Bjorn Andersson

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A vulnerability in the Linux kernel has been resolved. The issue occurs when the SCM driver fails during the probe, leaving the global ' scm' variable assigned. This can cause external users of the driver to assume the probe finished successfully, potentially leading to a NULL pointer exception. The problem is triggered by introducing probe deferral in the SCM driver. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A issue in the Linux kernel has been resolved, specifically in the qcom scm smc firmware. The problem was related to handling a missing SCM device. A commit was made to explicitly handle the case where qcom scm get tzmem pool() can return NULL, ensuring its users can properly manage this situation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the mapping of shared memory in the Linux kernel, specifically in the soc: qcom: cmd-db component. The problem arises when the XPU falsely detects clean cache eviction as a "write" into the write-protected region, leading to a secure interrupt and an endless loop in the Trust Zone. This occurs because the Qualcomm Hypervisor maps the region as Non-Cacheable memory in Stage 2 translation tables, but other hypervisors like Xen or KVM do not know about these specific mappings. The patch fixes the issue by updating the mapping of cmd-db memory from MEMREMAP WB to MEMREMAP WT/WC, removing the dependency on correct mappings in Stage 2 tables. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 5.18.0-rc5-next-20220506-00033-g6cee8cab6089-dirty #419 **Description** A vulnerability has been resolved in the Linux kernel. The issue occurred when the `msm drm uninit()` function was called from the `msm drm init()` error path, which could lead to calling `free irq()` for an IRQ that was not requested before due to an earlier error. This resulted in a warning and a backtrace indicating an attempt to free an already-free IRQ. The vulnerability is related to the `drm/msm` module and affects the `msm drm uninit()` and `msm drm bind()` functions. **Recommendations** To resolve the issue, update the Linux kernel to a version that includes the fix for this vulnerability. As a temporary workaround, consider disabling the `msm drm uninit()` function until a patch is available. Restrict access to the `drm/msm` module to minimize the risk of exploitation. Avoid using the `free irq()` function in the affected code path until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A issue in the Linux kernel has been resolved, related to a struct clk leak on probe errors in the phy: qcom-qmp module. The problem occurred when a late probe error happened, such as probe deferral, and the pipe clock reference was not released. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A shift-out-of-bounds error was found in the Linux kernel, specifically in the gpio-wcd934x driver. The bit-mask for pins 0 to 4 is incorrectly set to BIT(n - 1) instead of BIT(0) to BIT(4). This issue was caught by the UBSAN check, which reported a shift-out-of-bounds error in the drivers/gpio/gpio-wcd934x.c file at line 34, column 14. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A potential use after free issue in the MHI send functionality of the Linux kernel has been resolved. The `MHI ul callback` may be invoked immediately after the `skb` is queued for transmission, leading to the callback decrementing the refcount of the associated `sk` and freeing the `skb`. To avoid this issue, the dereference of `skb` and the increment of the `sk` refcount must happen before the `skb` is queued. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.