracking of dirty data.

In the Linux kernel, a vulnerability in the netfs and afs subsystems causes write skipping in writepages functions for directories and links. The issue occurs when a write is skipped due to lock contention and WB_SYNC_NONE mode, potentially leading to data inconsistency.

In the Linux kernel, a memory leak vulnerability was found in the ath11k driver in WMI WOW functions. Two instances directly returned the result of ath11k_wmi_cmd_send without checking the return value, preventing skb buffer deallocation in the error path.

In the Linux kernel, a reference leak was found in the DRM driver for Adreno GPUs (MSM) in the a6xx_gpu_init() function. The function obtains a device node via of_parse_phandle(), but several early error paths skip releasing the reference, causing a memory leak.

In the Linux kernel, a flawed sanity check in dma_map_resource() using pfn_valid() was moved to debug code. On ARM64 with SPARSEMEM, MMIO addresses sharing a section with RAM falsely triggered WARN_ON_ONCE and returned DMA_MAPPING_ERROR, causing issues on Raspberry Pi 4 during SPI driver probe.