Linux kernel vulnerabilities

In the Linux kernel's drm/panthor driver, panthor_fw_load_section_entry() skips BO creation for zero-sized firmware sections but adds them to the section list, leading to NULL pointer dereference in later paths. The fix skips adding such sections to the list.

In the Linux kernel powerpc/pseries papr-phy-attest, missing validation of cmd.length could lead to buffer overflow. The fix adds length checks and fixes memory leaks on error paths.

In the Linux kernel Synaptics RMI4 driver (F54), worker errors were not propagated to the V4L2 queue, causing stale or uninitialized data to be delivered to userspace. The fix adds error checking and marks buffers as error state.

In the Linux kernel, the hynitron_cstxxx driver improperly validated touch count and finger IDs. This can lead to corrupted touch state or out-of-bounds buffer access.

In the Linux kernel, the gve driver lacks an implementation of adjfine, leading to a NULL pointer dereference when triggered from userspace, e.g., via testptp.

A use-after-free vulnerability was found in the Linux kernel's gpio-sloppy-logic-analyzer driver. The 'trigger' debugfs file lacked proper protection, allowing a write to freed memory during device unbind. The issue was fixed by using debugfs_create_file() instead of debugfs_create_file_unsafe().

In the Linux kernel, the xcrb_msg_to_type6cprb_msgx() and xcrb_msg_to_type6_ep11cprb_msgx() functions for s390/zcrypt copy a user space message into a kernel buffer based on length, but further processing assumes 4-byte alignment. As a result, up to 3 bytes of uninitialized kernel memory are forwarded to further processing, potentially exposing kernel memory to the crypto card firmware.

In the Linux kernel, the amdgpu driver for AMD Display has a NULL pointer dereference in amdgpu_dm_crtc_set_vblank() when vblank is enabled or queried before a stream is attached to acrtc_state->stream. This can lead to a system crash.

In the Linux kernel XFS filesystem, during directory tree repair, a self-referential directory may be detected. In such a case, the repair code attempts to lock the same inode twice (double iolock/ilock), leading to a deadlock. The fix detects this corner case and handles it appropriately.

In the Linux kernel XFS filesystem, during AGI repair, the function xrep_iunlink_walk_ondisk_bucket may attempt to use the pointer sc->sa.agi_bp, which can be null if the buffer verifier fails. The fix uses ragi->agi_bp instead, which skips verifier checks, to avoid walking off the end of memory.

In the Linux kernel XFS filesystem, during online fsck, the function xrep_iunlink_resolve_bucket is still vulnerable to infinite loops coming from next_unlinked pointers. The fix remembers which inodes have already been seen and checks new agino pointers against that to detect loops.

In the Linux kernel XFS filesystem, the function xlog_recover_dquot_commit_pass2() validates the recovered dquot with xfs_dqblk_verify(). On failure, it sets error = -EFSCORRUPTED and jumps to out_release, but out_release unconditionally returns 0, so the error is discarded. This allows a corrupt quota buffer to be written back to disk.

A vulnerability in the Linux kernel's ASoC SOF subsystem affects IPC payload handling for copier widgets. After suspend/resume, the ipc_config_data buffer is not refreshed, causing stale DMA channel assignments to be sent to firmware, leading to errors and crashes. The fix refreshes copier_data and dma_config_tlv before sending the IPC message.

In the Linux kernel, the optee ffa driver's optee_ffa_lend_protmem function does not check if the allocated pointer is NULL. Under memory pressure, this can lead to a null pointer dereference.

In the Linux kernel, the SCSI core subsystem reads the shost->eh_noresume flag twice in one error handling iteration, which can lead to unmatched runtime PM get and put calls, causing a usage count underflow.

In the Linux kernel's rseq mechanism, rseq_grant_timeslice_extension() calls hrtimer_rearm_deferred_tif() with interrupts enabled, while __hrtimer_rearm_deferred() expects interrupts disabled. This can lead to a livelock and is caught by lockdep.

In the Linux kernel, the net/sched act_api module has a TOCTOU vulnerability leading to NULL pointer dereference on a->goto_chain. A concurrent operation can clear the pointer between two reads, causing a NULL dereference.

In the Linux kernel, the regmap sdw-mbq module has a vulnerability of calling an unset readable_reg callback. When the callback is not set, calling it leads to a NULL pointer dereference, potentially causing a system crash.

In the Linux kernel, in the L2TP modules (pppol2tp and l2tp_dfs), there is a reference leak for tunnels and sessions when closing seq_file files before reaching end-of-file. References stored in private data are not dropped, leading to memory leaks.

In the Linux kernel's firewire: ohci driver, a NULL pointer dereference vulnerability was found in ar_context_release(). The issue occurs during the error handling path of the probe function when the context was not initialized, and the devres cleanup mechanism triggers release. An attacker could exploit this to cause a kernel crash (system panic).

In the Linux kernel, in the DRM/AMD Display subsystem, the function dce110_set_avmute called is_tg_enabled without checking if it is implemented in the ops table for older DCE timing generators. This caused a NULL pointer dereference on Southern Islands GPUs when turning the display off over HDMI.

In the Linux kernel, in the soc: aspeed: lpc-snoop driver, the snoop_file_read function can cause a usercopy overflow due to lack of synchronization between the producer (IRQ) and consumer (file). The fix adds a per-channel spinlock to serialize kfifo access.

In the Linux kernel, in XFS, the function xfs_buf_free calls folio_put on a NULL pointer when backing memory allocation fails, leading to a kernel crash. The fix skips folio_put when bp->b_addr is NULL.

A memory leak was found in the Linux kernel's btrfs filesystem in the btrfs_do_encoded_write() function. During encoded write operations (ioctl), allocated extent_changeset structures are not freed before returning from the function, leading to memory leaks. The issue was discovered during local fuzzing on version 6.12.94.

In the Linux kernel net/smc module, the smc_llc_event_handler() function lacks a check for an already pending qentry before storing a new one for CONFIRM_LINK and ADD_LINK_CONT. A malicious or buggy peer can send a second request, causing the pointer to be overwritten without freeing the previous allocation, leading to a memory leak (kmalloc-96).

In the Linux kernel devlink_nl_reload_doit() function, there is a net namespace reference leak. When the requested namespace differs from the current one and the reload action is not DRIVER_REINIT, the function returns -EOPNOTSUPP without releasing the reference obtained by devlink_netns_get().

In the Linux kernel amdxdna_insert_pages() function in the accel/amdxdna driver, there is a BUG_ON vulnerability. The vm_flags_mod() call sets VM_MIXEDMAP and clears VM_PFNMAP, allowing an unprivileged process to call madvise(MADV_DONTNEED) on a mapped GEM object, and subsequent memory access triggers BUG_ON in vmf_insert_pfn_prot() due to pfn_valid(pfn) and VM_MIXEDMAP.

In the Linux kernel, AF_XDP allows user space to change metadata flags after request processing. Rereading them during completion can make the kernel write a timestamp that was not requested when the packet was submitted. The fix clears the metadata pointer during request processing unless timestamp completion is requested.

In the Linux kernel, the bnge driver has a NULL pointer dereference vulnerability in the auxiliary device release function. If allocation of auxr_dev fails during auxiliary device setup, the error path calls auxiliary_device_uninit(), which eventually invokes bnge_aux_dev_release(). The release callback unconditionally dereferences aux_priv->auxr_dev->pdev, causing a NULL pointer exception.

In the Linux kernel, the DRM/Xe driver has a memory leak in exec_queue_set_hang_replay_state(). The q->replay_state is blindly overwritten, potentially leaking memory previously allocated by vmemdup_user(). The fix returns an error if q->replay_state is not empty.

In the Linux kernel, the mlx5e network driver has a vulnerability due to incorrect BQL reset on SQ re-activation. mlx5e_activate_txqsq() unconditionally calls netdev_tx_reset_queue(), zeroing BQL counters of channels with in-flight TX WQEs, leading to BUG_ON in dql_completed().

In the Linux kernel, the net/ncsi module has a heap out-of-bounds read vulnerability. The ncsi_send_cmd_nl() function does not validate the payload length from the packet header, allowing an attacker with CAP_NET_ADMIN to read up to 64KB of kernel memory and leak information.

In the Linux kernel, the prestera driver lacks validation of the firmware header length. The prestera_fw_hdr_parse() function reads the header before checking that the firmware image contains that header, which could lead to out-of-bounds read.

A vulnerability in the Linux kernel's rqspinlock mechanism was found, where the queue tail is not reset when an ABBA deadlock is detected. This can cause a thread to wait indefinitely for a next waiter that never arrives, leading to intermittent or permanent system stalls.

In the Linux kernel, the ltc4282 hwmon driver has a vulnerability where negative current values are cast directly to u64, leading to large positive values and then overflow and random values after division. These values are then clamped to the maximum limit instead of zero.

In the Linux kernel, the ALSA usb-audio driver has an out-of-bounds write vulnerability when handling inbound USB transfers of Format Type II. The issue is caused by incorrect calculation of the transfer buffer size, which is one packet too small, leading to writes beyond the allocated memory.

In the Linux kernel, the usb: misc: usbio driver has a vulnerability where in usbio_bulk_msg() the EMSGSIZE check compares ibuf_len (receive buffer size) with txbuf_len (transmit endpoint size) instead of rxbuf_len. When these sizes differ, the check is incorrect.

In the Linux kernel's cxacru driver for USB ATM devices, a vulnerability was found due to improper URB management. During an error in cxacru_cm(), the active rcv_urb is not killed, which can lead to a warning in usb_submit_urb() and potential system stability issues.

In the Linux kernel, the usb: gadget: f_ncm driver has a vulnerability where the variable ndp_index is declared as signed, but it stores the return value of get_ncm(), which is unsigned. A malicious host can supply a large offset that overflows the signed ndp_index, making it negative, which bypasses sanity checks and leads to an out-of-bounds read when calculating the address of the NDP block.

A use-after-free vulnerability was found in the Linux kernel's ipheth driver for iPhone USB devices, caused by improper re-arming of carrier_work after interface close or device disconnect. This leads to accessing freed memory, potentially causing a kernel crash or memory corruption.

In the Linux kernel, the IMA module's xattr_verify() has a bug in the digest length check, leading to an out-of-bounds read for truncated xattrs.

In the Linux kernel Open vSwitch, when updating a flow with a UFID that misses and falls back to key lookup, the preallocated reply may be too small. This can cause -EMSGSIZE and trigger BUG_ON in the update path.

In the Linux kernel bridge MRP subsystem, br_mrp_alloc_test_skb() builds MRP test frames on an skb from dev_alloc_skb(), which does not clear the linear data area. In the MRA ring-role branch, three bytes remain uninitialized in every MRP_Test frame.

A vulnerability in the Linux kernel futex mechanism involves a race condition during robust futex exit. The previous fix (ca16d5bee598) was insufficient, allowing lost wakeup notifications when another thread re-acquired the futex via the fast path. This could cause waiting threads to sleep forever on a free futex.

In the Linux kernel's 8250_dma driver, serial8250_release_dma() terminates RX DMA and releases the channel but leaves rx_running set. On port reopen, the stale state causes a NULL channel to be passed to dmaengine_pause(), leading to a kernel Oops.

In the Linux kernel's DAMON_LRU_SORT module, there is a division by zero vulnerability when the active_mem_bp parameter is set to a value greater than 10000. The target value for cold memory is calculated as '10000 - active_mem_bp + 2', which becomes zero for 10002, causing a divide error. The fix returns an error when starting DAMON with >10000.

A vulnerability in the Linux kernel's DAMON_SAMPLE_MTIER sample module allows a user to trigger a division by zero in damos_quota_score(). This occurs when the node0_mem_free_bp or node0_mem_used_bp parameter is set to zero, leading to a kernel Oops and potential system crash.

In the Linux kernel's ALSA USB driver, there is a use-after-free (UAF) vulnerability in delayed release of MIDI2 endpoints. The previous fix for UAF in ump_to_endpoint() causes another UAF because it tries to dereference the UMP endpoint object, which may already be released in a delayed context. The fix adds private_free to clear associated data.

In the Linux kernel, the ALSA driver for the us144mkii device has a use-after-free vulnerability. When resubmitting capture URBs in capture_urb_complete(), the URBs were not re-anchored, leaving the anchor list empty after the first completion. This caused cleanup functions like tascam_free_urbs() to fail to stop the URBs, leading to writes to freed memory and dereferencing of a freed driver object.

A race condition between event_define_fields() and update_event_fields() in the Linux kernel was found during concurrent module loading. Lack of event_mutex protection for the event field list in trace_event_update_all() can lead to a kernel panic.