Linux kernel vulnerabilities

In the Linux kernel, the airoha watchdog driver has a division by zero vulnerability. The clk_get_rate() function can return 0 when the clock provider is not properly configured or the clock is unmanaged. The driver uses wdt_freq as a divisor in airoha_wdt_probe() and airoha_wdt_get_timeleft(), leading to division by zero.

In the Linux kernel, the ath11k WiFi driver has a buffer underflow vulnerability in ath11k_hal_rx_msdu_list_get(). When the first entry in msdu_details has a zero buffer address, the code accesses msdu_details[i - 1] with i == 0, causing an out-of-bounds access.

In the Linux kernel, the firewire net driver has a vulnerability in fragmented datagram reassembly. The fwnet_frag_new() function keeps a sorted list of received fragments. When checking adjacency, the code assumes the current fragment always has a real next or previous fragment, but at list edges it may be the list head, leading to incorrect merging of ranges. As a result, fwnet_pd_is_complete() may miss a complete datagram.

In the Linux kernel, the ath6kl driver has an out-of-bounds read vulnerability in the TX complete event handler. The firmware-controlled num_msg field (u8, 0-255) drives the loop without validation against buffer length, allowing reads up to 1020 bytes past the WMI event buffer.

In the Linux kernel, the ath6kl driver has an out-of-bounds read vulnerability in the connect event handler. The firmware-controlled fields beacon_ie_len, assoc_req_len, and assoc_resp_len are not validated against buffer length, potentially causing OOB reads during IE parsing and corruption of wmi->is_wmm_enabled state.

In the Linux kernel, the carl9170 driver has an out-of-bounds read vulnerability in carl9170_cmd_callback. When the firmware sends a response with a length mismatch, memcpy copies len - 4 bytes, which can exceed the readbuf size, causing an overread.

In the Linux kernel, the carl9170 driver has an out-of-bounds read vulnerability in the TX status handler. The bounds check uses `i > ((cmd->hdr.len / 2) + 1)` which is off by two, allowing 2 extra iterations past valid _tx_status entries when firmware-controlled hdr.ext exceeds hdr.len/2.

In the Linux kernel, the carl9170 driver has a buffer overflow vulnerability in the rx_stream failover path. Copying the full tlen from the second USB transfer instead of capping at rx_failover_missing can exceed the 65535-byte failover SKB, triggering skb_over_panic.

In the Linux kernel, the ASoC tas2781 driver has an out-of-bounds read vulnerability when parsing firmware description strings. The parser uses strlen() without checking if the NUL terminator is present in the firmware buffer, which can cause reads past the end of the buffer with a malformed firmware image.

A security issue was found in the Linux kernel's AMD IOMMU subsystem, involving unsafe locking in interrupt context during domain allocation. The bug triggers Lockdep warnings about potential deadlocks, which could lead to system instability.

In the Linux kernel, the ALSA hda cs35l41 driver has a vulnerability involving memory leak and potential invalid pointer access when handling the ACPI mute object. The function cs35l41_get_acpi_mute_state() does not free the ACPI object after use and assumes the returned object is a buffer with at least one byte, which can lead to memory leak or invalid pointer access with a malformed firmware response.

In the Linux kernel, the arm_mpam subsystem has a NULL pointer dereference vulnerability when destroying component configuration. The function __destroy_component_cfg() adds each mbwu_state object to the MPAM garbage list, but mbwu_state is allocated only for RISes with MBWU monitors, so some RISes may have a NULL pointer, leading to NULL dereference in the add_to_garbage() macro.

In the Linux kernel's ueagle-atm driver for USB ADSL modems, a vulnerability was found due to inconsistent criteria for distinguishing pre- and post-firmware devices between the probe and disconnect functions. A crafted USB device can exploit this mismatch, leading to an out-of-bounds read (slab-out-of-bounds) and potentially causing a system crash or privilege escalation.

In the Linux kernel's ovpn, ovpn_peer_release_p2p() may drop a reference to a new P2P peer instead of the one associated with the destroyed UDP socket. This leads to use-after-free in peer and socket cleanup paths.

In the Linux kernel's ovpn, unlock_ovpn() uses llist_for_each_entry() to iterate over the release_list, but after freeing a peer inside the loop, it reads peer->release_entry.next after the peer may have been freed, leading to use-after-free.

In the Linux kernel's hwmon occ, the poll response parser uses the static backing-array capacity as the parse boundary instead of data_length, allowing reads beyond the current response when data is truncated.

In the Linux kernel's Bluetooth btusb driver, btusb_recv_event_realtek() reads the Realtek subevent code at data[2] without checking if the event is long enough. Short events can be misclassified as coredump.

In the Linux kernel's net/packet, packet_set_ring() may re-register the fanout hook after device unregistration if po->ifindex == -1 is not treated as an invalidated binding. This leads to re-adding the hook after the device has been unregistered.

In the Linux kernel's BPF, the bpf_redirect*() helpers and skb_do_redirect() assume the existence of bpf_net_context, but in some qdisc paths it is not established, leading to NULL dereference.

In the Linux kernel's bonding, when IPv6 is disabled (ipv6.disable=1), devconf_all is not initialized, but bond_send_validate() still calls bond_ns_send_all(), leading to NULL dereference in ip6_pol_route().

A vulnerability was found in the Linux kernel's RDS (Reliable Datagram Sockets) subsystem. The destination socket lookup does not consider network namespaces, allowing a message to be delivered to a socket in a different namespace. This can lead to a use-after-free condition when the namespace is torn down, potentially causing a system crash or arbitrary code execution.

In the Linux kernel's rxrpc, rxrpc_wake_up_io_thread() checks local->io_thread but then reloads the pointer for wake_up_process(). Since the pointer is cleared with WRITE_ONCE(), the second load can see NULL even if the first did not, leading to a race.

In the Linux kernel, the dpaa2-switch driver has a reference leak for the MAC endpoint device during disconnect. fsl_mc_get_endpoint() returns a device with a reference that is not dropped in the disconnect path, causing a memory leak on every successful connection.

In the Linux kernel, the airoha network driver has a potential use-after-free in airoha_ppe_deinit(). The function replaces the NPU pointer with NULL without waiting for existing RCU readers, which could lead to accessing freed memory.

In the Linux kernel, the dpaa2-eth driver has a reference leak for the MAC endpoint device during disconnect. fsl_mc_get_endpoint() returns a device with a reference that is not dropped in the disconnect path, causing a memory leak on every successful connection.

In the Linux kernel, the airoha network driver has a DMA direction bug for the NPU mailbox buffer. airoha_npu_send_msg() always maps the buffer with DMA_TO_DEVICE, but some callers expect the NPU to write response data back into the same buffer. On non-cache-coherent architectures, this can lead to reading stale data.

In the Linux kernel, a vulnerability in the iommu/amd driver was found in the iommu_completion_wait() function due to incorrect handling of the need_sync flag. In a multi-CPU scenario, the function could return early without waiting for all previously queued commands to complete, violating the synchronization contract.

In the Linux kernel, the nfp driver lacks a check for the resource mutex allocation result. nfp_cpp_resource_find() may return success even if the mutex allocation fails, leading to a NULL pointer dereference when trying to lock the mutex.

In the Linux kernel, the wanxl driver has a potential NULL pointer dereference during early initialization failures. wanxl_pci_init_one() stores the card in driver data before the BAR is mapped, and on error wanxl_pci_remove_one() calls wanxl_reset(), which dereferences card->plx, which may still be NULL.

In the Linux kernel, the mwifiex driver lacks validation of event length supplied by firmware, leading to potential out-of-bounds read or integer underflow when handling station association events in AP mode.

In the Linux kernel, the iommu/amd driver's ivrs_acpihid command-line parser does not check the capacity of the early_acpihid_map array before appending an entry, which can lead to an out-of-bounds write when more than four entries are provided.

In the Linux kernel, the iommu/intel driver's dmar_latency_disable() function has a bug where it zeroes the entire latency_statistic array instead of a single entry, which for type > 0 leads to an out-of-bounds write and corruption of adjacent memory.

A vulnerability in the Linux kernel's TIPC subsystem affects the UDP replicast list. List updates were not serialized, which could lead to list corruption and a kernel panic. The issue is a race between adding entries from a softirq and deleting them during bearer cleanup.

In the Linux kernel, a vulnerability in the RDS module causes a NULL pointer dereference in __ipv6_chk_addr_and_flags() when attempting to bind an RDS socket to an IPv6 address while IPv6 is disabled via the 'ipv6.disable=1' parameter. This occurs because the inet6_addr_lst list is never initialized when IPv6 is disabled. The issue can lead to a system crash.

In the Linux kernel, a memory leak of FDIR filters (Perfect FDIR filters) was detected in the txgbe driver during network interface removal. Filters added while the interface is down are not freed because txgbe_fdir_filter_exit() is not called when the device is not up. The issue leads to memory leakage.

In the Linux kernel, a vulnerability in the SCTP protocol involves an incorrect capacity check of the auth_chunk_list in sctp_auth_ep_add_chunkid. The limit set to 20 entries is larger than the actual capacity of the destination structure (16 entries), which can lead to a buffer overflow during copying in sctp_association_init().

In the Linux kernel, a deadlock was detected in the pds_core driver between the reset thread and the device removal function. pci_reset_function() acquires device_lock, and pdsc_remove() is called with device_lock already held, leading to a deadlock when the reset thread is active. The fix uses pci_try_reset_function(), which does not block.

In the Linux kernel, a use-after-free vulnerability was detected in the pds_core driver related to the workqueue during device removal. The workqueue is destroyed before pdsc_teardown() is called, allowing work to be queued on the destroyed workqueue, leading to use-after-free. The fix moves destroy_workqueue() after pdsc_teardown() and orders resource freeing appropriately.

In the Linux kernel, a race condition was detected in the pds_core driver during the addition and removal of auxiliary devices. Two paths (VF reset and devlink handler) can concurrently modify the same slot, leading to memory leaks or NULL pointer dereference. The fix involves checking and updating the slot under config_lock.

In the Linux kernel, errors were detected in the element size calculation during command stream validation in the ethosu accelerator. For NHWC format, the element size is missing, and for OFM different precision bits are used than for IFM/IFM2, leading to an undersized calculation. This can result in improper validation and potential buffer overflow.

A vulnerability in the Linux kernel's SCTP implementation was found. The sctp_process_strreset_inreq() function does not validate the stream count in a RESET_IN_REQUEST from a peer, which can cause an overflow when generating the RESET_OUT_REQUEST. On interfaces with MTU larger than 65535 bytes (e.g., loopback with IPv6 jumbograms), this can lead to a __u16 overflow, undersized skb allocation, and a kernel BUG.

In the Linux kernel, a resource leak was detected in the mctp i3c module during failed driver registration. If I3C driver registration fails, the notifier and mctp_i3c_bus objects are not cleaned up, leading to memory leaks and leaving a notifier pointing into a module that failed to load. The fix adds cleanup in the error path.

In the Linux kernel TIPC subsystem, the __tipc_nl_compat_dumpit function can enter an infinite loop when the dumpit callback returns a negative errno. The while(len) loop never terminates, causing genl_mutex to never be released and other tasks waiting on it to starve in D state.

In the Linux kernel CIFS subsystem, there is a cifsFileInfo leak when kmalloc fails in deferred close drain paths. After cancelling a pending deferred close, if memory allocation fails, the loop breaks but the cifsFileInfo reference and the open server handle are not released.

In the Linux kernel mt76 WiFi driver (mt7925 model), the mt7925_sta_set_decap_offload() function can dereference a NULL pointer when an MLO station does not have a link STA for every valid link of the vif. This leads to NULL dereference when setting or clearing the MT_WCID_FLAG_HDR_TRANS flag.

In the Linux kernel mt76 WiFi driver (mt7915 model), the mt7915_mcu_bss_he_tlv() and mt7915_mcu_sta_bfer_tlv() functions can dereference a NULL pointer when mt76_connac_get_he_phy_cap() returns NULL. This leads to NULL dereference when appending the TLV.

In the Linux kernel mt76 WiFi driver (connac subsystem), the mt76_connac_mcu_uni_bss_he_tlv() function can dereference a NULL pointer when mt76_connac_get_he_phy_cap() returns NULL. There is no check of the cap pointer before dereferencing it.

In the Linux kernel mt76 WiFi driver (mt7996 model), the mt76_connac_get_he_phy_cap() function can theoretically return NULL, and the code does not check the cap pointer before dereferencing it, which can lead to a crash.

In the Linux kernel mt76 WiFi driver (mt7925 model) during reset recovery, mt7925_vif_connect_iter() can pass NULL as bss_conf to mt76_connac_mcu_uni_add_dev(), leading to a system crash. This happens when the driver bitmap contains a link whose bss_conf has already gone away.

In the Linux kernel mt76 WiFi driver (mt7996 model), the mt7996_mcu_sta_bfer_eht() function can dereference a NULL pointer when mt76_connac_get_eht_phy_cap() returns NULL. There is no check of the cap pointer before dereferencing it.