Linux kernel vulnerabilities

In the Linux kernel cfg80211 Wi-Fi subsystem, an out-of-bounds access can occur during multi-link element defragmentation due to incorrect length calculation.

In the Linux kernel's MTK PMIC keys driver (mtk-pmic-keys), a null pointer dereference vulnerability was found. The issue occurs when a button is not defined in the device tree (e.g., left floating), causing the code to access an uninitialized regs pointer.

In the Linux kernel, a vulnerability was found in the x86 memory management switching code. During a specific window between setting the new CR3 and updating the 'loaded_mm' pointer, the should_flush_tlb() function incorrectly suppresses TLB flushes, potentially allowing stale page translations to be used.

In the Linux kernel, a vulnerability in KVM for SVM was found where SHUTDOWN interception does not force leaving SMM mode before sending INIT. This triggers a WARN and potential security issues, as INIT is blocked in SMM, leading to undefined behavior.

In the ksmbd SMB server in the Linux kernel, renaming a file to an empty string causes a kernel oops in d_alloc.

In the Linux kernel's SMB client, a race condition exists in open_cached_dir with lease breaks. A valid cfid entry may be considered invalid, causing a dentry reference leak if allocation occurs before the queued lease break work runs.

In the ksmbd SMB server in the Linux kernel, a use-after-free vulnerability exists in __close_file_table_ids due to a race condition between threads.

In the Linux kernel xenbus subsystem, a race condition in request lifetime management was found. After wake_up() is called, another thread may free the request memory (kfree) before xenbus_thread uses it, causing a null pointer dereference.

In the ksmbd SMB server of the Linux kernel, a missing write offset validation was found in ksmbd_vfs_stream_write(). If *pos was greater than or equal to stream length, an out-of-bounds memory write could occur.

A bug was found in the Linux kernel PHY driver for phylink-managed network interfaces. During system resume from suspend, the PHY state machine is not properly stopped, triggering a WARN_ON warning and potentially incorrect operation. The issue affects DSA drivers and other network drivers using phylink that do not set the mac_managed_pm flag.

In the Linux kernel's ath12k Wi-Fi driver, a bug was found where the wrong function is used to fetch entries from the destination ring in ath12k_dp_mon_srng_process. A source ring function was used, leading to incorrect pointer arithmetic and ring management, potentially causing data corruption or system crashes.

In the Linux kernel's ath12k Wi-Fi driver, a vulnerability was found due to missing packet length validation before processing in ath12k_dp_rx_h_undecap_nwifi. Hardware may deliver packets exceeding the maximum native Wi-Fi header length, leading to invalid data access and potential memory corruption.

In the Linux kernel, a vulnerability was found in the trace event format verifier. The verifier ignored formats containing "%*p..", which could lead to references to memory that was freed before the event was read, causing a kernel crash. The fix extends verification to cover these cases.

A vulnerability was found in the Linux kernel's PEBS (Precise Event-Based Sampling) mechanism for KVM guests. During VM-Entry, the MSR_IA32_PEBS_ENABLE value was not masked with the guest's desired value, potentially enabling PEBS unexpectedly. This caused a flood of page faults (#PF) and guest crashes.

In the Linux kernel, a vulnerability in Btrfs causes tree log corruption on machines with 64k page size and 16k node size. The issue is due to incorrect subpage bitmap bit calculation during metadata block writeout, leading to skipped writes of dirty blocks.

In the Linux kernel, a vulnerability in the trace_seq_to_buffer() function allows an out-of-bounds write. The function may copy more data than the buffer size, leading to memory corruption.

In the Linux kernel, the VXLAN driver (vxlan) has a bug where the default FDB entry is deleted without holding the hash lock when deleting a VNI in vnifilter mode. This triggers a lockdep warning and potential synchronization issues.

In the Linux AF_XDP generic RX path, a race condition occurs when multiple sockets share the same xsk_buff_pool in umem mode. The rx_lock is moved from xsk_socket to xsk_buff_pool to protect both queues.

In the Linux kernel's btusb Bluetooth driver, a vulnerability was found leading to a NULL pointer dereference in skb_dequeue() when processing a QCA firmware crash dump. The handle_dump_pkt_qca() function returned 0 instead of a negative error code, causing double processing of the packet and a NULL dereference.

In the Linux kernel's mtk-star-emac driver, a spinlock recursion bug occurs during RX/TX polling when DMA interrupts are re-enabled. This causes a deadlock on the same spinlock, leading to system hangs.

In the Linux kernel's DRR (Deficit Round Robin) network scheduler, a vulnerability was found causing a double addition of a class to the active list when a netem child qdisc causes reentrant enqueue in the parent. This leads to memory corruption. The fix adds a check whether the class is already on the active list before adding.

In the Linux kernel, the ETS queuing discipline (net_sched: ets) has a double list add bug when netem is a child qdisc. Reentrancy in enqueue causes the class to be added twice to the active_list, leading to memory corruption.

In the Linux kernel, a double list addition of a class to the active list was found in the QFQ network scheduler when netem is used as a child qdisc. This causes memory corruption.

In the Linux kernel's bnxt_en driver, a vulnerability was found during ethtool -w operation where memory corruption occurs due to out-of-bounds memcpy(). The __bnxt_get_coredump() function may copy DMA data exceeding the destination buffer size, causing memory corruption.

A memory leak was found in the Linux kernel's lan743x driver. When GSO is enabled and the fragment count is zero, the skb is mapped to the EXT descriptor instead of the LS descriptor, preventing its deallocation.

In the Linux kernel, a bug in unaccount_slab() fails to clear slab->obj_exts when memory allocation profiling is disabled at runtime or due to an error, causing bad page state and cgroup charge warnings.

In the Linux kernel, a race condition was found between io_uring_cmd_complete_in_task and ublk_cancel_cmd in the ublk driver. Canceling a command may conflict with scheduled task work, leading to a kernel crash. The fix prevents cancellation if the ublk block request has already started.

In the AMD GPU driver (amdgpu) in the Linux kernel, a use-after-free vulnerability was found in the HDCP code. Pointers to amdgpu_dm_connector objects are copied without incrementing kref reference counts, so when a USB-C dock is unplugged, the objects are freed, leaving dangling pointers that are later dereferenced, causing a crash.

In the Linux kernel, the irqchip/qcom-mpm driver lacks a GPIO_NO_WAKE_IRQ check, causing a crash when handling interrupts for non-wake GPIOs. This occurs on Qualcomm chipsets where not all GPIOs have a corresponding MPM pin.

In the Linux kernel, in ksmbd, there is a use-after-free vulnerability during session logoff. The sess->user object can be in use by another thread, for example when another connection sends a session setup request to bind to the session being freed. The patch fixes this issue.

In the Linux kernel, the ALSA UMP subsystem has a buffer overflow during SysEx message conversion from MIDI 1.0 to UMP. The conversion function used a buffer too small (4 bytes) for the SysEx format, which can require up to 6 bytes, leading to overflow and potential memory corruption.

In the Linux kernel, the HFSC network scheduler has a use-after-free vulnerability when an HFSC class has a netem child qdisc. The check cl->qdisc->q.qlen == 0 does not guarantee the class hasn't been inserted into vttree/eltree, leading to double insertion and UAF.

In the Linux kernel's pds_core driver, an uninitialized stack variable fw_list leads to data leakage and potential crash when running the 'devlink dev info' command. An unsupported PDS_CORE_CMD_FW_CONTROL result causes reading garbage from the stack and out-of-bounds array access.

In the Linux kernel's pds_core driver, the wait_context was stored on the stack in pdsc_adminq_post(), causing use of a pointer to a non-existent object after timeout. This leads to kernel crashes and system instability.

In the Linux kernel, a vulnerability was found in KVM for x86 where IRTE is not properly restored to host control when a new GSI route prevents direct interrupt posting to a vCPU. This can lead to incorrect interrupt delivery to the guest and potentially use-after-free.

In the Linux kernel, a vulnerability in the USB xHCI driver related to handling of isochronous Ring Underrun/Overrun events was found. The TRB pointer in these events may point to the enqueue position at error time or be NULL, and with delayed processing, a new TD may be incorrectly processed, leading to data loss or a use-after-free of the buffer by the xHC.

A bug in the Linux kernel causes a system crash during netfs subsystem initialization when CONFIG_PROC_FS is disabled. The issue arises from attempting to create /proc/fs/netfs without checking if the proc filesystem is available, leading to a kernel panic.

A vulnerability in the Linux kernel's NFSD subsystem can cause a deadlock when handling delegations. The issue arises when a dl_recall queue operation fails, and subsequent calls to nfs4_put_stid may attempt to acquire the same lock (cl_lock) from two threads.

In the Linux kernel, a vulnerability in the DRM Xe driver (xe_migrate_clear) was found where the error path uses a potentially unstable fence pointer (m->fence) instead of a locally generated fence, leading to a possible use-after-free (UAF).

In the Linux kernel, a vulnerability was found in the mpi3mr SCSI driver where the task management thread accesses unallocated memory due to an invalid queue ID (0xFFFF) set by the reset thread, causing a crash. A synchronization flag was added.

In the Linux kernel's Btrfs filesystem, list_del_init() operations on the bg_list of block groups can race with btrfs_mark_bg_unused() or btrfs_mark_bg_to_reclaim(), leading to double reference decrement and a kernel warning.

In the amdkfd driver in the Linux kernel, there is a use-after-free bug during mode1 GPU reset. After KFD aborts processes, user queues may still write to freed system memory, corrupting data structures and causing driver crash.

In KVM for ARM64, if vCPU creation fails, vGIC vCPU data is not cleaned up. This causes memory leaks and potential use-after-free when the redistributor device is handled.

In the Linux kernel, a use-after-free (UAF) vulnerability was found in the fprobe tracing mechanism. A previous fix moved try_module_get() outside the lock, allowing a module to be unloaded before the reference count is incremented, leading to access to a freed object.

In the Linux kernel for RISC-V, the uprobes implementation is missing a fence.i instruction after building the XOL buffer. This can lead to execution of stale instructions due to lack of instruction cache flushing.

In the xen-netfront driver in the Linux kernel, a missing NULL check on xdp_convert_buff_to_frame() can lead to NULL pointer dereference and memory leak.

A vulnerability was found in the Linux kernel TTY driver related to the TIOCL_SELMOUSEREPORT operation. A previous patch (commit 2f83e38a095f) inconsistently relaxed permission requirements, potentially allowing an attacker to simulate mouse movements and inject input into terminal applications. The issue is fixed by restoring the CAP_SYS_ADMIN requirement for all uses of TIOCL_SELMOUSEREPORT.

In the Linux kernel, the USB xHCI driver has an invalid pointer dereference in the Etron workaround code. The check enqueue + 1 may point beyond the segment, causing a crash or data corruption.

In the Linux kernel, the ksmbd (SMB server) module triggers a warning about calling blocking operations while in a non-TASK_RUNNING state. The ksmbd_durable_scavenger_alive() function tries to acquire a mutex while sleeping, which is incorrect. The mutex is not needed there.

In the SPI driver for i.MX (spi-imx), the return value of spi_imx_setupxfer() is not checked. This can lead to a NULL pointer dereference and system crash.