Linux kernel vulnerabilities

A use-after-free (UAF) vulnerability in the Linux kernel's NBD (Network Block Device) driver allows reconnection after disconnection, leading to a race condition and access to freed nbd_config memory.

In the Linux kernel, a vulnerability in the rtw89 driver causes double initialization of the mgnt_entry list when WoWLAN fails during resume. This corrupts the list, leading to a kernel BUG and system crash.

In the Linux kernel, the CIFS/SMB client fails to handle an unset link speed (LinkSpeed) from the server, causing a division by zero error and a system oops when reading debug data.

A vulnerability was found in the Linux kernel's XFRM (IPsec) subsystem in packet offload mode. When IP forwarding is enabled, the secpath entry is not removed after policy check, causing the packet to be re-processed by the network driver with xfrm_offload set. This leads to a NULL pointer dereference and kernel panic, as observed in the mlx5 driver.

In the Linux kernel ipmr module, a vulnerability exists where mr_mfc_uses_dev() is called for unresolved (unres) entries, causing a wild pointer dereference and system crash. This issue has been present since the initial implementation and can be exploited to trigger a kernel panic.

A vulnerability was found in the Linux kernel's ROSE protocol implementation. ROSE timers did not check if the socket was owned by a user thread, leading to a race condition and use-after-free.

In the Linux kernel, the mlx5e driver (Mellanox ConnectX) was missing a cpu_to_node call before passing the CPU ID to kvzalloc_node. Operations on a CPU with index greater than MAX_NUMNODES caused out-of-bounds access and kernel panic.

A vulnerability in the Linux kernel's TCP implementation can cause permanent connection deadlock under extreme memory pressure. When a socket temporarily advertises a zero window and fails to update its window size after memory is freed, the peer stops sending data, blocking transmission.

In the Linux kernel, during dup_mmap() failure handling, the mm_struct may be left incomplete, creating a race condition. Setting MMF_OOM_SKIP and MMF_UNSTABLE flags prevents access to the partially initialized mm_struct by other components, including uprobe.

A vulnerability was found in the Linux kernel's MPTCP (MultiPath TCP) subsystem related to the in-kernel path manager. The function setting the 'fullmesh' flag on endpoints was too permissive, allowing this flag to be set on implicit endpoints, which triggered a kernel warning and could lead to system instability.

A vulnerability was found in the Linux kernel's MPTCP implementation, related to improper handling of disconnect during TCP Fast Open. The bug can cause data stream corruption and trigger a warning in the __mptcp_clean_una function.

A use-after-free vulnerability was found in the Linux kernel's PPS (Pulse Per Second) subsystem. The bug occurs during device removal when pps_device_destruct() frees memory before file operations on open descriptors complete, leading to system crashes.

A soft lockup vulnerability was found in the Linux kernel during OOM (Out-Of-Memory) handling in cgroup. The issue occurs when a very large number of processes (e.g., 56,000) are in the OOM cgroup, causing traversal to take too long and blocking the system.

In the Linux kernel's rdma/cxgb4 driver, an integer overflow vulnerability was found on 32-bit systems. The user-controlled 'gl->tot_len' variable can cause wrapping in addition, leading to a potential security flaw.

In the Linux kernel, the i40e driver has a vulnerability causing a call trace and potentially a system panic. The issue occurs when after a PF reset and ethtool -t, the second i40e_vsi_close starts before the previous one finishes, leading to a crash.

In the Linux kernel, the tun driver has a vulnerability involving a race between tun file and device destruction. NAPIs in struct tun_file can be destroyed before the netdev, and the code does not explicitly delete the NAPI if the queue was detached first.

In the Linux kernel TIPC module, there is a NULL pointer dereference vulnerability. When creating a new node, the broadcast link is created after inserting the node into the hash table, creating a race window where an incoming packet can get the node without the link yet, leading to a kernel panic.

In the Linux kernel, a vulnerability was found in the in6_dump_addrs() function for IPv6, where rcu_dereference() was used without holding the rcu_read_lock(), causing a lockdep warning and potential synchronization issues.

In the Linux kernel, a vulnerability was found in the drm/panfrost driver where calling the madvise IOCTL twice on a BO causes memory shrinker list corruption. This leads to the BO being added to the list twice, causing memory corruption and kernel crash.

In the Linux kernel, the IMA module has a vulnerability involving a potential integer overflow in ima_appraise_measurement. When ima-modsig is enabled, the rc value passed to evm_verifyxattr() may be negative, which can cause an integer overflow.

In the Linux kernel, the pinctrl driver for Aspeed chips had a potential NULL pointer dereference in aspeed_pinmux_set_mux(). The fix adds a null check before dereferencing.

In the Linux kernel, a buffer overflow vulnerability was found in the be2net driver in the be_get_module_eeprom function. The function be_cmd_read_port_transceiver_data assumes a buffer of sufficient length, which is not always the case, potentially leading to out-of-bounds write.

In the Linux kernel, in the crypto qat module, a parameter check was added for DH to reject requests with a source buffer larger than the key size. This prevents a possible integer underflow when copying the scatterlist.

In the Linux kernel, in the crypto qat module, a parameter check was added for RSA to reject requests with a source buffer larger than the key size. This prevents a possible integer underflow when copying the scatterlist.

In the Linux kernel, KVM for x86 has a vulnerability in updating guest PTE A/D bits. The use of mapping the PTE into kernel address space is broken for VM_PFNMAP, potentially leading to access to random page frames.

In the Linux kernel, the exFAT filesystem has a vulnerability causing an out-of-bounds read in exfat_clear_bitmap. The issue is triggered by a truncate operation with size 0, leading to memory corruption. The fix adds validation of cluster numbers before using them in bitmap operations.

In the Linux kernel, the Bluetooth hci_qca driver has a vulnerability where del_timer() is used instead of del_timer_sync() before freeing, which can lead to corruption of the timer list. Additionally, the wake_retrans_timer can be rearmed via the work queue.

In the Linux kernel, in the NTFS3 filesystem, validation was added for the sectors_per_clusters field in the BOOT sector. An overly large value can lead to negative shifts or shifts larger than the field size, causing a UBSAN error.

In the Linux kernel, in ALSA USB-audio, when closing a MIDI substream, there might be pending work that accesses the released runtime object. The fix cancels the pending work at closing.

In the Linux kernel, the ath11k driver has a vulnerability that triggers a warning in mhi_pm_disable_transition() during firmware crash simulation. The issue arises from calling mhi_device_put() without a prior mhi_assert_dev_wake() when the MHI state is not normal, leading to a non-zero dev_wake counter and a warning.

In the Linux kernel, the lpfc (SCSI) driver had a null pointer dereference after failing to issue FLOGI and PLOGI. If FLOGI or PLOGI fails and there is pending dev-loss-evt work, the node may be released prematurely, leading to use-after-free.

In the Linux kernel, the ath11k driver has a buffer overflow vulnerability when processing Wi-Fi scan requests. The maximum number of SSIDs is reported as 16, but the scan_req_params structure can only hold 10, leading to overwriting the extraie pointer. The fix sets the maximum SSID and BSSID counts according to firmware capabilities.

In the Linux kernel, the dw9714 camera driver (media i2c) did not disable the voltage regulator when probing failed, causing warnings and potential issues. The fix adds regulator disabling in error handling.

In the venus media driver in the Linux kernel, a NULL pointer dereference in hfi_core_deinit was fixed. When hfi_destroy sets core->ops to NULL, hfi_core_deinit could not call core_deinit, causing a bug. The fix skips the call when necessary.

In the Linux kernel, the ath11k driver has a vulnerability causing a crash when modules are removed (rmmod) with spectral scan enabled. The issue is due to not disabling spectral scan before cleaning the data buffer, leading to a NULL pointer dereference. The fix sends a WMI command to firmware before cleaning the buffer.

In the Linux kernel on ARM64, a vulnerability was found in the handling of unknown system calls in compat (32-bit) mode. When a compat process invokes an invalid syscall number, the kernel incorrectly interprets this number as an ESR_ELx value, leading to misleading error messages in dmesg that suggest pointer authentication issues. The fix sets ESR_ELx to 0 to avoid incorrect interpretation.

A vulnerability in the Linux kernel's ath10k driver causes a double free crash during system suspend when the driver is in the RESTARTING state after firmware recovery. The issue occurs when a suspend event happens during the restart process, leading to two calls to ath10k_halt() and a kernel panic.

In the Linux kernel, the ASoC SOF subsystem for IPC3 topologies has an out-of-bounds access vulnerability in sof_get_control_data(). The function assumes bytes payload but can be called for other types, leading to incorrect memory reads.

In the Linux kernel, the Intel ice network driver's ice_get_vf_vsi function can return NULL in some cases, and many places did not check the pointer validity, potentially leading to NULL dereference. The fix adds checks for the return value everywhere.

In the Linux kernel, the fbdev defio driver has a vulnerability causing pagelist corruption due to a race between processes in fb_deferred_io_mkwrite() and fb_deferred_io_fault(). One process adds a page to the list while another initializes the same page without lock protection.

In the wl1251 WiFi driver in the Linux kernel, a vulnerability was found where stack parameters are used for DMA, which after the introduction of vmap'ed stacks leads to kernel panic. The issue occurs in several places in the driver, e.g., when accessed via SDIO, making it unusable on platforms like OpenPandora.

In the Linux kernel, the MediaTek VCODEC driver (mtk-vcodec-dec) has a vulnerability causing a kernel crash when removing the module. When the driver operates in subdev mode, the dev->pm.dev pointer is NULL, leading to a call to __pm_runtime_disable on an invalid address and a system panic.

In the Linux kernel, the mt76 driver had a race condition leading to use-after-free on station removal. In a small race window, ongoing tx activity can cause an skb to be added to the status tracking idr after it has been cleaned up, keeping the wcid linked in the status poll list.

In the rtw89 driver (for WiFi cards), the rtw89_phy_cfo_parse() function did not validate mac_id before accessing an array, leading to an out-of-bounds read. The fix adds an index check before array access.

In the ti_sci_pm_domains driver in the Linux kernel, a check for the return value of devm_kcalloc was added. If memory allocation fails, the function returns -ENOMEM to avoid a later NULL pointer dereference.

In the Linux kernel, the arm_scmi firmware subsystem has a vulnerability due to improper validation of the number of protocols during protocol list enumeration. The check uses a sum of unsigned integers that can overflow and bypass the validation. The fix avoids the addition in the validation.

In the f2fs filesystem in the Linux kernel, a vulnerability was found involving dereferencing a stale list iterator after the loop body. If no break is hit, the iterator becomes a bogus pointer, and dereferencing it (e.g., cur->page) could load out-of-bounds/undefined values, which may be exploited by an attacker.

In the Linux kernel's mac80211 module, a use-after-free was found in channel context (chanctx) code. After freeing the old context in ieee80211_vif_use_reserved_reassign(), further referencing it leads to UAF.

In the staging r8188eu WiFi driver in the Linux kernel, a vulnerability was found due to missing check before writing to the ->Ssid array in the rtw_wx_set_scan() function. There is a check to prevent read overflow, but no check to prevent writing beyond the end of the array, which can lead to buffer overflow.

In the F2FS filesystem in the Linux kernel, a bug in dec_valid_node_count() that caused BUG_ON was fixed. When total_valid_block_count or total_valid_node_count were corrupted to zero, the function panicked. The fix prints a warning and sets SBI_NEED_FSCK instead of panicking.