Linux kernel vulnerabilities

In the Linux kernel BPF subsystem, the verifier rejects variable offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. The issue arises because constant offsets were moved to reg->var_off, while __check_buffer_access() only checks the instruction offset. For writable raw tracepoints, an access with a negative offset can wrap the calculated end, allowing a program to bypass validation.

In the Linux kernel, the fwnode_init() function did not initialize all fields of the fwnode_handle structure. If a firmware node is allocated on the stack or heap without zeroing, the secondary pointer may contain uninitialized memory, potentially leading to dereferencing. The fix sets fwnode->secondary to NULL and initializes the remaining fields of the structure.

A vulnerability in the Linux kernel's f2fs filesystem can cause a deadlock in f2fs_balance_fs() when the filesystem space is nearly exhausted. This results in processes and writeback workers being blocked for over 120 seconds, indicating a severe system hang.

In the Linux kernel f2fs filesystem, a potential deadlock was found in the gc_merge path of f2fs_balance_fs(). When the device is mounted with the gc_merge mount option, a deadlock can occur between the write thread, garbage collector thread, and truncate process. The fix calls f2fs_submit_merged_write() and f2fs_submit_all_merged_ipu_writes() in the GC_MERGE path to commit cached writes, similar to the NOGC_MERGE path.

In the Linux kernel binder module, a vulnerability exists where the LSM context size field is read after being zeroed by release. This inflates the scatter-gather buffer end offset, allowing copies to overwrite the secctx area.

In the Linux kernel, the ueagle-atm driver (USB ATM) has a vulnerability due to not waiting for the completion of asynchronous firmware loading in the .disconnect() function. This can lead to a race condition when the device is unplugged, potentially causing kernfs errors and system crashes.

In the Linux kernel liveupdate (luo) mechanism, there is a lack of session type validation before performing ioctl operations. Some operations, such as PRESERVE_FD, are only applicable to outgoing sessions, while RETRIEVE_FD and FINISH are only valid for incoming sessions. Calling an invalid ioctl on a session can cause handlers to run in an unexpected context, leading to errors and WARN() warnings. The fix adds session type validation before dispatching the ioctl handler.

In the Linux kernel, in the KVM subsystem for s390 PCI handling, a bug was found: when a guest registers IRQs without a summary bit, the associated GAITE entry stores an incorrect value (physical address instead of zero) in the guest AISB location. The fix ensures zero is stored there.

In the Linux kernel, in the s390/zcrypt subsystem, a buffer over-read vulnerability was found in cca_cipher2protkey. User-controlled length fields in CCA token structures were used without proper validation against buffer size and minimum token size, potentially leading to out-of-bounds reads or buffer underruns, causing kernel crashes or memory exposure.

In the Linux kernel, in the s390/zcrypt subsystem, a missing length validation was found in CCA AES cipher key requests. cca_cipher2protkey() derives the copy length from the key token length field, which could lead to out-of-bounds read if the token length exceeds the available space in the CPRB parameter block.

In the Linux kernel, in the s390/zcrypt subsystem, a missing length validation was found in CCA ECC private key requests. cca_ecc2protkey() derives the copy length from the key token length field, which could lead to out-of-bounds read if the token length exceeds the available space in the CPRB parameter block.

In the Linux kernel, a vulnerability in the Btrfs filesystem causes a memory leak when inserting a duplicate relocation root node. The function __add_reloc_root() allocates a mapping node, but if insertion finds an existing entry, the new node is not freed, leading to a memory leak. The fix frees the newly allocated node before returning -EEXIST.

In the Linux kernel, the ata: sata_dwc_460ex driver has an infinite loop bug in the NCQ tag completion bit-scanning. When tag_mask has only high bits set, the loop shifts the mask left until it overflows to zero, causing an infinite loop in hardirq context with a spinlock held. The fix replaces the hand-rolled scanning with __ffs().

In the Linux kernel, the overlayfs filesystem has a vulnerability related to incorrect access checks for the source file during copy_file_range operations. The copy operation between two overlayfs is performed with the mounter creds of the destination overlayfs, not the source, which may lead to unauthorized file access or denial of access. The fix adds an explicit read access check to the source file with the source overlayfs mounter creds.

In the Linux kernel, the drm/amdkfd driver has a vulnerability where the CRIU control stack checkpoint copy is not bounded to the allocated BO size. The copy uses the hardware value cp_hqd_cntl_stack_size, which may be larger than the allocated region, leading to out-of-bounds read and kernel data leak to userspace. The fix clamps the copy size to the buffer size.

In the Linux kernel, the drm/vmwgfx driver has a vulnerability due to lack of validation of the array_size field in the vmw_surface_metadata structure. This field comes from userspace and should be validated against specific limits depending on the available Shader Model.

In the Linux kernel's drm/vc4 driver, vc4_gem_object_mmap() rejects writable mappings of validated shader BOs but leaves VM_MAYWRITE set. Userspace can map the BO read-only and then make it writable with mprotect().

In the Linux kernel's arm_ffa subsystem, ffa_partition_info_get() passes uuid_str directly to uuid_parse() without a NULL check. A NULL argument causes a NULL pointer dereference and kernel panic. A NULL guard has been added to return -ENODEV instead.

In the Linux kernel's gigabyte_waterforce hwmon driver, calling hid_hw_stop() does not stop device IO, leading to a race condition between hid_input_report() and code after hid_device_io_start() in the probe function. If probe fails, a use-after-free vulnerability can occur.

In the Linux kernel's btrfs filesystem, when splitting extent maps, the new maps inherit the EXTENT_FLAG_LOGGING flag, which is never cleared. This can lead to a WARN_ON and use-after-free when the map is freed.

In the Linux kernel, a vulnerability was found in the TC (Traffic Control) mechanism where packet redirects (TC_ACT_REDIRECT) from qdisc filter chains were silently ignored, causing packets not to be redirected and in some cases leading to a system crash (NULL pointer dereference) when calling bpf_redirect(). The issue affects TC filters attached to qdisc that return TC_ACT_REDIRECT (e.g., via eBPF).

In the Linux kernel's txgbe network driver, txgbe_read_eeprom_hostif() always copies round_up(length, 4) bytes into the caller buffer, which is allocated with exactly 'length' bytes. A non-4-aligned length causes an out-of-bounds write (heap overflow).

In the Linux kernel's mt76 (mt7925) WiFi driver, mt76_connac_get_he_phy_cap can theoretically return NULL, and the cap pointer is dereferenced without a check, potentially leading to a NULL pointer dereference.

In the Linux kernel's SMP mechanism, when CSD lock debugging is enabled, multiple CPUs can concurrently prepare the same destination CPU CSD, leading to a non-atomic read-modify-write on the CSD_FLAG_LOCK bit. This can cause the same llist node to be added again, leading to deadlock or soft-lockup.

In the Linux kernel, the DRM Imagination (powervr) driver has a vulnerability where available space in the CCCB buffer is incorrectly checked for paired fragment jobs. This leads to incomplete command sequences, kernel warnings, and potential job timeouts.

In the Linux kernel DRM/AMD Display subsystem, a vulnerability was found where allocating the `dc` structure with `kzalloc()` can exceed the 4 MiB contiguous allocation limit, causing a warning and returning NULL. This leads to amdgpu driver initialization failure and unusable display. The fix replaces `kzalloc()` with `kvzalloc()` to allow non-contiguous allocation.

In the Linux kernel for LoongArch, there is a bug in the kexec command line lookup. In the kexec_load(2) path, a user-space pointer is cast to a kernel pointer and used in strncmp(), causing an incorrect memory reference. The fix copies the segment prefix to a stack buffer using copy_from_user() before comparing.

In the Linux kernel's 8250_mid serial driver, there is a NULL function pointer dereference on Denverton (DNV), Ice Lake Xeon D (ICX-D/CDF), and Snowridge (SNR) platforms. A previous fix replaced setup and exit callbacks with NULL pointers, and the call sites do not check for NULL before use, leading to a NULL pointer dereference and oops.

In the Linux kernel's libceph library, there is a bug in handle_get_version_reply() which uses msg->front_alloc_len as the decode boundary for MON_GET_VERSION_REPLY. Since this is the buffer size, not the actual received bytes, a truncated reply can cause an uninitialized memory read from stale tail bytes.

In the Linux kernel's VXLAN driver, there is a missing CAP_NET_ADMIN requirement in the device network namespace during changelink operations. A caller privileged in the device namespace but not in the underlay namespace can modify VXLAN tunnel configuration, potentially leading to unauthorized changes.

In the Linux kernel's amdgpu graphics driver for gfx8 generation, an unnecessary BUG_ON() call was removed, which caused kernel crashes in unnecessary cases. The fix simply removes this call.

In the Linux kernel's DisplayPort MST driver, there is a bug in drm_dp_mst_topology_queue_probe() where concurrent teardown of the MST topology (e.g., during monitor unplug) triggers drm_WARN_ON() and potential compositor crashes. The fix replaces this warning with a graceful early return, eliminating spurious warnings and crashes.

A use-after-free vulnerability was found in the Linux kernel's KVM x86/mmu during vendor module reload. The mmu_destroy_caches() function destroys caches but leaves pointers dangling, leading to use of freed memory on subsequent module load.

In the Linux kernel, the gpu: host1x subsystem has a use-after-free vulnerability in host1x_bo_clear_cached_mappings. The __host1x_bo_unpin() function drops the last reference to the mapping and frees it, making later dereference invalid. The fix uses the local cache variable instead.

In the Linux kernel, the IB/mad subsystem has a vulnerability that allows processing unsolicited RMPP responses before they are matched to an outstanding request. This can lead to allocation or extension of RMPP state for responses that do not correspond to any sent request. The fix requires that for kernel-handled RMPP DATA responses, a match via ib_find_send_mad() must exist before entering RMPP reassembly.

In the Linux kernel, the mtd: virt_concat subsystem has a use-after-free vulnerability in mtd_virt_concat_destroy_joins(). The mtd_concat_destroy() function frees item->concat, and then calling mtd_virt_concat_put_mtd_devices(item->concat) leads to use-after-free. The fix moves the call to mtd_virt_concat_put_mtd_devices() before mtd_concat_destroy().

In the Linux kernel, the mtd: virt_concat subsystem has a use-after-free vulnerability in mtd_virt_concat_destroy(). The mtd_concat_destroy() function frees item->concat, and then calling mtd_virt_concat_put_mtd_devices(item->concat) leads to use-after-free. The fix moves the call to mtd_virt_concat_put_mtd_devices() before mtd_concat_destroy().

In the Linux kernel, the btrfs subsystem has a vulnerability causing a root leak in merge_reloc_roots(). If an unexpected reloc_root is encountered for a root, the jump to the out label does not drop the reference obtained for the root, leading to a memory leak. The fix adds a missing btrfs_put_root() call.

In the Linux kernel, the sched_ext subsystem has an issue with a warning in put_prev_task_scx() regarding core-sched forced idle. When a runnable task is forced idle by core scheduling, a warning is generated even though it is not an error. The fix gates the warning on sched_cpu_cookie_match(): a cookie mismatch means core scheduling forced the idle, while a match (or core scheduling off) still catches a genuine missing-ENQ_LAST drop.

A vulnerability in the Linux kernel's XFRM subsystem allows a stack-out-of-bounds read in xfrm_state_find() due to optional IPTFS templates in outbound policies not being covered by a previous fix. A local attacker can trigger a kernel panic by sending a crafted ICMP packet. The issue affects outbound policies only; IN and FWD policies are not vulnerable.

In the Linux kernel, a vulnerability in the RDMA/irdma driver allows a user to invoke rereg_mr on special memory regions (used for QP/CQ/SRQ creation) that lack a valid mkey. This triggers a real CQP command with a zero mkey, potentially causing incorrect behavior.

In the Linux kernel, the RDMA/irdma driver has a vulnerability that allows a user to trigger a null pointer dereference during QP creation. If the user provides a zero value in the user_wqe_bufs field, the iwqp->iwpbl field is not initialized and later dereferenced unconditionally, causing a crash. The fix unconditionally calls irdma_get_pbl and bails on failure.

In the Linux kernel, the RDMA/siw driver's siw_create_qp() function calls siw_qp_add() before the QP is fully initialized, allowing other components to access a partially constructed QP. The fix moves siw_qp_add() to the end of the function after full initialization.

A vulnerability in the Linux kernel's MTD subsystem causes a double free and WARN_ON in add_mtd_device() error paths. When device_register() or mtd_nvmem_add() fails, the error handling triggers mtd_release() which frees mtd_info, but callers also free it, leading to a double free. Additionally, release_mtd_partition() hits WARN_ON because the partition node is still linked in the parent's list.

A vulnerability in the Linux kernel XFRM/IPsec subsystem was found. After a failed IPTFS state setup, the mode callback pointer (mode_cbs) remains in a dead state, which after module unload leads to a dangling pointer dereference by deferred GC (xfrm_state_gc_task) and a kernel panic.

A vulnerability in the Linux kernel's cfg80211 subsystem allows the sched_scan_res_wk work item to run after device unregistration, leading to a use-after-free condition. The issue is caused by missing cancellation of this work during wiphy unregister.

In the Linux kernel, the wifi ipw2100 driver has a potential memory leak in ipw2100_pci_init_one(). Memory allocated by ipw2100_alloc_device() is not freed in some error paths. The fix converts direct returns into gotos to the error path, and handles pci_enable_device() failure inline.

In the Linux kernel, the wifi cfg80211 subsystem has a memory leak in cfg80211_wext_siwscan(). If the SSID length test fails, the 'creq' object is not freed. The fix uses the existing error handling path to free the memory.

In the Linux kernel, the wifi mac80211_hwsim driver has a denial-of-service vulnerability due to lack of clamping the virtio RX length before skb_put(). A malicious backend can report a length larger than the available buffer, causing a kernel panic (skb_over_panic). The fix clamps the length to the available room.

In the Linux kernel, the wifi libertas driver has a memory leak in helper_firmware_cb(). After a successful async firmware load, the single-stage firmware image is not freed, leading to a memory leak in the USB firmware-download path. The fix adds release_firmware() after lbs_fw_loaded() returns.