Linux kernel vulnerabilities

In the Linux kernel, the broken autobind feature for AX25 sockets has been removed. It caused memory and refcount leaks, leading to system crashes. Calling connect() without prior bind now returns -EINVAL.

In the Linux kernel, the bnxt_en driver incorrectly masks the bd_cnt field in TX BD, potentially corrupting TX BD and causing TX timeout. Added a macro for proper masking.

In the Linux kernel DSA driver for SJA1105, an out-of-bounds memory access vulnerability was found in the sja1105_table_delete_entry() function. The issue occurs when deleting the last element from a table, potentially accessing invalid memory.

In the Linux kernel, the ibmvnic driver fixed an issue with printing hex dumps where the buffer was cast to an 8-byte long and printed using string formatters. If the buffer size was not a multiple of 8, a read buffer overflow was possible. The fix uses hex_dump_to_buffer instead.

A bug in the Bluetooth btnxpuart driver in the Linux kernel causes a kernel panic during firmware release. The issue occurs in a stress test scenario where WLAN and BT firmware are downloaded simultaneously, and due to a hardware bug, the chip sends only one bootloader signature. After a 60-second timeout waiting for the next signature, calling release_firmware triggers a kernel panic.

In the Linux kernel, the panthor DRM driver has a race condition when gathering fdinfo group samples. Lack of protection for group access with an xarray lock can lead to use-after-free.

In the Linux kernel, the PCI brcmstb driver has a vulnerability where the number of regulators is not set to zero after a regulator_bulk_get() error. If the PCIe link fails, a subsequent regulator_bulk_free() call causes a kernel panic.

In the Linux kernel, the powerpc/perf module lacks module ownership assignment for the 'vpa_pmu' PMU. This allows unloading the module while perf events are active, leading to a NULL pointer dereference and kernel panic.

In the Linux kernel PAT (Page Attribute Table) mechanism for x86, a bug was found in handling the VM_PAT flag during a failed fork() call. When track_pfn_copy() fails, the VM_PAT flag remains set for the destination VMA, causing an attempt to read PAT information from uncopied page tables, triggering a WARNING and potential system crash.

A vulnerability in the Linux kernel's RDMA/core subsystem caused hardware counters (hw_counters) to be exposed to non-initial network namespaces. Attempting to read these counters in such a namespace resulted in a NULL pointer dereference and kernel panic.

In the Linux kernel BPF subsystem, the may_goto instruction uses an extra 8 bytes on the stack, causing the interpreters[] array index calculation to go out of bounds.

In the Linux kernel MLX5 driver, a bug in mlx5_poll_one() incorrectly compares the QP number from CQE with the QP number in mlx5_ib_qp instead of mlx5_core_qp. This causes the wrong QP to be used when handling a CQE, potentially leading to a NULL pointer dereference and system crash.

In the Linux kernel's vhost-scsi subsystem, multiple bugs were found when vhost_scsi_set_endpoint is called multiple times without an intervening vhost_scsi_clear_endpoint. These bugs can cause use-after-free, hang during TPG directory removal, and TPG leaks, making them unremovable.

In the NTFS3 filesystem in the Linux kernel on 32-bit systems, an integer overflow occurs when adding 'off + sizeof(struct NTFS_DE)'. This can lead to incorrect behavior.

In the NTFS3 filesystem in the Linux kernel, the hdr_first_de() function does not properly validate the 'de_off' and 'used' values from disk. On 32-bit systems, this can lead to integer overflow bypassing checks.

In the OCFS2 filesystem in the Linux kernel, the l_tree_depth field (16-bit) is not validated before use, potentially causing out-of-bounds access if it has an invalid value (e.g., from a corrupted disk). Maximum depth is limited to OCFS2_MAX_PATH_DEPTH.

In ksmbd (SMB server in the Linux kernel), the r_count counter is only incremented during oplock break wait but decremented elsewhere, causing a mismatch. This can make r_count negative, preventing the ksmbd thread from terminating.

In the Linux kernel's spufs (Cell Broadband Engine), there are lifetime management bugs in gang directories. A previous patch incorrectly removed dentry pinning, leading to unbalanced dput() calls and link count leaks.

In the Linux kernel, a vulnerability was found in the SCTP protocol due to missing mutual exclusion in proc_sctp_do_udp_port(). Concurrent calls to sctp_udp_sock_stop() and sctp_udp_sock_start() can cause a race condition, leading to a NULL pointer dereference and system crash, as reported by syzbot.

In the Linux kernel's Airoha network driver, a bug in airoha_tc_get_htb_get_leaf_queue() causes incorrect queue ID (qid) reporting. This triggers a kernel warning and potential crash when deleting offloaded HTB leafs or root HTB qdisc.

In the Linux kernel, the mvpp2 driver has a vulnerability that can corrupt the parser TCAM memory. Concurrent access to TCAM and SRAM index registers without proper locking can cause writes to wrong rows and TOCTOU errors during row allocation. This was observed when mvpp2_set_rx_mode() ran on two CPUs simultaneously, corrupting the MVPP2_PE_MAC_UC_PROMISCUOUS entry and dropping all incoming unicast traffic.

A vulnerability in the Linux kernel's UDP implementation allows multiple integer overflows of the sk->sk_rmem_alloc counter. By setting a large sk->sk_rcvbuf (e.g., INT_MAX) and flooding packets, an attacker can cause the counter to overflow, enabling a single socket to hold excessive data.

In the Linux kernel's dst_release function, cached dst counters are not properly decremented (when CONFIG_DST_CACHE is enabled). This can lead to accessing freed memory during netns dismantle, causing a kernel panic.

In the Linux kernel netfilter nft_tunnel module, a vulnerability was found due to incorrect pointer arithmetic when processing GENEVE attributes. A type confusion before pointer addition leads to a heap out-of-bounds write.

A vulnerability in the Linux kernel allows integer overflow in the geneve_opt structure. An attacker can use a 128-byte option to fake a zero-length option, leading to a heap out-of-bounds read.

In the Linux kernel for LoongArch architecture, ARCH_DMA_MINALIGN defaults to 1, but some devices (e.g., APBDMA) require 16-byte alignment. Small DMA buffers can cause hardware cacheline write errors.

In the Linux kernel on LoongArch architecture in the BPF subsystem, there is a bug that overrides the return value of a subprogram. During bpf2bpf calls, the return value is incorrectly moved from register a0 to a5, which can cause a kernel panic.

In the Linux kernel in the x86/microcode/AMD subsystem, there is a bug in the __apply_microcode_amd() function. When verify_sha256_digest() fails, the function returns -1 instead of false, which is interpreted as success.

In the Linux kernel on x86, flush_tlb_range() can be used to zap PMD entries (pointers to page tables) along with corresponding PTE entries. The current implementation does not handle this case, potentially leading to incorrect TLB invalidation, especially concerning lazy TLB CPUs.

In the Linux kernel ACPI NFIT driver, acpi_nfit_ctl() incorrectly converts call_pkg->nd_family from u64 to int before range checking. This can bypass validation when the upper 32 bits are non-zero and lower 32 bits are zero, leading to an invalid argument.

In the Linux kernel in the ksmbd (SMB server) subsystem, there is a missing bounds check for the durable handle context.

In the Linux kernel in the ksmbd (SMB server) subsystem, there is a missing bounds check for the create lease context.

In the Linux kernel, a vulnerability was found in the ksmbd filesystem related to an overflow in the dacloffset bounds check. The field was typed as int and used in an unchecked addition, which could overflow and bypass existing bounds checks, leading to out-of-bounds memory access and a kernel crash when dereferencing the DACL pointer.

In the Linux kernel, a vulnerability was found in the ksmbd filesystem due to an out-of-bounds read when accessing sub_auth with zero num_subauth. Lack of validation before reading psid->sub_auth[psid->num_subauth - 1] leads to an out-of-bounds read.

In the exfat filesystem in the Linux kernel, a bug causes random stack corruption. When get_block is called with a stack-allocated buffer (e.g., in do_mpage_readpage), a use-after-free (UAF) of the buffer can occur in a race condition, leading to stack corruption.

A vulnerability in the Linux kernel's device-exclusive entry handling for HugeTLB and THP pages was found. The bug prevents proper migration, swapping, and splitting of pages marked as device-exclusive, causing memory to become pinned and migration failures.

A vulnerability has been identified in the Linux kernel concerning the nfsd_proc_stat_init() function, which ignores the return code from svc_proc_register(). If the procfile creation fails, the kernel issues a warning when attempting to remove the entry later.

In the Linux kernel's NFS server (nfsd), a memory leak of nfs4_stid objects was discovered. The issue occurs when nfsd4_run_cb fails to queue the dl_recall work to the callback_wq, after the reference count of dl_stid was incremented. On failure, the count is not decremented, leading to a permanent memory leak.

In the Linux kernel, a read-only check was added before calling txBeginAnon in extAlloc and extRecord in the JFS filesystem. This prevents modification attempts on a read-only mounted filesystem, avoiding potential errors or crashes.

In the Linux kernel, the JFS filesystem has added a read-only check before truncation in the jfs_truncate_nolock function. This is to avoid errors related to writing to a read-only filesystem.

In the Linux kernel PCI/ASPM subsystem, a use-after-free vulnerability occurs during PCIe switch function removal. The ASPM link state is freed either too early (on any function removal) or too late (after last function removal), causing memory corruption.

In the Linux kernel, the ntb_hw_switchtec driver has a vulnerability causing a shift-out-of-bounds. The function ntb_mw_clear_trans() passes 0 for both address and size, leading to a negative xlate_pos.

A vulnerability in the Linux kernel USB xHCI driver for NEC uPD720200 controllers was found. Missing chain bit in Link TRBs for isochronous endpoints causes IOMMU faults and ring segment skipping, potentially leading to data being written to random buffers.

In the bcachefs filesystem in the Linux kernel, bugs were found in bch2_ioctl_subvolume_destroy(). The bch2_evict_subvolume_inodes() function hung due to incorrect dcache pruning, and permissions checks were missing.

A vulnerability was found in the Linux kernel's memory migration mechanism (mm/migrate). The bug incorrectly determines the number of xarray entries to update during shmem folio migration, causing multi-index entry corruption. The issue occurs when __folio_migrate_mapping() uses folio_test_swapbacked() instead of folio_test_swapcache() to distinguish between page cache and swap cache folios.

A vulnerability in the Linux kernel's KVM for ARM64 involves incorrect lazy saving of host FPSIMD/SVE/SME state, causing unexpected SVE discarding, ptrace ABI changes, and FPMR value loss during VM execution.

In the Linux kernel, a change to the device tree for SDM845/850 that enforced cache coherency in apps_smmu has been reverted. On some devices (e.g., Lenovo Yoga C630) it caused lock-ups and resets.

A memory leak was found in the Linux kernel's fib_check_nh_v6_gw() function for IPv6. The issue occurred after moving fib_nh_common_init() before pcpu memory allocation, leaving nhc_pcpu_rth_output uncleaned on allocation failure.

In the Linux kernel in the net/atm (LAN Emulation) subsystem, there is a use-after-free bug in the lec_send() function. The ->send() function frees the skb buffer, but the length is read after freeing, leading to a use-after-free condition.

In the QAIC (Qualcomm AI Core) accelerator in the Linux kernel, an integer overflow bug was found in qaic_validate_req(). User-controlled u64 variables can cause arithmetic wrapping, potentially leading to incorrect memory allocation.