CVE Vulnerability Catalog

In the Linux kernel, the UCSI (USB Type-C) driver lacks validation of the connector number in ucsi_connector_change(). The 7-bit connector number from the PPM is used to index the ucsi->connector[] array without checking against the number of connectors reported at init. A buggy or malicious PPM can trigger schedule_work() on out-of-bounds memory.

A memory leak was found in the Linux kernel's migrate_vma_insert_huge_pmd_page function. When a PMD check fails, the previously allocated page table (pgtable) is not freed, causing a memory leak. A free_abort label was added to release the pgtable in the error path.

A reference leak in the Bluetooth L2CAP stack of the Linux kernel was found. The l2cap_chan_timeout() function fails to release a reference taken by __set_chan_timer() when the connection (chan->conn) is NULL, causing a memory leak.

In the Linux kernel MT6359 ADC driver, the return value of regmap_read() in mt6358_read_imp() is not checked. If the read fails, val_v remains uninitialized and its random stack content is reported as a measurement result.

In the NXP SAR ADC driver in the Linux kernel, there is no validation of the sampling frequency value before using it as a divisor. Writing zero or a negative value to the sampling_frequency sysfs attribute triggers a division by zero. Additionally, when the computed cycle count is smaller than NXP_SAR_ADC_CONV_TIME, an unsigned integer underflow occurs, wrapping inpsamp to a huge value.

In the ADIS16260 gyroscope driver in the Linux kernel, there is no validation of the sampling frequency value before using it as a divisor. Writing zero to the sampling_frequency sysfs attribute triggers a division by zero in the kernel.

In the Linux kernel driver for the MH-Z19B sensor (iio: chemical: mhz19b), a buffer overflow vulnerability was found. The mhz19b_receive_buf() function copies serial data into a fixed buffer without checking if the reply size exceeds available space, potentially causing a buffer overflow.

In the Linux kernel, the SCD30 driver for IIO chemical sensors has a division by zero vulnerability. A user can trigger a kernel crash by writing a zero fractional part to the sampling_frequency sysfs attribute.

A memory leak was discovered in the Linux kernel's IIO (Industrial I/O) subsystem during DMA buffer enqueue. The iio_buffer_enqueue_dmabuf() function failed to release a reference to the struct iio_dma_fence object, causing a permanent leak of 104 bytes per enqueue operation.

In the Atmel maXTouch touchscreen driver (atmel_mxt_ts) in the Linux kernel, a boundary check flaw was found in the mxt_prepare_cfg_mem function. When a config file provides an object larger than expected, the processing loop incorrectly skips the last byte, causing adjacent memory overwrite.

In the Linux kernel, the USB serial keyspan driver lacks a sanity check on the size of usa49wg indat transfers, potentially parsing stale or uninitialized slab data.

In the Linux kernel, a vulnerability was found in the mct_u232 USB serial driver. It lacks a sanity check on the size of interrupt-in transfers, which could lead to parsing stale or uninitialized slab data and leaking it to user space.

In the Linux kernel's amdgpu driver, a lock leak was found in the AMDGPU_GEM_OP_GET_MAPPING_INFO function. The error occurs on memory allocation failure (ENOMEM), causing three tracked resources, including the dma_resv lock on the VM root page directory, to be leaked. This permanently blocks subsequent operations on the same GPU VM, leading to a local denial of service (DoS).

In the Linux kernel's amdgpu driver, a vulnerability was found due to missing bounds check on user-supplied num_entries in GEM_OP GET_MAPPING_INFO. An attacker can supply an excessively large num_entries, causing massive memory allocation, a kernel WARNING, and panic on systems with CONFIG_PANIC_ON_WARN=y.

A vulnerability was found in the Linux kernel's DZ serial driver for DECstation platforms. During initialization of the first serial port, a NULL pointer dereference occurred, causing a kernel panic. The issue was fixed by converting the driver to use a platform device.

In the Linux kernel, the Z85C30 serial driver (DECstation) crashes during initialization of the first serial port due to a null pointer dereference. The fix converts the driver to use a platform device, preventing the crash.

In the Linux kernel, a reference leak of mm_struct was found in the aie2_populate_range() function of the accel/amdxdna driver. Jumping to the 'again' label without calling mmput(mm) causes a kernel memory leak.

A vulnerability was found in the Linux kernel's GARP (Generic Attribute Registration Protocol) attribute parser. The bug is caused by reversed operands in data length calculation, leading to an unsigned integer underflow. As a result, received Join/Leave events are ignored, breaking protocols like GVRP.

In the Linux kernel PCI driver for MediaTek Gen3, an IRQ domain leak was detected. IRQ domains are allocated before fetching the controller IRQ, and if the fetch fails, the function returns an error without freeing the already allocated domains.

In the SPI driver for MediaTek chips (mtk-snfi), the ECC engine was not unregistered during probe failure unwind and device removal. A devm cleanup action was added to ensure nand_ecc_unregister_on_host_hw_engine() is called correctly in both cases.