Linux kernel vulnerabilities

The Linux kernel contains an ABBA deadlock between the mmap_lock and disassociation_lock in the RDMA/uverbs subsystem. A thread performing mmap/fork acquires locks in the order mmap_lock → disassociation_lock, while the thread executing uverbs_user_mmap_disassociate() acquires them in reverse order, leading to a potential deadlock. The issue was resolved by removing disassociation_lock and using the existing hw_destroy_rwsem instead.

In the Linux kernel, the RDMA/efa management IRQ handler accesses both the admin completion queue and the async event queue. The driver registered the IRQ before constructing these queues and destroyed them before freeing the IRQ, so the handler's lifetime was not contained by the resources it accesses. The fix initializes the queues with interrupts masked, requests the IRQ, then switches to interrupt mode, and on removal resets the device and frees the IRQ before destroying the queues.

In the Linux kernel, the RDMA/efa completion IRQ handler accesses the EQ state and DMA buffer. Its IRQ was registered before that state was initialized, while teardown released the buffer before free_irq() synchronized the handler. The fix initializes the EQ without arming it, registers the IRQ, then arms it, and reverses the resource order during teardown by freeing the IRQ before destroying the EQ.

In the Linux kernel, the USB 6fire driver uses URBs embedded in different structs for PCM, MIDI and communication, which is a buggy implementation nowadays; since a URB is managed with a refcount, this may lead to a UAF when the URB is released asynchronously. The fix converts those embedded URBs to ones properly allocated via usb_alloc_urb(), changing each embedded struct urb to a pointer and updating callers; resources are released in common destructors called at both the init error path and disconnect.

In the Linux kernel, the CoDel scheduler's dropping loop in codel_dequeue() could fail to advance with very small interval values, draining the entire backlog under the qdisc lock in a single call. An unprivileged user could trigger a soft lockup this way. The fix ensures the control-law step is at least 1 tick and caps the dropping loop at 256 drops per codel_dequeue() call.

In the Linux kernel, the mwifiex wifi driver's mwifiex_pcie_request_irq() registers each MSI-X vector with a per-index dev_id (&card->msix_ctx[i]). On a request_irq() failure the cleanup loop "for (j = 0; j < i; j++)" frees msix_entries[j].vector but passes the failed index's &card->msix_ctx[i] as the dev_id. Since free_irq() matches on (irq, dev_id), it fails to find the action registered with &card->msix_ctx[j]: the already-requested IRQ j is not freed (leaked) and free_irq() warns about freeing a non-existent IRQ. The fix uses &card->msix_ctx[j].

In the Linux kernel, ieee80211_request_ibss_scan() in mac80211 warns when the regulatory domain leaves no allowed channel to scan. This can happen because the regdomain can change while IBSS is operating, and IBSS can continue to operate briefly during the 60s grace period until it is shut down. The fix removes the warning in this case.

In the Linux kernel, cfg80211_switch_netns() in cfg80211 moves all interfaces, then moves the wiphy itself by setting its network namespace and renaming it, which makes sysfs move it. The rename can fail (only on allocation failures), leaving things mixed up and hitting a warning. The fix undoes the move and lets the change fail, and if undo fails it WARNs.

In the Linux kernel, mac80211_hwsim checks ->started for frames coming from wmediumd, but the radio can be stopped after the check and before frame delivery, causing mac80211 to hit WARN_ON(!local->started). The fix expands the mutex for this case and synchronizes against it when the radio is stopped, and drops an error print that complicated the error path.

In the Linux kernel, mac80211 AP_VLAN interfaces get crypto_tx_tailroom_needed_cnt from the AP interface on ifup, but it is never decremented unless the AP is also brought down. Bringing the same AP_VLAN up again increments the counter again and eventually hits the WARN_ON_ONCE sanity check. The fix resets it on ifdown.

In the Linux kernel, mac80211 requires that a TDLS setup confirm (WLAN_TDLS_SETUP_CONFIRM) be sent to an existing TDLS station. Otherwise, building the frame hits WARN_ON_ONCE(!sta || !ap_sta). The fix only accepts WLAN_TDLS_SETUP_CONFIRM when the station already exists as a TDLS station.

In the Linux kernel, reset_per_cpu_data() in drop_monitor computes al including sizeof(struct nlattr) (the 4-byte attribute header). It then calls memset(msg, 0, al), where msg points to nla_data(nla), which is sizeof(struct nlattr) bytes past nla, writing 4 bytes beyond the allocated buffer and corrupting skb_shared_info. The fix makes al represent only the payload length and uses genlmsg_new(nla_total_size(al), ...).

In the Linux kernel, the scheduler (sched/core) can move a blocked donor's scheduling context to the lock owner's CPU even when the donor is migration-disabled. set_task_cpu() warns unconditionally for migration-disabled tasks, causing a false positive. The fix excludes blocked proxy donors from the warning.

In the Linux kernel, ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates that offset and triggers the skb warning path. The fix uses the careful transport-header helper and drops the skb through the existing XFRM error path when the offset cannot be represented.

In the Linux kernel, the dmaengine ti k3-udma-glue driver has a bug in k3_udma_glue_release_rx_chn(). If devm_kcalloc() for rx_chn->flows fails in a channel request function, the error path calls k3_udma_glue_release_rx_chn(), which dereferences the NULL rx_chn->flows pointer in k3_udma_glue_release_rx_flow(). The fix skips the flow release loop when rx_chn->flows is not allocated.

In the Linux kernel, the soc: samsung: exynos-pmu driver has a use-after-free of the interrupt generator device tree node. setup_cpuhp_and_cpuidle() releases the node reference (of_node_put()) too early and then passes the intr_gen_node pointer to of_syscon_register_regmap().

In the Linux kernel, a bug in memcg causes obj_cgroup_charge_pages() to not short-circuit the root memcg, leading to a warning in refill_stock() and asymmetric page accounting. This can be triggered via zswap and cgroup operations, resulting in a page counter leak in the root memcg.

In the Linux kernel, the SELinux avc_has_perm_noaudit() function returns early for an empty requested permission set without filling the access decision buffer (@avd). All callers pass an uninitialized stack variable that is then fed to avc_audit(), and the inode hook even stores it in the per-task decision cache.

In the Linux kernel, the power: sequencing subsystem's pwrseq_unit_new() can dereference a NULL pointer. If memory allocation fails in pwrseq_unit_setup_deps(), pwrseq_unit_put() is called to release the partially initialized unit, but unit->list was never initialized and pwrseq_unit_release() unconditionally calls list_del() on it.

In the Linux kernel, the power: sequencing subsystem's pwrseq_device_register() can dereference a NULL pointer. If dev_set_name() fails, the code jumps to the err_put_pwrseq label before initializing pwrseq->targets, and pwrseq_release() unconditionally iterates over targets and dereferences an invalid pointer.

In the Linux kernel, the watchdog: da9063 driver's da9063_wdt_suspend() and da9063_wdt_resume() only check watchdog_active(). When the driver sets WDOG_HW_RUNNING in da9063_wdt_probe() but userspace never opens the device, WDOG_ACTIVE remains cleared and wdt_disable() is not executed during suspend, so the watchdog keeps counting and may reset the system.

In the Linux kernel, the watchdog: rtd119x driver's clk_get_rate() can return 0, leading to a division by zero. The vulnerability causes a kernel panic.

In the Linux kernel, the watchdog: rzv2h driver's clk_get_rate() can return 0, leading to a division by zero. The vulnerability causes a kernel panic.

In the Linux kernel, the wifi: rsi driver's rsi_hal_load_key() performs a memset with an incorrect offset when a key is removed (data == NULL). Since set_key is a struct rsi_set_key pointer, the subscript is scaled by sizeof(struct rsi_set_key) (160 bytes), so the memset writes 144 zero bytes about 2.4 KB past the end of the skb data buffer, corrupting unrelated heap objects.

In the Linux kernel, ieee80211_set_bitrate_mask() lacked a check for the IEEE80211_SDATA_IN_DRIVER flag before calling the driver. When the interface was running but not yet added to the driver (e.g., during bringup or teardown), an ioctl SIOCSIWRATE call triggered a WARN in driver-ops.h. The fix adds an IN_DRIVER check and returns -ENETDOWN.

In the Linux kernel SMB client, parse_posix_sids() computes sidsbuf_end using the server-supplied out_len without validating it against the actual received iov length. A malicious server can provide an inflated out_len, enabling out-of-bounds reads into adjacent kernel memory.

In the Linux kernel drm/virtio driver, virtio_gpu_user_framebuffer_create() returns NULL instead of an ERR_PTR() error pointer. This leads to a NULL pointer dereference in drm_mode_addfb2().

In the Linux kernel s390 boot code, append_ipl_block_parm() may pass a zero size to the IPL parameter conversion helpers when the command line occupies the entire COMMAND_LINE_SIZE buffer. This results in a write outside the command line buffer.

In the Linux kernel, a bug was fixed in the icmp_send tracepoint where TP_fast_assign() unconditionally called udp_hdr(skb) before checking whether the packet is UDP. This triggered a DEBUG_NET_WARN_ON_ONCE warning when accessing an uninitialized transport header (transport_header = ~0U), as __icmp_send() can be invoked from paths such as link failures, ARP errors, forwarding, or AF_PACKET.

A vulnerability in the Linux kernel's iptunnel handling causes a stale transport_header offset during tunnel decapsulation of GSO packets. This leads to a negative offset and subsequent KASAN fault or page fault in qdisc_pkt_len_segs_init(). The issue occurs when encapsulated GSO packets are forwarded at L2 by a bridge or HSR instead of being delivered to the local IP stack.

In the Linux kernel s390 kdump handling, set_os_info_reipl_block() dereferences reipl_block_actual, which remains NULL for IPL types without a re-IPL parameter block (e.g., HMC FTP boot, QEMU direct kernel boot). This can lead to a NULL pointer dereference.

In the Linux kernel s390 stand-alone dump handling, dump_reipl_run() unconditionally dereferences reipl_block_actual, which remains NULL for IPL types without a re-IPL parameter block. This can lead to a NULL pointer dereference and put the dumper into disabled wait.

In the Linux kernel platform/x86 x86-android-tablets module, gpio_secondary_fwnode_init() drops the device reference at the end of each iteration, while devm_add_action_or_reset() saves the pointer without incrementing its reference count. This can lead to a use-after-free during driver teardown.

In the Linux kernel on PowerPC, arch_exit_to_user_mode_prepare() restored user memory access permissions (KUAP) too early, before platform-specific exit routines completed. This caused the kernel to run with user memory access unblocked, triggering a warning in interrupt_exit_user_prepare() when CONFIG_PPC_KUAP_DEBUG was enabled. The issue was fixed by removing the KUAP restore from that hook.

In the Linux kernel on PowerPC, __replay_soft_interrupts() overwrote irq_soft_mask with IRQS_DISABLED (0x1) when replaying a pending interrupt, stripping the IRQS_PMI_DISABLED (0x2) bit. This triggered a WARN_ON in arch/powerpc/kernel/irq_64.c:75, observed early in boot on a POWER10 pseries guest. The fix replaces local_irq_disable() with hard_irq_disable().

In the Linux kernel, recv(0, MSG_PEEK) in blocking mode triggered a busy-wait in unix_stream_read_generic() when the last skb in the queue was a MSG_OOB skb. This affects AF_UNIX sockets. The fix makes the function return 0 immediately, matching TCP behavior.

In the Linux kernel IPv4 handling, a UDP length overflow occurs with PMTU discovery and a very large interface MTU. When IP_MTU_DISCOVER is set to IP_PMTUDISC_PROBE and a packet is sent over a netdev with MTU larger than IP_MAX_MTU + 20, the UDP length can exceed the 16-bit field and trigger a WARN in udp_set_len_short. This affects the IPv4 networking stack in the kernel.

In the Linux kernel Bluetooth driver btintel_pcie, there is an off-by-one bounds check error for tx_handle. Valid indices are 0..txq->count-1, but the guard in btintel_pcie_msix_tx_handle() only checked '> txq->count', allowing an index equal to txq->count. The fix changes the guard to '>= txq->count'.

In the Linux kernel drm/xe driver, a race condition occurs during VM teardown when the runtime PM reference is dropped asynchronously while stale page faults are still queued. The page-fault worker may call guc_ct_send_locked() on an already-suspended device, tripping an assertion and kernel warning. The fix holds a runtime PM reference across the entire pagefault queue worker.

In the Linux kernel x86/amd_node code, a divide-by-zero occurs on virtualized systems. The number of nodes is unrelated to the number of roots, and on Xen PVH dom0 roots_per_node can be 0, causing a crash in a modulo operation. The fix sets roots_per_node to 1 in this case and prints a firmware bug warning for non-virtualized systems.

In the Linux kernel drm/amdgpu driver, during resume from GPU reset, the gfx idle work may invoke switch_power_profile before the reset completes. This causes register access without releasing the GPU reset semaphore, leading to an assertion error and stack trace. The fix skips switch_power_profile during GPU reset.

In the Linux kernel, do_close_on_exec() is called while holding exec_update_lock, which can block waiting for a filesystem reply. This can lead to deadlock if a FUSE filesystem tries to inspect the calling process, or block codepaths using exec_update_lock. The fix moves do_close_on_exec() before taking exec_update_lock, but after copying the FD table if necessary.

In the Linux kernel s390/crypto module (aes_s390), return codes from skcipher_walk_virt() are not properly checked before entering processing loops in ecb_aes_crypt() and ctr_aes_crypt(). If skcipher_walk_virt() fails, the walk structure may be in an undefined state, leading to incorrect behavior or access to uninitialized memory. The fix adds proper return code checking.

In the Linux kernel scsi: qla2xxx driver, __qla2x00_alloc_iocbs() zeroes the QLAFX00 request ring slot with a plain memset(), even though it is ioremapped device I/O memory, not DMA-coherent RAM. On architectures like ARM64, memset() may emit invalid instructions (e.g., DC ZVA) on Device memory, causing a synchronous external abort. The fix uses memset_io() for QLAFX00.

In the Linux kernel, a use-after-free vulnerability exists in tcp_send_synack() involving retransmit_skb_hint. When tcp_send_synack() replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original but tp->retransmit_skb_hint still points to the freed object, which can be exploited by an unprivileged TFO client to trigger a use-after-free.

In the Linux kernel, a bug exists in move_hugetlb_page_tables() where the destination address is advanced too far when the source and destination offsets within their page tables differ. This can lead to a kernel panic on x86-64.

In the Linux kernel's BPF subsystem, mark_fastcall_pattern_for_call() must ensure that a matched "spill; call; fill" instruction series is not interrupted by a jump. Otherwise the rewrite applied by bpf_remove_fastcall_spills_fills() is unsound. The fix records instructions targeted by jumps in insn_aux_data[*].jump_target and uses this flag to stop growing a pattern.

In the Linux kernel's BPF subsystem, in_rbtree_lock_required_cb() only checks the innermost verifier frame, so rbtree callback restrictions disappear in a nested static subprogram call frame. The subprogram can unlock the tree, remove and drop the node being compared, then relock, leading to freed memory being linked into the tree.

In the Linux kernel, a BPF verifier vulnerability affects stack helpers that may block on filesystem reads (e.g., resolving build IDs) but were not marked as sleepable. The verifier could still allow these helpers from non-sleepable regions such as RCU or preemption-disabled sections.

In the Linux kernel, the BPF verifier mishandled legacy packet-load instructions (BPF_LD_ABS/BPF_LD_IND) reached from callbacks, triggering a verifier bug warning and an -EFAULT on BPF_PROG_LOAD. A privileged program loader could trigger this issue.