Linux kernel vulnerabilities

A use-after-free (UAF) vulnerability was found in the Linux kernel's proc_get_inode() function. It is caused by a race condition between module removal and inode instantiation for a /proc entry, leading to dereference of a pointer to a freed module.

In the SMB server (ksmbd) in the Linux kernel, incorrect validation of the num_aces field in smb_acl was found. The parse_dcal() function used a wrong condition that could allow allocating an array of size ULONG_MAX, leading to overflow.

In the AMD graphics driver (drm/amd/display) in the Linux kernel, out-of-bounds access bugs were found. The hpo_stream_to_link_encoder_mapping array has size MAX_HPO_DP2_ENCODERS (4), but the location index can be up to 6. Similarly, disp_cfg_stream_location index can be used out of bounds.

A bug in the Linux kernel's userfaultfd_move() incorrectly handles pages in the swapcache. When a page is in swapcache and its PTE is a swap entry, the folio index is not updated, causing inconsistency and a BUG during rmap operations.

In the Linux kernel, the hyperv_fb driver has an issue when unbinding a Hyper-V framebuffer device. Forcibly releasing the framebuffer while in use triggers a WARN and does not free memory.

In the Linux kernel, the MCTP protocol has a vulnerability in packet reassembly. Shared frag_list can lead to incorrect reassembly and memory leaks due to circular references.

In the Linux kernel's net_sched subsystem, a vulnerability allows creating classes with the TC_H_ROOT identifier. This causes premature termination of qdisc tree traversal, leading to incorrect parent statistics and potential crashes in the DRR discipline.

In the Linux kernel, a crash occurs in the mlx5 driver when removing a LAG device from a bridge due to incorrect LAG state checking. The flaw skips flushing FDB entries, causing use of a destroyed netdev and a kernel panic.

A use-after-free vulnerability was found in the Linux kernel's Bluetooth L2CAP stack. After the hci sync command releases the l2cap_conn structure, the hci receive work queue may reference freed memory, causing a KASAN error.

In the Linux kernel, a use-after-free vulnerability was found in the ksmbd file system in the ksmbd_free_work_struct function. The interim_entry of ksmbd_work could be deleted after the oplock is freed, leading to memory corruption.

In the Linux kernel, the sched_ext scheduler lacks validation of the prev_cpu parameter in scx_bpf_select_cpu_dfl(). Providing an invalid CPU (outside nr_cpu_ids range) can cause a kernel crash.

In the Linux kernel, the bnxt_en driver has a bug in truesize calculation when converting an XDP packet to sk_buff in the mb-xdp and XDP_PASS case. This causes a warning in skb_try_coalesce and potential system instability.

In the Linux kernel's bnxt_en driver, a bug was found where ip_summed field in skb was updated twice. The bnxt_xdp_build_skb() unnecessarily set CHECKSUM_UNNECESSARY, conflicting with later update in bnxt_rx_pkt() and triggering a WARN() warning.

In the Linux kernel's netfilter subsystem (nf_conncount), a vulnerability was found due to uninitialized fields in the `nf_conncount_tuple` structure within the `insert_tree()` function. Missing initialization of `cpu` and `jiffies32` fields can lead to undefined behavior, including information leaks or system crashes.

In the Linux kernel, the openvswitch module reverted a commit that introduced per-action label counting in conntrack. The new implementation caused a warning when trying to allocate the labels_ext extension for a confirmed conntrack entry, which occurred when the entry was created before OVS incremented the labels_used counter.

In the Linux kernel's ksmbd module (SMB server), a vulnerability allows connection release during oplock break notification, potentially leading to use-after-free in the ksmbd_work structure.

In the Linux kernel for LoongArch architecture, a bug was found in hugetlb memory mapping handling. The base address allocated from hugetlbfs was not aligned to PMD (Page Middle Directory) size, causing an internal kernel BUG during huge page operations. The issue is fixed by adding a check and enforcing proper base address alignment.

In the Linux kernel's ksmbd module (SMB server), an out-of-bounds read vulnerability exists in the parse_sec_desc() function due to improper validation of offsets (osidoffset, gsidoffset, dacloffset), potentially leading to slab-out-of-bounds.

In the Linux kernel's ksmbd module (SMB server), a use-after-free vulnerability exists in the smb2_lock function. When smb_lock->zero_len has a value, the llist is not deleted and flock remains old, leading to use-after-free during error handling.

In the Linux kernel's drm/xe/hmm driver, a vulnerability allows dereferencing struct page pointers without holding the notifier lock. This can lead to marking pages as dirty/accessed that we don't own and dereferencing pages we don't own.

A vulnerability in the Linux kernel's MPTCP implementation allows concurrent connection requests to trigger synchronize_rcu in an atomic context (e.g., during packet reception in an RCU read-side critical section). This causes a 'scheduling while atomic' error and potential system hang.

In the Linux kernel, a vulnerability in vma_modify() causes incorrect VMG state after a failed merge due to out-of-memory (OOM), leading to invalid start/end values in subsequent VMA splits and triggering a VM_WARN_ON_VMG assertion.

In the Linux kernel, the __udp_gso_segment function removes the skb destructor without removing the socket reference, causing a kernel BUG when the original skb is later orphaned. This issue is triggered in Open vSwitch scenarios with specific action sequences.

In the Linux kernel's LLC (Logical Link Control) subsystem, a vulnerability was found where skb_get() is used before dev_queue_xmit(). This causes the network buffer (skb) to be shared, which, with drivers not supporting IFF_TX_SKB_SHARING (e.g., e1000), leads to a kernel BUG and system crash.

In the Linux kernel's hns3 network driver (Huawei), a vulnerability exists where the PTP (Precision Time Protocol) clock is not unregistered and freed if hclge_ptp_get_cycle returns an error, leading to resource leaks.

In the Linux kernel scheduler CFS, a potential memory corruption vulnerability was found in the child_cfs_rq_on_list function. The issue stems from an invalid conversion of the 'prev' pointer from the rq's leaf_cfs_rq_list, potentially causing memory faults or garbage data access.

In the Linux kernel CDX driver (drivers/cdx/cdx.c), driver_override_show() reads the driver_override field without locking, while driver_override_store() can modify it, freeing the old value. This can lead to a use-after-free (UAF) and potential kernel address leak.

In the Linux kernel, the Slimbus messaging subsystem has a bug where the transaction ID (TID) is not freed when slim_do_transfer() returns a timeout error due to delayed interrupts. This leads to invalid memory access in qcom_slim_ngd_rx_msgq_cb() and a kernel panic.

In the Linux kernel, a vulnerability in the amd_get_mmconfig_range() function for x86 has been fixed. Xen does not offer MSR_FAM10H_MMIO_CONF_BASE to all guests, causing an unchecked MSR access warning. The fix uses rdmsr_safe() instead of rdmsr() to safely handle the missing access.

In the Linux kernel's iwlwifi Wi-Fi driver (Intel), a vulnerability exists where the IWL_MVM_STATUS_ROC_P2P_RUNNING flag is not set when firmware fails to start session protection. This leads to improper cleanup and a WARN() on subsequent remain-on-channel attempts.

In the Linux kernel, the RDMA bnxt_re driver lacks sanity checks on the rdev pointer. The ulp_irq_stop and ulp_irq_start callbacks can be called when the device is detached, leading to a NULL pointer dereference and system crash.

In the Linux kernel, NFSv4 has a deadlock when recovering state for a sillyrenamed file. The put_nfs_open_context() call can trigger a synchronous delegreturn that deadlocks because it is not marked as privileged.

In the Linux kernel, a vulnerability in the tracing subsystem allows a malformed histogram trigger (hist) to corrupt the named_triggers list. After a failed trigger creation with an invalid action (onmax(bogus)), the data structure is freed but remains on the list, causing a use-after-free bug and potential system crash.

In the Linux kernel FUSE filesystem, the switch to new folio-based readahead code caused the folio reference to be dropped after locking. In splice responses, where the old folio is removed and replaced, the missing reference leads to a use-after-free (UAF).

In the Linux kernel, the OverlayFS filesystem used the flexible array 'buf' as the memcpy() destination to avoid a false positive runtime warning from the recent FORTIFY_SOURCE hardening. The issue involved a field-spanning write to the fh->fb structure.

In the Linux kernel, an issue was found in the f2fs filesystem where locks are not initialized before use. The f2fs_fill_super() function calls spin_lock on an uninitialized lock, causing a lockdep warning. The fix moves lock and structure initialization to immediately after memory allocation.

In the Linux kernel, a vulnerability in the f2fs filesystem was found due to missing sanity check on i_extra_isize in is_alive(). This can lead to a slab-out-of-bounds read during garbage collection, as reported by KASAN.

In the Linux kernel idpf driver, a bug in idpf_rx_rsc() uses skb_transport_offset() before the transport header is set. This triggers a DEBUG_NET_WARN_ON_ONCE warning in debug kernel builds.

In the Linux kernel's perf subsystem, a missing RCU read lock protection was found in the perf_iterate_ctx() function during list traversal. This triggers lockdep warnings and potential synchronization issues when running perf probe with unshare(1).

A use-after-free (UAF) vulnerability was discovered in the Linux kernel's OverlayFS filesystem. The issue occurs in ovl_dentry_update_reval where premature dput(upper) call leads to accessing freed dentry memory. KASAN reported the bug which can cause undefined system behavior.

In the Linux kernel, a divide-by-zero bug was found in the bnxt_re RDMA driver when creating an SRQ by kernel consumers (e.g., NVMe target with use_srq enabled). The issue is due to missing page size and shift initialization for kernel-space SRQs.

In the Linux kernel, a vulnerability was found related to improper lifetime management of kernel sockets. Kernel sockets can be delayed in freeing by TX packets held in qdisc or device queues, triggering a ref_tracker_dir_exit() warning.

In the Linux kernel, the mlx5 driver did not free the scheduling node during vport QoS cleanup, causing a memory leak. Added the missing free and reset of the pointer.

In the Linux kernel, a suspicious RCU usage was detected in the IOMMU VT-d subsystem. The enable_drhd_fault_handling() function was moved to a code path that does not hold any lock while traversing the drhd list, triggering an RCU warning. The fix ensures the dmar_global_lock is held during the traversal.

A vulnerability was found in the Linux kernel's MPTCP implementation related to missing socket lock (msk socket lock) during address removal. This can cause a race condition and a lockdep warning, potentially leading to incorrect behavior or system crash.

In the Linux kernel's ASoC SOF driver for IPC4 topology, a NULL pointer dereference vulnerability was found. Loops looking for ALH copiers may encounter non-DAI widgets with NULL copier->data, causing a crash.

A vulnerability was found in the Linux kernel related to the use of small head cache with large MAX_SKB_FRAGS values. The issue triggers a warning (splat) during network interface initialization when the GRO buffer size exceeds the cache capacity. The fix ensures the small head cache fits both TCP and GRO allocations.

A use-after-free vulnerability was found in the Linux kernel's eth_skb_pkt_type() function used by BPF tests. It occurs when bpf_prog_test_run_xdp() passes an invalid user_data value to bpf_test_init(), causing access to skb data without an Ethernet header. The fix adds validation of user_data length against ETH_HLEN.

In the Linux kernel netfilter subsystem, a vulnerability was found in nf_ct_find_expectation. By default, this function removes the expectation from the hash table, which is undesirable in scenarios like OVS or TC conntrack when the created connection is not confirmed.

In the Linux kernel, a vulnerability in the TCP stack causes the security path (secpath) not to be dropped together with the dst object. This retains a reference to the xfrm_state, preventing its proper cleanup when network namespaces are deleted. The issue manifests as a WARN warning in xfrm6_tunnel_net_exit.