Linux kernel vulnerabilities

In the Linux kernel, the dev_uevent() function lacks synchronization when accessing the dev->driver pointer. This can lead to a race condition and NULL pointer dereference.

A vulnerability in the Linux kernel's vmxnet3 driver causes malformed packet sizing during XDP processing. The bug in vmxnet3_process_xdp leaks uninitialized kernel data onto the wire for packets sized 128-3k bytes, potentially leading to MTU issues and packet drops.

In the Linux kernel, a vulnerability in the SCSI target subsystem causes a crash when handling WRITE_SAME commands with the NDOB (No Data Buffer) bit set. The issue occurs when there is no data buffer and the code tries to access the non-existent t_data_sg structure. The patch adds a check for the NDOB bit and validation of the scatter-gather element count.

In the Linux kernel, the net/smc module has a race condition between smc_smcr_terminate_all() and smc_buf_create(), which can lead to a NULL pointer dereference in smc_cdc_tx_handler(). The fix adds a check of sndbuf_desc before sending any CDC message.

In the Linux kernel, the CoDel mechanism had a redundant qlen check before calling qdisc_tree_reduce_backlog(). The fix makes qlen_notify callbacks idempotent.

In the Linux kernel, a Use-After-Free (UAF) vulnerability was found in the HFSC scheduler's class handling. It results from an incorrect assumption that the queue remains non-empty after calling qdisc_peek_len().

In the Linux kernel's SUNRPC module, a null-ptr-deref was found when xps sysfs allocation fails. In such cases, adding xprt and switch to sysfs could lead to dereferencing a null pointer, causing a crash.

In the Linux kernel, when cloning a device in btrfs, the associated zoned device info structure is not cloned for zoned filesystems. This leads to a NULL pointer dereference when accessing the device's zone info, e.g., when setting a zone as active.

A memory leak was discovered in the Linux kernel's netdevsim driver related to the fa_cookie field in the nsim_dev structure. The nsim_dev_trap_fa_cookie_write() function allocates memory for fa_cookie, but it is not freed when the driver is removed in nsim_drv_remove().

In the Linux kernel, the 9p (trans_fd) module has a double-lock issue in p9_conn_cancel. After moving requests to a local list, the lock is no longer needed but is released too late, causing a deadlock.

In the Linux kernel ethtool_cmis_module_poll() function, using the wrong size for the rpl structure causes stack corruption and kernel panic.

In the Linux kernel, a vulnerability was found where the refcount of non-slab folios in iov_iter is not incremented, leading to a use-after-free (UAF) bug. This occurs during EROFS file-backed mounts over v9fs, potentially causing system crashes.

In the Linux kernel, the ksmbd SMB server has a use-after-free vulnerability in __smb2_lease_break_noti(). When a connection is disconnected, tcp_transport is freed but the connection object may still be in use, leading to UAF.

In the ksmbd SMB server in the Linux kernel, a use-after-free vulnerability exists in smb_break_all_levII_oplock() due to unlocking in the middle of a loop.

In the Linux kernel's Nouveau driver, a dangling pointer dereference in ttm_bo_delayed_delete causes a general protection fault. The issue arises when drm_prime_gem_destroy destroys a dma_buf before TTM operations complete, leading to memory corruption.

In the Imagination GPU driver (powervr), a reference is not taken for geometry jobs paired with fragment jobs. This leads to a Use-After-Free.

In the Linux kernel, the TIPC protocol has a memory leak in tipc_link_xmit(). When the backlog transmit queue for high-priority messages is full, the function returns -ENOBUFS without purging the skb list, causing a memory leak.

In the Linux kernel, in the net/tls subsystem, there is no explicit prohibition of disconnecting a TLS socket. It was discovered that one can disconnect a TLS socket, leading to various unexpected corner cases, including a warning in tls_strp. The patch explicitly disallows disconnecting TLS sockets.

In the Linux kernel, the SFQ (Stochastic Fairness Queueing) scheduler lacked proper limit validation after other parameter updates. An attacker could trigger an out-of-bounds array access via specific tc command sequences, causing a system crash.

In the Linux kernel, the AMD erratum table for x86 CPUs was missing a NULL terminator, causing out-of-bounds reads. The issue was introduced during the switch from x86_cpu_desc to x86_cpu_id.

In the Linux kernel, the ppp_sync_txmung function lacks bounds checking for skb data. This can lead to out-of-bounds read with empty packets.

In the Linux kernel, a vulnerability in the JFS filesystem allows copying an nlink value of 0 from a corrupted disk inode, potentially causing a deadlock in the diFree() function when processing iag inodes.

In the Linux kernel, a use-after-free vulnerability was found in the ext4 filesystem's ext4_xattr_inode_dec_ref_all function. The issue occurs when extended attributes (xattrs) are located past the end entry, potentially leading to memory corruption.

In the Linux kernel, the mediatek vcodec driver fixes a resource leak related to the scp device in firmware initialization. On MediaTek devices with an SCP, the mtk_scp structure must be explicitly removed to avoid a leak. The structure is freed if firmware structure allocation fails during initialization.

In the venus driver (for hardware video encoding/decoding) in the Linux kernel, a missing size check in the SFR buffer allows a malicious user to modify the size in shared memory, leading to an out-of-bounds write.

In the venus driver in the Linux kernel, a missing size check for the shared queue between the driver and video firmware allows malicious firmware to set an invalid large size, leading to an out-of-bounds write.

In the venus driver in the Linux kernel, the init_codecs function can be called multiple times by a manipulated payload from the video firmware. This can increment the codecs_count beyond MAX_CODEC_NUM, leading to an out-of-bounds access.

In the venus driver in the Linux kernel, parsing HFI packets can lead to an out-of-bounds access when words_count reaches the last word. The fix adds calculation of remaining bytes before parsing.

In the STMMAC (Ethernet) driver for PCI MSI, a pointer to a local variable is passed as the interrupt affinity_hint. After the function returns, the pointer becomes dangling, leading to crashes or data leaks.

In the Linux kernel, the MHI host driver has a race condition between mhi_unprepare_from_transfer() and mhi_queue_buf(). If mhi_gen_tre() runs after the channel is torn down by mhi_unprepare_from_transfer(), a kernel panic occurs due to an invalid pointer dereference.

A vulnerability was found in the Linux kernel's ext4 filesystem, caused by an off-by-one error in the do_split function. This leads to out-of-bounds access in ext4_insert_dentry, potentially resulting in use-after-free during symlink creation.

In the Linux kernel, a vulnerability in the MPTCP implementation allows a NULL pointer dereference in the can_accept_new_subflow function. This can occur when the same request (req) receives two SYN-ACKs in a short time, leading to a kernel panic.

A null-ptr-deref vulnerability was found in the Linux kernel's LOCKDEP mechanism. It occurs when a CIFS (or similar) module is unloaded while a TCP socket still exists in FIN-WAIT-1 state, causing an attempt to access a lock class from the already removed module.

A vulnerability was found in the Linux kernel's SCTP implementation, involving a use-after-free issue in the transport structure during message sending. The bug occurs in sctp_sendmsg() when another thread removes the selected transport after chunks are prepared but before they are sent, leading to a use-after-free read.

In the Linux kernel, a vulnerability was found in the io_uring subsystem related to io_req_prep_async with provided buffers. The function may import provided buffers but commit the ring state prematurely, requiring reimport.

In the Linux kernel's ASoC subsystem, function graph_util_parse_dai() used __free(device_node) for dlc->of_node, causing premature release of the device node while the driver is still in use.

In the NFS server (nfsd) in the Linux kernel, nfs4_lookup_stateid() does not include the SC_STATUS_FREEABLE flag when searching for delegation states. This causes revoked delegations not to be found, returning NFS4ERR_BAD_STATEID instead of NFS4ERR_DELEG_REVOKED.

In the Linux kernel for the LoongArch architecture, an off-by-one vulnerability was found in the BPF JIT's build_prologue() function. When BPF programs mix bpf2bpf and tailcalls, the first pass generates N instructions and the second generates N+1, causing epilogue_offset to be off and jumping to an unexpected instruction, leading to a kernel hard lockup.

In the Linux kernel, a vulnerability was found in the ext4 filesystem where an out-of-bounds read occurs when checking a directory containing a '.' entry with rec_len equal to the block size (4KB). An attacker can exploit a crafted filesystem to trigger a read beyond the allocated buffer, potentially leading to data disclosure or system crash.

In the Linux kernel, the int340x thermal driver lacked a NULL check for the ACPI device pointer (adev), which could lead to a NULL pointer dereference in int3402_thermal_probe(). A check has been added, returning -ENODEV if adev is NULL.

In the ath11k Wi-Fi driver in the Linux kernel, there is an out-of-bounds write error during channel list update. The update process did not wait for cfg80211 to finish asynchronous processing before sending the list to firmware, leading to a KASAN bug.

In the Linux kernel, a vulnerability in the F2FS filesystem was found where a race condition between checkpoint writing and remounting can trigger a warning in dquot_writeback_dquots(). The issue stems from improper synchronization of the s_umount lock, potentially causing false alarms.

In the Linux kernel's DLM (Distributed Lock Manager), a vulnerability leads to a NULL pointer dereference (NPD). When a positive value is written to the event_done file, the new_lockspace function undoes all work, leaving lockspace uninitialized. The __dlm_new_lockspace function incorrectly treats this positive value as success, passing a NULL pointer to dlm_find_lockspace_local, causing a crash.

In the Linux kernel, the md/md-bitmap driver has a bug causing incorrect bitmap_limit calculation in clustered mode (clustermd). As a result, the bitmap superblock area for a cluster node was not updated, leading to hangs in mdadm during resize tests.

In the Linux kernel, a use-after-free vulnerability was found in the ext4 filesystem's ext4_xattr_inode_dec_ref_all() function. The issue occurs because ext4_xattr_delete_inode() does not validate extended attributes (xattr) stored in the inode, leading to out-of-bounds read.

In the Linux kernel, the ice driver lacks validation of queue quanta parameters, potentially leading to out-of-bounds (OOB) access. Added wraparound prevention by validating start_qid and num_queues.

In the ice network driver (Intel Ethernet Connection) in the Linux kernel, the pkt_len value from user space in ice_vc_fdir_parse_raw() is not validated. An untrusted value may exceed the VIRTCHNL_MAX_SIZE_RAW_PACKET limit.

A race condition was found in the Linux kernel's Btrfs filesystem in the btrfs_create_pending_block_groups() function. The issue arises from missing synchronization using the unused_bg_lock, leading to incorrect reference counting of block groups. This results in refcount underflow warnings and potential use-after-free.

In the Linux kernel, the btrfs filesystem function btrfs_validate_super() overwrites the ret variable, negating earlier validity checks. This could allow mounting invalid filesystems.

In the Linux kernel, unnecessary RTNL lock operations were removed for SIOCBRADDIF and SIOCBRDELIF ioctls, which caused deadlocks and warnings about waiting for network device release. The issue occurred when one thread detached an interface from a bridge while another tried to remove the bridge, leading to a lockup and 'unregister_netdevice: waiting' splat.