CVE Vulnerability Catalog

In the Linux kernel, the pds_core driver has a dentry reference leak and improper error handling in debugfs_lookup(). debugfs_lookup() returns a dentry with an elevated reference count that must be released with dput(). The code discards the dentry without calling dput(), causing a leak on every firmware reset recovery. Additionally, when CONFIG_DEBUG_FS is disabled, debugfs_lookup() returns ERR_PTR(-ENODEV) instead of NULL, and the current check passes for error pointers, leading to a crash when calling dput() on an invalid pointer.

In the Linux kernel, a metabuf leak was found in the EROFS filesystem during extended attribute initialization of inodes. The error paths after erofs_read_metabuf() fail to release the buffer, causing a folio reference leak.

In the Linux kernel Bluetooth btmtk driver, a memory leak occurs when urb submission fails or the submitted urb is killed. The setup_packet of the control urb is not freed in error paths, leading to memory leak.

A vulnerability in the Linux kernel's uniwill-laptop driver may cause permanent battery damage on older models (~2020) when enabling the charging limit even via the 'force' parameter. The fix prevents forcing this feature.

In the Linux kernel, the ksmbd module has a memory leak of struct smb_sid in set_posix_acl_entries_dacl(). When the DACL size exceeds 65535 bytes, the newly added check_add_overflow() guard breaks out of the loop but skips freeing the previously allocated memory, causing a leak.

A stack buffer overflow vulnerability was found in the pmbus/adm1266 driver of the Linux kernel. The function adm1266_nvmem_read_blackbox() uses a 5-byte local buffer for reading block data via i2c_smbus_read_block_data(), which does not check buffer size and copies up to 32 bytes, potentially causing stack overflow.

A bug in the Linux kernel's unmap_page_range function caused spurious warnings when unmapping device-private/exclusive pages. The issue stemmed from an incorrect assumption that anonymous folios always belong to anonymous VMAs, which is false for private file-backed mappings.

In the Linux kernel, a vulnerability was found in the tag initialization of the huge zero folio when init_on_free is enabled. Memory tags are not cleared, potentially leaking previous allocation data. The issue affects ARM64 with Memory Tagging Extension (MTE).

In the Linux kernel, a vulnerability in the memory migration mechanism (mm/migrate_device) causes a spinlock leak when check_stable_address_space() fails after acquiring the PMD spinlock, leading to a permanent deadlock.

In the Linux kernel, a Bluetooth ISO vulnerability allows ISO_END frames sent without prior ISO_START to trigger a NULL pointer dereference. An attacker within radio range can crash the system (oops) by sending crafted packets.

In the Linux kernel's Bluetooth L2CAP subsystem, a vulnerability was found in the ecred_reconfigure function where a stack pointer was incorrectly passed instead of the packed PDU structure. This causes a kernel address leak to the paired Bluetooth device and breaks the L2CAP_ECRED_RECONFIGURE functionality.

In the Linux kernel, a vulnerability was found where kstrdup() return values in phy_prepare_data() are not checked. A failed memory allocation for the 'name' string leads to a NULL pointer dereference in phy_reply_size() when strlen() is called, causing a kernel panic.

In the Linux kernel L2TP module, a vulnerability was found due to using list_del_init() instead of list_del_rcu() when removing a session from the list. An unprivileged local user can pin a host CPU indefinitely by concurrently issuing GET, CREATE, and DELETE operations on an L2TP session.

A memory leak vulnerability was found in the Linux kernel's igc driver for Intel network adapters. The igc_fpe_xmit_smd_frame() function fails to free an allocated skb buffer when igc_fpe_init_tx_descriptor() fails, causing a memory leak.

In the Linux kernel's PCM512x driver, a null pointer dereference was found in pcm512x_overclock_xxx_put() functions. The issue arises from incorrectly using snd_soc_dapm_kcontrol_to_dapm() for a general mixer kcontrol, which should be replaced with snd_soc_component_to_dapm().

In the Linux kernel, a vulnerability was found in the KVM component for ARM64 architecture, related to memory management of the virtual Generic Interrupt Controller (vGIC). When vGIC initialization for a virtual CPU (vCPU) fails after allocating private IRQs, these IRQs are not freed, leading to a memory leak. The kvm_vgic_vcpu_destroy() call is missing in the error path of kvm_vgic_vcpu_init().

In the Linux kernel, a vulnerability was found in the pds fwctl driver where RPC input size validation occurs after parsing. This can lead to an out-of-bounds read if the input size is smaller than the expected structure.

A deadlock was detected in the Linux kernel's MSM DRM driver during shrinker operation. The kswapd process, holding the fs_reclaim lock, attempts to acquire the reservation_ww_class_acquire lock, leading to a circular dependency and potential system deadlock.

In the Linux kernel's batman-adv (BLA) module, a NULL pointer dereference vulnerability was found. It occurs when a hard interface (hardif) is detached from a mesh interface (meshif) without holding rtnl_lock, causing the meshif pointer to become NULL. Subsequent operations, such as sending an ARP request, trigger the flaw.

In the Linux kernel, a reference leak of tp_vars was found in the batman-adv throughput meter receiver shutdown. The flaw stems from incorrect synchronization between the timer callback and batadv_tp_stop_all(), causing inconsistent resource release.