Linux kernel vulnerabilities

In the Linux kernel, the dm-integrity module has a bug that can lead to a deadlock. When dm_integrity_check_limits fails, the code exits with DM_MAPIO_KILL, but the range is already locked and not unlocked. The fix moves the limit check earlier to avoid resource leaks.

In the Linux kernel, the dm-integrity module has a bug where the hash_offset variable is incremented twice. The variable is already incremented in the loop, and the code increments it again, leading to incorrect behavior. The fix removes the extra increment.

In the Linux kernel, the dm-verity module has a possible NULL pointer dereference in dm_verity_loadpin_is_bdev_trusted when the device has no table. The fix addresses this issue.

In the Linux kernel, the dm-verity module's error counter was not atomic, which could lead to race conditions. As a result, the call to dm_audit_log_target("max-corrupted-errors") may be skipped. The fix makes the counter atomic.

In the Linux kernel, the dma_fence_dedup_array() function returns 1 when called with a count of 0, which contradicts the documentation and may lead to dereferencing an uninitialized pointer in amdgpu_userq_wait_*(). The fix makes the function return 0 for an empty array.

In the Linux kernel, the dma-buf/dma-fence module has a potential NULL pointer dereference due to incorrect ordering of operations on weakly ordered platforms. The fix replaces the signaled-bit check with synchronization on the ops pointer.

In the Linux kernel, the accel/amdxdna module has a use-after-free bug in amdxdna_gem_dmabuf_mmap(). When vm_insert_pages() fails, the error path calls close, which releases the GEM object, and then the code releases it again, leading to access to freed memory. The fix returns directly from close_vma.

In the Linux kernel accel/amdxdna driver, amdxdna_cmd_submit() calls the cmd_submit pointer without checking if it is defined. For AIE4 devices (aie4_vf_ops) this pointer is NULL, leading to a NULL function-pointer call via the AMDXDNA_EXEC_CMD ioctl and a kernel oops. The fix rejects the submission with -EOPNOTSUPP when the device provides no cmd_submit op.

In the Linux kernel accel/amdxdna driver, amdxdna_drm_submit_execbuf() passes the user-supplied command BO handle without validating it. When the handle is AMDXDNA_INVALID_BO_HANDLE (0), the command is submitted with a NULL cmd_bo, leading to a NULL pointer dereference in the DRM scheduler worker and a kernel oops. The fix rejects the invalid handle for user submissions.

In the Linux kernel accel/amdxdna driver, amdxdna_drm_sync_bo_ioctl() for SYNC_DIRECT_FROM_DEVICE passes the BO's client pointer to amdxdna_hwctx_sync_debug_bo() instead of the ioctl file's client. This causes the wrong client to be used as the handle namespace and hardware context owner, potentially leading to synchronization errors. The fix passes filp->driver_priv instead.

In the Linux kernel accel/ivpu driver, fw_log_from_bo() does not check that the log size is at least the header size. When the log is smaller, fw_log_print_buffer() computes data_size with an underflow, leading to reads far past the small real data region of the BO. A size of 0 also causes infinite looping. The fix rejects logs whose size is smaller than the header.

In the Linux kernel scsi: hpsa driver, on the IOACCEL2 reset path there is a DMA mapping leak. When phys_disk->in_reset is set, the function returns without undoing the resources acquired for the command. The fix adds the missing cleanup: unmapping the SG chain, unmapping the SCSI command, and dropping the outstanding IOACCEL command count.

In the Linux kernel scsi: lpfc driver, in lpfc_sli4_driver_resource_setup() there is a memory leak. The memory allocated for mboxq using mempool_alloc() is not freed in some early exit error paths. The fix moves the mempool_free() call earlier, after last use.

In the Linux kernel scsi: xen: scsiback driver, on the TMR submit-failure path there is a command tag leak. When target_submit_tmr() returns an error, the jump to the err label sends a response but frees nothing. The fix uses a helper that returns just the tag.

In the Linux kernel, in the SCSI elx efct driver, a reference leak was detected in efct_hw_io_abort(). When request tag allocation fails, the error path returns -ENOSPC without releasing the reference obtained earlier via kref_get_unless_zero(), causing a permanent reference leak on the io_to_abort object. Additionally, the abort_in_progress flag remains set to true, blocking future abort attempts for the same I/O.

In the Linux kernel, in the SCSI elx efct driver, an I/O leak was detected in efct_dispatch_fcp_cmd(). The function allocates an efct_io before dispatching an unsolicited FCP command, but if the command has an unsupported additional CDB, it returns -EIO without freeing the allocated I/O.

In the Linux kernel, a use-after-free vulnerability was found in the resctrl subsystem during unmount. A concurrent reader of a monitoring event file may access already freed memory because the RDT_DELETED flag is not set for the default resource group. The fix sets this flag unconditionally and prevents remounting when there are pending readers.

In the Linux kernel, in the Input ims-pcu driver, a use-after-free and double-free vulnerability was detected in ims_pcu_disconnect(). The function relies on the interface class to distinguish between control and data interfaces, which could be exploited by a malicious device to cause premature cleanup and potential use-after-free or double-free.

In the Linux kernel, in the Input ims-pcu driver, there is a lack of validation of the control endpoint type. The driver assumes that the first endpoint is an interrupt IN endpoint without verification. A malicious device could provide a different endpoint type, potentially leading to kernel warnings or undefined behavior.

In the Linux kernel, in the Input ims-pcu driver, a memory leak was detected in the async update function. The firmware object was not being released if validation failed. The fix uses __free(firmware) to ensure the firmware is always released.

In the Linux kernel, in the Input ims-pcu driver, an out-of-bounds read was detected in ims_pcu_irq() debug logging. The debug logging unconditionally prints data from pcu->urb_in_buf, but if the interrupt fired for pcu->urb_ctrl, the actual data resides in pcu->urb_ctrl_buf. If actual_length for the control URB exceeds pcu->max_in_size, this leads to an out-of-bounds read.

In the Linux kernel, in the Input ims-pcu driver, a race condition was detected in the reset_device sysfs callback. The ims_pcu_reset_device() function calls ims_pcu_execute_command() without acquiring pcu->cmd_mutex, which can lead to data races and corruption of the shared command buffer if triggered concurrently with other commands.

In the Linux kernel, in the Input ims-pcu driver, a type confusion vulnerability was detected in CDC union descriptor parsing. The driver trusts bMasterInterface0 from the CDC union descriptor without verifying that it matches the interface being probed. This could lead to overwriting the private data of another interface.

In the vub300 MMC driver, a use-after-free vulnerability exists during failed host addition. The error path bypasses the kref lifetime management after arming the inactivity timer, potentially leading to use of freed memory.

In the mlx5e driver for Mellanox network cards, a use-after-free vulnerability was found in MACsec handling. Deleting an RX SC freed the metadata_dst object without respecting the reference count, which could lead to use of freed memory by a concurrent packet receive process. Additionally, publishing an element in the xarray before metadata_dst initialization could expose incomplete data.

A use-after-free vulnerability was found in the Linux kernel's user_event_mm_dup() function related to the user_events mechanism. The issue occurs during fork() when the enabler list is traversed without locking while another thread removes an enabler, leading to use of freed memory. An unprivileged attacker can trigger this bug, resulting in a system crash or potential privilege escalation.

In the Linux kernel, the libertas_tf driver has a use-after-free vulnerability in lbtf_free_adapter(). The function uses timer_delete() instead of timer_delete_sync(), which does not wait for a running timer callback that may access freed memory during device removal.

In the Linux kernel, the posix-cpu-timers mechanism has a multiplication bug in update_rlimit_cpu(). On 32-bit kernels, multiplying the CPU limit by NSEC_PER_SEC is done in 32-bit type, causing truncation for limits >= 5 seconds and incorrect programming of the process CPU timer.

In the Linux kernel, the CPU hotplug mechanism has a bug in cpuhp_invoke_callback() that hides the original error during rollback of earlier callbacks. The ret variable is reused to store the rollback result, which can mask the original error.

In the Linux kernel, the CPU hotplug mechanism has a buffer overflow vulnerability in states_show(). The function writes hotplug state names to a sysfs buffer using sprintf(), which can write past the end of the PAGE_SIZE buffer when many states are registered.

In the Linux kernel, a vulnerability was found in the Tegra GPIO driver where pinctrl functions are called for GPIO direction, even though the GPIO driver programs direction registers directly. This redundant call enters the pinctrl core and can sleep in an atomic context when shared GPIO users hold a spinlock. The issue was confirmed by static analysis and manual code review.

In the Linux kernel, the GPIO driver for MT7621 modifies bank-shared fields like 'rising' and 'falling' using non-atomic read-modify-write operations. Concurrent calls for different IRQs on the same bank can overwrite each other's configuration. A lock 'gpio_generic_lock_irqsave' has been added to protect these fields.

In the Linux kernel, the SIT driver's ipip6_changelink() did not check CAP_NET_ADMIN in the tunnel's network namespace. A caller privileged in the device's netns but not in the tunnel's netns could modify the tunnel. Added rtnl_dev_link_net_capable() check at the beginning.

In the Linux kernel, the TI ICSSG driver's icssg_ndo_get_stats64() calls emac_get_stat_by_name() without checking if the PA stats block is present. When pa_stats pointer is NULL, thousands of log entries are generated and counters rx_errors, rx_dropped, tx_dropped are corrupted. Added proper guard.

In the Linux kernel, the T7xx WWAN driver's t7xx_cldma_late_init() creates a DMA pool before initializing TX and RX rings. If ring initialization fails, the DMA pool is not freed, causing a memory leak. Added destruction of the DMA pool on the error path.

In the Linux kernel, the ixp4xx_hss driver's ixp4xx_hss_probe() allocates two HDLC netdevs, but registers one and removes another. This leads to memory leak and improper removal. The fix allocates only one netdev and assigns it to port->netdev.

In the Linux kernel, the act_ct module's tcf_ct_handle_fragments() does not save and restore skb->cb during defragmentation. This causes loss of qdisc metadata like pkt_segs and can trigger WARN_ON_ONCE(). Added save and restore of tc_skb_cb.

In the Linux kernel, the ENA driver's create_queues_with_size_backoff() creates XDP TX queues before setting up regular TX queues. If regular TX queue setup fails, XDP TX queues are not destroyed, causing resource leak. Added explicit destruction of XDP TX queues at two missing failure points.

In the Linux kernel, the IP6VTI driver's vti6_changelink() did not check CAP_NET_ADMIN in the tunnel's network namespace. A caller privileged in the device's netns but not in the tunnel's netns could modify the tunnel. Added rtnl_dev_link_net_capable() check at the beginning.

In the Linux kernel, the IPVTI driver's vti_changelink() did not check CAP_NET_ADMIN in the tunnel's network namespace. A caller privileged in the device's netns but not in the tunnel's netns could modify the tunnel. Added rtnl_dev_link_net_capable() check at the beginning.

In the Linux kernel, the IPIP driver's ipip_changelink() did not check CAP_NET_ADMIN in the tunnel's network namespace. A caller privileged in the device's netns but not in the tunnel's netns could modify the tunnel. Added rtnl_dev_link_net_capable() check at the beginning.

In the Linux kernel, the ip6_gre driver has a vulnerability where CAP_NET_ADMIN is not required in the tunnel's network namespace during changelink operations. A caller privileged in the device's namespace but not in the tunnel's namespace can modify a tunnel residing in another namespace.

In the Linux kernel, the ip6_tunnel driver has a vulnerability where CAP_NET_ADMIN is not required in the tunnel's network namespace during changelink operations. A caller privileged in the device's namespace but not in the tunnel's namespace can modify a tunnel residing in another namespace.

In the Linux kernel, the octeontx2-af driver has a memory leak in nix_setup_bpids(). If any devm_kcalloc() allocation for BPID mapping arrays fails, the function returns without freeing the previously allocated BPID bitmap.

A vulnerability was found in the Linux kernel's legacy netlink interface for IEEE 802.15.4. The LLSEC dump operations in the IEEE802154_NL family lacked the required administrative permission flag, allowing any local user to read raw 16-byte AES-128 keys from the kernel key table. The issue affects only the legacy API, while the modern nl802154 family is properly secured.

In the Linux kernel, the ca8210 driver (IEEE 802.15.4) has a memory leak in ca8210_spi_transfer(). On spi_async() failure, the completion callback is not invoked, leaving the allocated cas_ctl buffer orphaned. Under sustained SPI bus contention, each retry iteration leaks about 600 bytes.

In the Linux kernel, the ca8210 driver (IEEE 802.15.4) has a vulnerability of pointer truncation in kfifo on 64-bit systems. Functions ca8210_test_int_driver_write() and ca8210_test_int_user_read() exchange a buffer pointer through kfifo but use a literal byte count of 4, which on 64-bit writes only the low 4 bytes of the 8-byte pointer. The reader reads 4 bytes into an 8-byte local variable, leaving the upper 4 bytes uninitialized, leading to dereferencing an arbitrary address and system crash.

In the Linux kernel, the octeontx2-af (cn10k) driver has a vulnerability due to lack of validation of the base_pcifunc field in rvu_mbox_handler_lmtst_tbl_setup(). This allows a VF function to read the physical LMTLINE address of another function if base_pcifunc points outside its own PF space. The fix rejects the request with -EPERM when base_pcifunc is not a valid function under its own PF.

In the Linux kernel on LoongArch architecture, a vulnerability was found related to missing dirty page tracking in pte_wrprotect() and pmd_wrprotect(). When hardware page table walker (PTW) is enabled, it may set _PAGE_DIRTY without setting _PAGE_MODIFIED, leading to loss of dirty information during copy-on-write (fork). As a result, a page may be considered clean and freed without writeback, causing data corruption.

In the Linux kernel IPMI subsystem, a vulnerability exists where the user refcount is underflowed during event delivery. On delivery failure, the rollback path decrements the refcount excessively, potentially leading to use-after-free or a refcount_t warning.