Linux kernel vulnerabilities

A vulnerability related to io_uring has been resolved in the Linux kernel, concerning opcode speculation. Safeguards have been implemented to ensure that sqe->opcode is properly sanitized against speculations.

In the Linux kernel, a vulnerability was found in migrate_device_finalize() where a folio to be freed is incorrectly added to the LRU list. This triggers memcg warnings and may cause unnecessary system overhead.

A use-after-free vulnerability was found in the ibmvnic driver of the Linux kernel. After sending the transmit buffer to VIOS, the driver incorrectly accessed the skb structure, leading to a race condition between reading skb->len and freeing the skb via an interrupt from VIOS.

In the Linux kernel, a vulnerability in BPF was found where the freeze_mutex was held during the entire mmap operation, potentially leading to deadlocks. The fix reduces the lock hold time to only the necessary write permission checks.

In the Linux kernel, arena_map_free causes a soft lockup on 64k page kernels (aarch64). The address returned by bpf_arena_get_kern_vm_start() may not be page-aligned, leading to an infinite loop in apply_to_pte_range.

A vulnerability in the Linux kernel's acct(2) system call can cause a NULL pointer dereference when writing to a file that triggers an internal lookup (e.g., /sys/power/resume) after the process has exited and called exit_fs().

In the Linux kernel SMB (CIFS) client, the function receive_encrypted_standard() lacks a check for the return value of cifs_buf_get() and cifs_small_buf_get(), potentially leading to a null pointer dereference.

In the amdkfd driver in the Linux kernel, there is a bug where gang_ctx_bo is not properly freed when user queue initialization fails. The function amdgpu_amdkfd_free_gtt_mem() expects a pointer to pointer (void**), but void* was passed, leading to errors during dereferencing.

A bug was found in the Linux kernel's KVM for x86, where hardware DR6 is loaded with a stale vcpu->arch.dr6 value instead of the guest's actual DR6. This occurs when the guest modifies DR6 with interception disabled and a fastpath VM-Exit (e.g., VMX preemption timer) happens, overwriting the correct DR6 with old data.

In the Linux kernel io_uring/kbuf subsystem, reusing an old io_buffer_list structure during IORING_REGISTER_PBUF_RING violates the requirement that fields remain stable after publication, potentially causing incorrect behavior.

In the Linux kernel, the block I/O function blkdev_read_iter() performs iov_iter_revert() with a negative value for -EIOCBQUEUED, causing a WARN and potential issues.

In the Linux kernel, a vulnerability in the landlock module was found where a corrupted filesystem (e.g., bcachefs) might return weird files. Instead of throwing a warning and allowing access, such files are now treated as regular files.

In the Linux kernel, a vulnerability in the DRM V3D driver occurs when an active performance monitor (perfmon) is destroyed without being stopped, leaving the `v3d->active_perfmon` pointer stale. This can lead to undefined behavior and system instability.

In the Linux kernel, a vulnerability in the mac80211 WiFi module was found where if STA state is pre-moved to AUTHORIZED (e.g., in IBSS scenarios) and insertion fails, the station is freed. Trying to flush such a station that was not uploaded to the driver may cause a crash.

In the Linux kernel, the btusb Bluetooth driver for Mediatek chips lacks proper locking when calling usb_driver_claim_interface() from a context other than probe(). This can lead to "Failed to claim iso interface" errors or NULL pointer dereferences.

In the Linux kernel, the netfilter (nf_tables) subsystem has a vulnerability due to not rejecting mismatches between the sum of field lengths and the set key length. Register-based arithmetic allows combining mismatching values, leading to incorrect pipapo rule width calculation.

A vulnerability in the Linux kernel's bpf_timer mechanism causes a 'scheduling while atomic' violation on systems with PREEMPT_RT enabled. The issue occurs during hash table (htab) element updates when check_and_free_fields() tries to acquire a spin-lock while the caller already holds a raw-spin-lock (bucket lock).

In the Linux kernel, a vulnerability in the mac80211 subsystem allows deactivating all links via the debugfs interface, triggering a WARN_ON that indicates an internal bug.

In the Linux kernel, a vulnerability in the UBIFS filesystem causes a null pointer dereference when dumping the TNC tree after clearing the slab cache. The pointer c->zroot.znode becomes NULL, leading to a system crash.

In the Linux kernel's remoteproc subsystem, a bug was found where ida_free is called for an ID that was not previously allocated by ida_alloc. The issue occurs in the rproc_alloc function when an error happens before ida_alloc is called, and then in the release path (rproc_type_release) an attempt is made to free an unallocated ID, triggering a kernel warning.

In the Linux kernel, the batman-adv module had an unmanaged ELP metric worker that could cause invalid memory accesses when interfaces were removed or the module was unloaded. The fix replaces per-interface neighbor metric workers with processing in the interface worker context and uses rcu_trylock to prevent deadlocks.

In the Linux kernel, a vulnerability was found where a potential deadlock can occur during sysfs ->store() calls. The issue arises when store callbacks (e.g., update_nr_requests, wbt, scheduler) allocate memory with GFP_KERNEL, which may trigger direct reclaim and deadlock while the queue is frozen. The fix marks the context with GFP_NOIO around sysfs ->store().

In the Linux kernel, a vulnerability was found where the ->enable callback is called unconditionally without checking if it is implemented. Some drivers (e.g., ptp_s390, ptp_vclock, ptp_mock) do not define this callback, leading to NULL pointer dereference.

In the Linux kernel, the class_dev_iter_next() API has a wild pointer dereference issue. class_dev_iter_init() does not initialize the iterator on error, and subsequent calls to class_dev_iter_next() and class_dev_iter_exit() may dereference uninitialized pointers, causing a crash.

In the Linux kernel, a locking issue was found in the rxrpc and afs implementation. The AFS address list cleanup function is called in RCU (Bottom Half) context, attempting to acquire a regular spinlock (peer_hash_lock) also used in non-BH context. This creates a potential deadlock and triggers a lockdep inconsistency warning.

In the Linux kernel, the XDP subsystem lacks a check to disallow attaching device-bound programs in generic mode. These programs rely on driver-specific kfuncs that do not work in generic mode, potentially causing crashes.

A deadlock vulnerability (ABBA) was found in the Linux kernel's block layer when modifying queue limits via sysfs. The issue occurs when a user changes a limit (freezing the queue) while a device driver (e.g., SCSI sd) simultaneously revalidates limits, causing mutual blocking.

In the Linux kernel PCI RCAR Endpoint driver (rcar-ep), rcar_pcie_parse_outbound_ranges() uses a stack string variable for the resource name passed to devm_request_mem_region(). This can lead to undefined behavior, including garbage in /proc/iomem or system crashes.

In the Linux kernel's HNS3 network driver, a vulnerability was found causing an Oops when unloading hclge and hns3 drivers in parallel. The issue occurs when hclge unload tries to disable SR-IOV for ae_dev nodes while hns3 unload removes those nodes, leading to memory corruption.

In the Linux kernel, the ravb network driver lacked the rtnl lock during suspend/resume operations. Calls to ravb_open, ravb_close, and WOL (Wake-on-LAN) operations performed without this lock could conflict with concurrent ndo operations, triggering RCU warnings and potential instability.

A vulnerability in the Linux kernel causes a hang in nfsd4_shutdown_callback when an NFS client is in courtesy state, blocking for up to 15 minutes until TCP drops the connection.

In the Linux kernel's AX25 stack, a reference count leak occurs when using the SO_BINDTODEVICE socket option. The refcount is decremented in ax25_release but not incremented when binding via this option, causing a warning and potential memory leak.

In the Linux kernel's LoongArch architecture, the IP checksum function for negative lengths causes undefined bit shift and out-of-bounds memory read, potentially leading to crash or data leak.

In the TI AM65 CPSW Ethernet driver in the Linux kernel, there is a memory leak when the XDP program does not return XDP_PASS. Memory allocated by am65_cpsw_build_skb() was not freed, and allocating SKB before running the XDP program wasted CPU cycles. The fix moves SKB allocation after evaluating the XDP result.

In the Linux kernel for ARM64, a vulnerability was found in the cacheinfo subsystem due to an out-of-bounds write to the cacheinfo array. The detection loop did not account for cache levels with separate data/instruction caches, causing an out-of-bounds write.

In the Linux kernel, a buffer overflow vulnerability was found in the amdgpu driver's smu_sys_set_pp_table() function. A malicious user can provide a small pptable via sysfs followed by a larger one, leading to a buffer overflow attack.

A vulnerability was found in the Linux kernel's mmap mechanism for persistent ring buffers used in tracing. Attempting to mmap a trace instance buffer attached to reserve_mem causes a page fault and system crash. The issue arises because virt_to_page is used on vmap'd memory, which is invalid.

A vulnerability related to the handling of bogus partition tables has been fixed in the Linux kernel. Issues included improper sector size and lack of proper NUL termination in the partition table.

In the Linux kernel, the __ip_rt_update_pmtu() function for IPv4 lacked RCU protection when reading the network structure (net). This can lead to a race condition and access to already freed memory.

In the Linux kernel, a vulnerability was found in the ip6_default_advmss() function, which lacked RCU protection when reading the network structure. This could lead to a use-after-free condition.

A vulnerability was found in the Linux kernel's ndisc_alloc_skb() function, which can be called without holding RTNL or RCU locks. Lack of proper RCU protection may lead to a use-after-free (UAF) condition.

A vulnerability has been identified in the Linux kernel in the arp_xmit() function, which can be called without RTNL or RCU protection. A fix has been implemented to use RCU protection to avoid potential use-after-free (UAF).

In the Linux kernel, a subsystem refcount leakage of the @block_class was discovered in the blkcg_fill_root_iostats() function. The function iterates over devices using class_dev_iter_(init|next)() but does not end the iteration with class_dev_iter_exit(), causing a refcount leak.

In the Linux kernel, the libata-sff subsystem has a bug that allows writing outside the allocated buffer during ATA PIO command handling. The ata_pio_sector() function lacked a bounds check, unlike the similar __atapi_pio_bytes() function. This can lead to overwriting random memory.

A vulnerability has been identified in the Linux kernel related to lack of bounds checking in the nci_hci_create_pipe() function. The 'pipe' variable coming from the network can lead to memory corruption if its value exceeds 127.

In the Linux kernel misc fastrpc driver, the page size calculation for non-registered buffers does not consider the offset, potentially leading to an incorrect page size and out-of-bounds memory access.

In the Linux kernel HID multitouch driver (mt_input_configured), the return value of devm_kasprintf() is not checked. This can lead to a NULL pointer dereference when memory allocation fails.

In the Linux kernel, the safesetid module lacked size validation for data written to sysfs. An attacker could send an oversized buffer, triggering a warning in kmalloc and potentially destabilizing the system.

In the Linux kernel, the int3472 driver for x86 platforms lacked a check for a NULL adev (ACPI device) pointer. This could theoretically occur when a user manually binds the driver to an i2c/platform device via sysfs, leading to a possible NULL pointer dereference in skl_int3472_get_acpi_buffer().

In the Linux kernel UFS subsystem for the BSG interface, the bsg_queue pointer is not set to NULL after removal. This could lead to a use-after-free (UAF) vulnerability.