Linux kernel vulnerabilities

A vulnerability in the Linux kernel's KVM for x86 was found, involving delayed EOI (End of Interrupt) processing by the I/O APIC. If the delayed EOI work is processed after vCPUs are destroyed, a use-after-free (UAF) occurs, potentially leading to system crash or code execution.

In the igbvf driver, there is a memory leak in TX DMA error cleanup. Due to an off-by-one error, if some mappings succeed and then an error occurs, one DMA mapping (the head) is not unmapped, causing a leak.

A use-after-free vulnerability was found in the Linux kernel's SMC network module during link group termination. The issue arises from insufficient socket protection against concurrent close, potentially leading to memory corruption.

In the Linux kernel, the bridge module has a bug in br_multicast_leave_group() that can lead to a use-after-free after deleting a port group during fast-leave multicast handling.

In the Linux kernel, the UML vector driver has a use-after-free bug in vector_mmsg_rx() when a packet with an invalid header is discarded. The freed skb remains in the buffer, leading to double-free and potential exploitation.

In the Linux kernel, the veth interface has a vulnerability in handling frag_list skbs before running XDP. Frag_list skbs can have data_len set but empty frags[], leading to bogus XDP fragment metadata and a crash in AF_XDP copy mode.

In the Linux kernel, the vxlan module's route_shortcircuit() function reads the neighbour hardware address n->ha without holding the seqlock, which can lead to torn reads or partially updated MAC addresses.

In the Linux kernel, the vxlan module's vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get() functions use pskb_may_pull() instead of pskb_network_may_pull(), which does not account for the MAC header offset and can leave part of the network header in non-linear frags.

In the Linux kernel, the vxlan module's route_shortcircuit() function uses pskb_may_pull() instead of pskb_network_may_pull(), which does not account for the MAC header offset and can lead to reading beyond the pulled linear buffer when accessing IP header fields.

In the Linux kernel's iommu/vt-d subsystem, the Present bit is not cleared before tearing down a scalable-mode context entry, creating a window where hardware can fetch a torn entry, leading to unpredictable behavior or spurious faults. The issue affects device_pasid_table_teardown(), which was not aligned with a previous fix.

In the Linux kernel's rxrpc subsystem, lack of synchronization between rxrpc_kernel_charge_accept and socket teardown can lead to use-after-free. A concurrent rxrpc_discard_prealloc can free the rxrpc_backlog structure while a preallocation worker still uses it.

In the Linux kernel's rxrpc subsystem, when reading an OOB message with MSG_PEEK, the message is moved to the pending_oobq queue even though it should not be removed from the queue. This leads to double-free and use-after-free, potentially causing memory corruption.

In the Linux kernel's rxrpc subsystem, rxgk_issue_challenge() frees the page containing the challenge content after invoking the tracepoint, but the whdr pointer passed to the tracepoint points into the just-freed page, leading to use-after-free.

In the Linux kernel, the rxrpc subsystem fixed a double unlock in rxrpc_recvmsg() when handling OOB messages.

In the Linux kernel, the AFS subsystem fixed a netns teardown issue to cancel the preallocation charger. afs_charge_preallocation() skips charging when net->live is false, and afs_rx_new_call() avoids requeuing the charger.

In the Linux kernel, vxlan_gro_prepare_receive() has a potential null pointer dereference when sk_user_data is set to NULL during execution. This could lead to a system crash.

In the Linux kernel, the DLM module has an issue with the ordering of message handles in the send_queue, which can lead to refcounting issues and use-after-free. An attacker could exploit this to crash the system.

In the Linux kernel, addrconf_dad_failure() in IPv6 could overwrite DEAD state with ERRDAD, leading to use-after-free and system crash. The fix checks the state before transitioning to ERRDAD and performs operations in a single critical section.

In the Linux kernel, in the RDMA/srpt driver, the immediate data length check did not check for integer overflow, allowing a malicious initiator to bypass bounds check and pass ~4GB length to sg_init_one(). The fix uses check_add_overflow().

A vulnerability was found in the Linux kernel's nvme-multipath driver. The nvme_ns_head structure has a flexible array current_path[] indexed by NUMA node ID. Memory allocation used num_possible_nodes, which on systems with sparse NUMA IDs (e.g., POWER9) leads to out-of-bounds access (slab-out-of-bounds).

In the Linux kernel, the md/raid10 driver has been fixed to reset read_slot when reusing r10bio for discard. If the r10bio was previously used for a read, read_slot could be non-negative, causing the cleanup to skip bio_put() on repl_bio.

In the Linux kernel, a vulnerability in the NVMe driver has been fixed regarding an incorrect bounds check for the fdpcidx index in the FDP (Flexible Data Placement) mechanism. The bug used > instead of >=, incorrectly accepting an index equal to NUMFDPC + 1.

In the Linux kernel, a vulnerability in the OCFS2 filesystem was found due to missing validation of fast symlinks during inode read. A corrupted inode with a zero-cluster symlink can cause an out-of-bounds read beyond the inode block buffer, leading to a use-after-free error.

In the Linux kernel, a vulnerability in the RDMA/siw driver was fixed that caused a use-after-free when disassociating a socket from an endpoint. The issue occurred during processing of a malformed MPA request, potentially leading to closure of the new endpoint and access to freed memory.

In the Linux kernel, the lockd service's nlm4svc_lookup_file() function uses uninitialized bytes in file_hash() when the file handle length is less than LOCKD_FH_HASH_SIZE. This causes the same handle to hash to different buckets, leading to lookup failures. The fix zeroes only the tail bytes that file_hash() would otherwise consume.

A vulnerability in the Linux kernel's vhost-net allows zerocopy ubufs to be completed multiple times. Cloning skbs by the network stack (e.g., batman-adv) increments the ubuf_info refcount, but vhost_zerocopy_complete() treats every callback as a completed descriptor, leading to use-after-free.

In the Linux kernel, the vdpa/octeon_ep driver's interrupt handler looks up the IRQ index in oct_hw->irqs instead of assuming irq - irqs[0]. The fix supports non-contiguous IRQ numbers and avoids incorrect ring indexing.

In the Linux kernel, the SCTP functions sctp_verify_asconf() and sctp_verify_param() do not validate that the embedded address parameter length fits within the outer parameter bounds. This can lead to out-of-bounds reads when processing malformed INIT or ASCONF packets.

In the Linux kernel Marvell OcteonTX crypto driver, the DMA cleanup path used the wrong loop index, leaking mapped entries and repeatedly unmapping the failed one.

In the Linux kernel Cavium CPT crypto driver, the DMA cleanup error path used the wrong loop index, leaking mapped entries and repeatedly unmapping the failed one.

A vulnerability in the Linux kernel's bnxt driver causes an underflow when building the skb head during XDP head-grow operations. This leads to corrupted page reference counts, potentially causing premature recycling and double-free of memory.

In the Linux kernel, the TCP subsystem clears sock_ops cb flags before force-closing a child socket. A child socket inherits the listener's bpf_sock_ops_cb_flags, and if its setup fails, it may be closed without holding the lock, leading to a warning in tcp_set_state(). The fix clears these flags at a common point to avoid BPF callbacks on an unestablished socket.

In the Linux kernel, the net/sched/sch_codel module has a vulnerability where qdisc_tree_reduce_backlog is called during peek before qlen is restored. This can lead to incorrect deactivation of the parent class, causing a system crash (e.g., wild memory access) when qfq is used with codel as a child.

In the Linux kernel, the tipc_l2_send_msg() function has a use-after-free (UAF) vulnerability. The issue arises because tipc_disable_l2_media() calls synchronize_net() while the media_ptr pointer is still valid, allowing concurrent RCU readers to obtain the device pointer after synchronization, and then the device can be freed while still in use.

In the Linux kernel, in the RDMA/bnxt_re driver, the function bnxt_qplib_alloc_dpi returns success even when ioremap fails. Proper rollback is added for ioremap failure and -ENOMEM status is returned.

In the Linux kernel, in the RDMA/bnxt_re driver, applications can request multiple WC pages for the same ucontext, but only one WC page per ucontext is currently supported. A lock is added to avoid concurrent access and a check to fail repeated requests. Also, if the mmap entry insert fails for the WC, the Doorbell page index mapped for the WC page is freed.

In the Linux kernel, in the RDMA/irdma driver, the waitqueue and request_done flag are replaced with a completion. The previous use of the flag without proper memory barriers could lead to concurrency issues. Using a completion solves this problem in a purpose-built way.

In the Linux kernel, in enqueue_to_backlog(), there is a TOCTOU race related to the lockless netif_running() check. The check is moved inside the backlog lock, serializing it with the flush operation and preventing the use-after-free reported by syzbot.

A race condition was found in the Linux kernel's 9p/RDMA driver (trans_rdma.c) affecting the rdma->state field. The field is modified without req_lock in recv_done() and p9_cm_event_handler(), while rdma_request() uses the lock. This can lead to lost state transitions, corrupted connection state machine, and use-after-free of RDMA request objects during teardown.

In the Linux kernel, the NTFS3 filesystem has an issue with error handling during file rename. Instead of calling _ntfs_bad_inode() when rename fails, the driver uses WARN_ON, which does not prevent further operations on the inconsistent inode. The fix replaces WARN_ON with a call to _ntfs_bad_inode() to prevent further operations on the corrupted inode.

In the Linux kernel, a vulnerability was found in the xprtrdma subsystem related to improper lifecycle management of RPC requests. The issue was that a single reference counter (rl_kref) served two distinct lifetimes, which could lead to freeing a send buffer while the HCA might still be DMA-reading from it. The fix decouples these lifetimes by adding separate references for the RPC layer and the send side, ensuring the request returns to the free pool only after both owners have released it.

A vulnerability was found in the Linux kernel's NFS subsystem regarding protection of the file lock list. The issue involves improper use of flc_lock during iteration over the lock list, which may lead to use-after-free (UAF). The fix switches to using nfsi->rwsem for protection and moves the locks_lock_inode_wait call to avoid deadlocks.

In the Linux kernel's xprtrdma module, a vulnerability causes receive buffer leaks and Receive queue exhaustion. Improper decoding of short or malformed replies can misclassify frames as backchannel calls, leading to orphaned buffers and failure to repost receive slots.

In the Linux kernel's xfrm subsystem, a use-after-free vulnerability exists during async resumption. xfrm_rcv_cb may change skb->dev to a tunnel device without taking a reference, and subsequent resumption decrements the tunnel device's refcount, leading to use-after-free and refcount leak.

In the Linux kernel's xfrm module, there is a race during state cache insertion. The state validity check occurs before acquiring the global xfrm_state_lock, allowing a dead state to be inserted into the cache.

In the Linux kernel, the netfilter flowtable module has a vulnerability related to IP6IP6 tunnel handling. The function nf_flow_ip6_tunnel_proto() uses skb_header_pointer() instead of pskb_may_pull(), which may lead to incorrect packet processing. Additionally, the handling of extension headers was simplified, which may affect correctness.

In the Linux kernel, the netfilter/ipset module used test_bit() in lockless RCU readers in hash types, which is a relaxed atomic operation without memory barrier guarantees. It was replaced with test_bit_acquire() where the operation may run concurrently with add/del/gc.

In the Linux kernel, in ipv6: ioam, there is a type confusion of dst_entry. IOAM uses a dummy dst_entry (null_dst) to mark that the destination should not be changed, but this dst is stored in the IOAM lwt state and may be passed to dst_cache_set_ip6(), leading to invalid cast and potential invalid memory access.

In the Linux kernel, the ksmbd (SMB server) module has a use-after-free vulnerability in the conn->preauth_info structure during concurrent SMB2 NEGOTIATE requests. One thread can free the memory while another thread in the response send path still uses it, leading to a use-after-free read (confirmed by KASAN).

In the Linux kernel IPv4 FIB, when CONFIG_IP_MULTIPLE_TABLES is enabled but no rule is added, fib_lookup() performs route lookup directly on two tables. Since the first lookup does not properly bail out, the result of an error route in the merged local/main table could be overwritten by another route in the default table. The fix corrects this inconsistent behavior so that the error route is respected.