Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-49911

Publication date:

21/10/2024

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func This commit adds a null check for the set_output_gamma function pointer in the dcn20_set_output_transfer_func function. Previously, set_output_gamma was being checked for null at line 1030, but then it was being dereferenced without any null check at line 1048. This could potentially lead to a null pointer dereference error if set_output_gamma is null. To fix this, we now ensure that set_output_gamma is not null before dereferencing it. We do this by adding a null check for set_output_gamma before the call to set_output_gamma at line 1048.

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2024-49915

Publication date:

21/10/2024

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw This commit addresses a potential null pointer dereference issue in the `dcn32_init_hw` function. The issue could occur when `dc->clk_mgr` is null. The fix adds a check to ensure `dc->clk_mgr` is not null before accessing its functions. This prevents a potential null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn32/dcn32_hwseq.c:961 dcn32_init_hw() error: we previously assumed &#39;dc->clk_mgr&#39; could be null (see line 782)

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2024-49917

Publication date:

21/10/2024

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw This commit addresses a potential null pointer dereference issue in the `dcn30_init_hw` function. The issue could occur when `dc->clk_mgr` or `dc->clk_mgr->funcs` is null. The fix adds a check to ensure `dc->clk_mgr` and `dc->clk_mgr->funcs` is not null before accessing its functions. This prevents a potential null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:789 dcn30_init_hw() error: we previously assumed &#39;dc->clk_mgr&#39; could be null (see line 628)

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2024-49905

Publication date:

21/10/2024

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null check for &#39;afb&#39; in amdgpu_dm_plane_handle_cursor_update (v2) This commit adds a null check for the &#39;afb&#39; variable in the amdgpu_dm_plane_handle_cursor_update function. Previously, &#39;afb&#39; was assumed to be null, but was used later in the code without a null check. This could potentially lead to a null pointer dereference. Changes since v1: - Moved the null check for &#39;afb&#39; to the line where &#39;afb&#39; is used. (Alex) Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_plane.c:1298 amdgpu_dm_plane_handle_cursor_update() error: we previously assumed &#39;afb&#39; could be null (see line 1252)

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2024-49907

Publication date:

21/10/2024

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check null pointers before using dc->clk_mgr [WHY & HOW] dc->clk_mgr is null checked previously in the same function, indicating it might be null. Passing "dc" to "dc->hwss.apply_idle_power_optimizations", which dereferences null "dc->clk_mgr". (The function pointer resolves to "dcn35_apply_idle_power_optimizations".) This fixes 1 FORWARD_NULL issue reported by Coverity.

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2024-49912

Publication date:

21/10/2024

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Handle null &#39;stream_status&#39; in &#39;planes_changed_for_existing_stream&#39; This commit adds a null check for &#39;stream_status&#39; in the function &#39;planes_changed_for_existing_stream&#39;. Previously, the code assumed &#39;stream_status&#39; could be null, but did not handle the case where it was actually null. This could lead to a null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_resource.c:3784 planes_changed_for_existing_stream() error: we previously assumed &#39;stream_status&#39; could be null (see line 3774)

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2024-49913

Publication date:

21/10/2024

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream This commit addresses a null pointer dereference issue in the `commit_planes_for_stream` function at line 4140. The issue could occur when `top_pipe_to_program` is null. The fix adds a check to ensure `top_pipe_to_program` is not null before accessing its stream_res. This prevents a null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:4140 commit_planes_for_stream() error: we previously assumed &#39;top_pipe_to_program&#39; could be null (see line 3906)

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2024-49901

Publication date:

21/10/2024

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs There are some cases, such as the one uncovered by Commit 46d4efcccc68 ("drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails") where msm_gpu_cleanup() : platform_set_drvdata(gpu->pdev, NULL); is called on gpu->pdev == NULL, as the GPU device has not been fully initialized yet. Turns out that there&#39;s more than just the aforementioned path that causes this to happen (e.g. the case when there&#39;s speedbin data in the catalog, but opp-supported-hw is missing in DT). Assigning msm_gpu->pdev earlier seems like the least painful solution to this, therefore do so. Patchwork: https://patchwork.freedesktop.org/patch/602742/

Severity CVSS v4.0: Pending analysis

Last modification:

25/10/2024

CVE-2024-49904

Publication date:

21/10/2024

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: add list empty check to avoid null pointer issue Add list empty check to avoid null pointer issues in some corner cases. - list_for_each_entry_safe()

Severity CVSS v4.0: Pending analysis

Last modification:

25/10/2024

CVE-2024-49897

Publication date:

21/10/2024

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check phantom_stream before it is used dcn32_enable_phantom_stream can return null, so returned value must be checked before used. This fixes 1 NULL_RETURNS issue reported by Coverity.

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2024-49898

Publication date:

21/10/2024

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check null-initialized variables [WHAT & HOW] drr_timing and subvp_pipe are initialized to null and they are not always assigned new values. It is necessary to check for null before dereferencing. This fixes 2 FORWARD_NULL issues reported by Coverity.

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2024-49899

Publication date:

21/10/2024

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Initialize denominators&#39; default to 1 [WHAT & HOW] Variables used as denominators and maybe not assigned to other values, should not be 0. Change their default to 1 so they are never 0. This fixes 10 DIVIDE_BY_ZERO issues reported by Coverity.

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

Subscribe to Vulnerabilities