Linux kernel vulnerabilities

In the Linux kernel, the drm/sun4i driver's of_find_device_by_node() takes a device reference for the TCON TOP device that is not dropped after mux configuration completes. This results in a device reference leak.

In the Linux kernel, the drm/sun4i driver's sun4i_crtc_init() returns plain NULL on layer initialization failure, while other error paths return an error pointer. The caller sun4i_tcon_bind() checks with IS_ERR(), so it continues with tcon->crtc set to NULL, leading to a NULL dereference in drm_crtc_mask() and an oops.

In the Linux kernel, the imx6q cpufreq driver allocates the imx6_soc_volt array via devm_kcalloc() against cpu_dev, which is never unbound, so its devres list is never released and the remove function does not free the array. Every probe adds an allocation that persists for the system lifetime.

In the Linux kernel, the imx6q cpufreq driver allocates the imx6_soc_volt array fresh on every probe, but fills it through soc_opp_count, which has static storage and is never reset. A second bind after an unbind keeps indexing from where the first stopped, writing past the end of the new array.

In the Linux kernel on arm64, swsusp_arch_suspend() returns with DAIF masked when swsusp_mte_save_tags() fails, which is unexpected. The fix restores the saved DAIF state before returning from the error path.

In the Linux kernel, the Sunplus PHY driver has improper error handling in sp_uphy_init(). The error paths do not correctly undo operations: on clk_prepare_enable() failure it returns directly, on reset_control_deassert() failure it releases only the clock, and on update_disc_vol() failure it jumps to err_reset to release clock and reset. The fix cleans up these paths.

In the Linux kernel, the QLogic SCSI driver (qla2xxx) has a redundant VPD flash read in the sysfs read path. qla2x00_sysfs_read_vpd() calls read_optrom() a second time after releasing optrom_mutex. This repeated read is redundant and runs without the mutex, exposing flash access to concurrent operations. The fix removes the duplicate call.

In the Linux kernel, the firmware_loader has an issue with queueing completed sysfs fallback requests. fw_load_sysfs_fallback() calls device_add() before adding fw_priv to pending_fw_head. This allows a userspace helper to complete the request before it is queued, leading to queueing an already-completed request and potential fault on the next request. The fix checks if the request is already done and does not queue it.

In the Linux kernel, hugetlbfs has an issue with subpool release on fill_super failure. hugetlbfs_fill_super() allocates a hugepage subpool, and if root dentry creation fails, the error path frees the subpool with kfree(), bypassing hugepage_put_subpool() and potentially leaving min_size reservations. The fix uses hugepage_put_subpool() on the failure path.

In the Linux kernel, the qcom qmp-usb-legacy PHY driver has a flaw where the runtime suspend callback may run after pm_runtime_enable() but before pm_runtime_forbid(). This causes a dereference of the uninitialized qmp->phy pointer and a crash. It can also occur if a user re-enables runtime-pm via sysfs before the PHY is initialized.

In the Linux kernel, the qcom snps-femto-v2 PHY driver enables runtime PM before creating the PHY, while runtime PM callbacks dereference the not-yet-ready hsphy instance. This leaves a window where a suspend callback can trigger a NULL pointer dereference. The fix takes a runtime PM usage reference with pm_runtime_get_noresume() before enabling runtime PM and releases it once the PHY is created.

In the Linux kernel, the qcom qmp-usb PHY driver has a flaw where the runtime suspend callback may run after pm_runtime_enable() but before pm_runtime_forbid(). This causes a dereference of the uninitialized qmp->phy pointer and a crash. It can also occur if a user re-enables runtime-pm via sysfs before the PHY is initialized.

In the Linux kernel, the md/raid5 subsystem's raid5_bitmap_sector_map() aligns the array range to full RAID5 stripe widths before converting to component sectors. That width is not always a power of two, so the old round_down()/round_up() logic produces incorrect ranges. The fix uses sector_div()-based arithmetic so the rounded range matches the actual RAID5 stripe width.

In the Linux kernel, the md subsystem's __md_stop() destroyed the bitmap before calling mddev_detach(), causing mddev_detach() to skip bitmap_ops->wait_behind_writes(). With llbitmap, RAID1 behind-write completions could then run after llbitmap storage had been freed. The fix calls mddev_detach() before md_bitmap_destroy().

In the Linux kernel, the md/md-llbitmap subsystem's llbitmap_create() publishes mddev->bitmap before reading the bitmap superblock. If llbitmap_read_sb() fails, the old cleanup freed llbitmap before clearing mddev->bitmap, so readers such as /proc/mdstat could observe a stale pointer. The fix clears mddev->bitmap while holding bitmap_info.mutex.

In the Linux kernel, the md/md-llbitmap subsystem's llbitmap_destroy() deletes pending_timer before flushing md_llbitmap_io_wq, but daemon_work can still be queued or running and rearm pending_timer. If this happens during teardown, the timer can remain armed after llbitmap is freed and later dereference freed memory. The fix adds a BITMAP_SHUTDOWN bit and uses timer_shutdown_sync().

In the Linux kernel, the md/raid1 subsystem's raid1_takeover() sets conf->array_frozen = 1 on the newly allocated r1conf and never clears it, so every I/O to the array stalls permanently once _wait_barrier() sees it stuck at 1. This used to be harmless because level_store() called mddev_resume(), but commit b39f35ebe86d removed that call. The fix simply does not set array_frozen in raid1_takeover().

In the Linux kernel, the coresight etm4x driver's use of (nrseqstate - 1) in the loop initializing or setting TRCSEQEVR<n> can cause an underflow when TRCIDR5.NUMSEQSTATE is 0b000. The fix introduces an nr_seq_ctrls field and an ETM_MAX_SEQ_TRANSITIONS macro and applies them to TRCSEQEVR<n> field setup.

In the Linux kernel, the coresight etm4x driver's perf enable path is missing calls to cscfg_csdev_disable_active_config() in two cases: when branch broadcast is selected but unsupported by hardware, and when etm4_enable_hw() fails. This leads to a leak of config_desc->active_cnt. The fix calls cscfg_csdev_disable_active_config() in these error paths.

In the Linux kernel, the BRBE driver (arm_pmuv3) does not initialize the hw_id field in the perf branch stack structure, even though it is passed to userspace. According to documentation, this field should be 0 for architectures storing raw branch records in age order.

In the Linux kernel, the arm_mpam driver causes a NULL pointer dereference when a user unbinds an MSC after mpam_disable() has run in response to an error interrupt. mpam_disable() sets drvdata to NULL, and the driver remove callback does not check this state.

In the Linux kernel, the arm_mpam driver allows unbinding an MSC via sysfs, which can lead to a use-after-free. When the unbound MSC is the last one for a component, the mpam_component structure is freed and later accessed by resctrl_arch_get_config() when reading the schemata file.

A vulnerability was found in the Linux kernel BPF verifier regarding load-acquire instructions (BPF_LOAD_ACQ). Unlike a regular BPF_LDX, load-acquire is not rewritten to BPF_PROBE_MEM, so the JIT emits a plain load with no exception table entry, causing a kernel panic on fault instead of being handled. This affects pointer types requiring fault protection, such as PTR_TO_BTF_ID and PTR_TO_MEM | MEM_RDONLY | PTR_UNTRUSTED.

In the Linux kernel, the scsi: sd driver leaks a special_vec mempool page when scsi_alloc_sgtables() fails in sd_setup_unmap_cmnd() or sd_setup_write_same{10,16}_cmnd(). The SCSI midlayer does not call uninit_command() because RQF_DONTPREP is not yet set, causing the page leak.

In the Linux kernel, in the btrfs filesystem on zoned devices, btrfs_delayed_refs_rsv_refill() returns -EAGAIN when over-committed metadata exceeds the usable size in a metadata block-group. If this occurs during reclaim, the transaction is aborted even though -EAGAIN is a transient condition.

A vulnerability in the Linux kernel's Btrfs filesystem can lead to overlapping ordered extents, causing a kernel panic. The issue arises from an unexpected isize revert after a short direct IO, which skips waiting for existing ordered extents during buffered writes.

In the Linux kernel, in the btrfs filesystem, POSIX ACLs can be set even when the root has the read-only property set. The set_acl code path does not check the root's read-only flag because the relevant check was removed in commit 353c2ea735e4.

In the Linux kernel, in the btrfs filesystem, btrfs_read_merkle_tree_page() can find a folio that is not uptodate. After locking the folio, the code treats this as a read error and returns -EIO, making a transient read failure sticky. The fix retries the Merkle item read when a not-uptodate folio is found and unlocks the folio on read_key_bytes() failure.

In the Linux kernel, the btrfs filesystem on zoned devices has a bug that intermittently aborts transactions and forces the filesystem read-only. The issue occurs during metadata-heavy relocation when btree_writepages() encounters an active block group at a higher logical address, leading to -EAGAIN and transaction abort. The fix flushes active metadata and system block groups at the start of btree_writepages() to avoid deadlock and ensure forward progress.

In the Linux kernel, in the btrfs filesystem, the function qgroup_free_reserved_data() has an incorrect length calculation. Using round_up(start + len, sectorsize) gives the rounded end position instead of the length, leading to an oversized length and incorrect calculations. The fix introduces local variables aligned_start and aligned_len.

In the Linux kernel, in the pinctrl driver for Airoha chips, the .irq_request_resources hook is missing. Without it, gpiolib cannot set the GPIOD_FLAG_USED_AS_IRQ flag, breaking pin direction locking and potentially allowing reconfiguration of an active IRQ pin as an output.

In the Linux kernel, in the Bluetooth virtio_bt driver, virtbt_setup_zephyr() passes the response to Zephyr command 0xfc08 as a "%s" string without length checking, potentially causing an out-of-bounds read of adjacent memory. The fix limits printing to skb->len - 1 using "%.*s".

In the Linux kernel, in Bluetooth hci_sync, the advertising instance allocated in adv_timeout_expire() is not freed on error or cancellation paths, leading to memory leaks. The fix frees the buffer from a destroy callback and in the caller when the entry could not be queued.

In the Linux kernel, in Bluetooth MGMT, the mesh_send_cancel() command is queued with a NULL destroy callback, leading to memory leaks when the entry is cancelled. The leak also pins the socket reference, so the MGMT socket is never released. The fix frees the command from a destroy callback.

In the Linux kernel's Bluetooth MGMT subsystem, there is a memory leak when an HCI command is cancelled. The command is not freed, leading to memory leak and holding a reference to the mgmt socket that is never released.

In the Linux kernel's Bluetooth subsystem (MSFT), the length of the event prefix (evt_prefix_len) is not validated against the actual response length. A controller can declare a length up to 255 bytes, and the kernel will copy data beyond the response, leading to reading unauthorized data.

In the Linux kernel's BPF and cgroup subsystem, there is a null-ptr-deref bug after replacing a program. When program A (empty) is replaced by program B using BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE, the required storage is not allocated, leading to a panic when the new program is kicked.

In the Linux kernel's iio: light: gp2ap002 driver, there is unbalanced runtime PM management on repeated event writes. Double enabling leaks a runtime PM reference, and double disabling underflows the usage count and triggers a warning.

A bug was fixed in the Linux kernel's net/sched cls_api regarding teardown of an adopted proto when losing an insert race. When a request loses the race in tcf_chain_tp_insert_unique(), tp_created was not cleared, causing the error path to delete an active classifier belonging to the winning request. A tri-state variable was introduced to track the insert step outcome.

In the Linux kernel's BPF subsystem, there is a mmap_lock leak in the irq_work path. A nested caller can reuse the slot before the first caller queues it, leading to double locking of mmap_lock and a lock leak, blocking exit_mmap().

In the Linux kernel's fbdev: kyro driver, there is a lack of validation of overlay viewport coordinates. Large input values can cause 32-bit arithmetic wraparound, leading to incorrect coordinates passed to SetOverlayViewPort().

In the Linux kernel's iommu/vt-d subsystem, there is an iopf_refcount leak when replacing a domain at the RID level. The functions identity_domain_attach_dev() and blocking_domain_attach_dev() do not disable IOPF for the old domain, leading to a reference leak. As a result, the count never drops to zero, triggering a WARN_ON when the device is released.

In the Linux kernel's media: amd: isp4 driver, the function isp4if_alloc_fw_gpumem() does not release previously allocated GPU memory pools when a subsequent allocation fails. This causes a memory leak. The fix releases already-allocated pools before returning an error.

In the Linux kernel's media: amd: isp4 driver, the function isp4sd_pwron_and_init() causes a deadlock in the error path by re-acquiring the ops_mutex it already holds. The fix changes error handling to release resources in stages, avoiding the deadlock and other issues like runtime-PM underflow.

In the Linux kernel's nvme-pci driver, descriptor DMA pools are not released on probe failure after the admin tag set is allocated. This causes a leak of dma_pool objects. The fix adds pool release in the out_disable error path.

The vulnerability in the Linux kernel affects the AMT (Automatic Multicast Tunneling) driver. It allows creating AMT devices on a lower device in a different network namespace, leading to a kernel warning and system hang during device unregistration. The fix forbids such cross-netns setup.

In the Linux kernel NFC LLCP subsystem, nfc_llcp_getsockopt() always stores 4 bytes via put_user() regardless of the caller-supplied optlen. A call with optlen < 4 writes past the user buffer, violating the getsockopt(2) contract. The fix rejects calls with optlen < sizeof(u32), with an explicit check for negative values.

In the Linux kernel, the NFC pn533 driver has a use-after-free bug. __pn533_send_async() publishes the command and then calls send_frame(), while the I2C threaded IRQ can concurrently complete the command and free the skb before the transport finishes using it.

In the Linux kernel, the NFC NCI functions parsing the CORE_INIT_RSP packet do not validate the skb length. A malformed response can declare a large number of RF interfaces with insufficient data, causing reads of uninitialized memory.

In the Linux kernel, the ALSA seq bounce_error_event() embeds a data.ext.ptr pointer in the bounce payload that reaches userspace. This leaks a kernel address (8 bytes on 64-bit) even though the event header read path clears it.