Linux kernel vulnerabilities

In the F2FS filesystem in the Linux kernel, a problem with not clearing dirty inode in f2fs_evict_inode() was fixed. When inode node and dnode node share the same nid, dnode truncation invalidates its NAT entry, causing failure when truncating inode node and leaving it dirty. The fix clears dirty for inode and sets SBI_NEED_FSCK flag.

In the f2fs filesystem in the Linux kernel, a vulnerability was found due to missing sanity check on block address in the f2fs_do_zero_range() function. After fuzzing the filesystem image, block mapping info in the inode can be inconsistent with the SIT table, leading to kernel panic when updating SIT with an invalid block address.

In the F2FS filesystem in the Linux kernel, additional sanity checks for inline data inodes were added. The issue occurred when an inode had both inline_data and encrypted flags, leading to inline data conversion and page cache pollution, then panic in clear_inode(). The fix adds sanity checks in sanity_check_inode().

In the Linux kernel, the f2fs filesystem had an inconsistency between the checkpoint's valid block count and the SIT table, which could trigger a kernel panic during garbage collection. The fix adds consistency validation.

In the Linux kernel, a vulnerability was found in the ext4 filesystem that allows cycles in the h-tree stored inside a directory. A maliciously corrupted filesystem can lead to kernel corruption of tree nodes and access to unallocated memory. The issue is fixed by verifying that traversed block numbers are unique.

In the Linux kernel, in ip_gre, the check was revised to test csum_start instead of the transport header. This prevents overflow in lco_csum when GRE packets with TUNNEL_CSUM are processed.

In the Linux kernel, in the drm/etnaviv driver, a check was added for reaped mappings in etnaviv_iommu_unmap_gem. If the mapping is already reaped, the unmap is a no-op to avoid double removal and data structure corruption.

In the Linux kernel, a fix was made for accessing tp->snd_cwnd in TCP, which could be set to an illegal value, leading to warnings and potential bugs.

In the Linux kernel, in the xprtrdma module, when an RDMA server returns a fault format reply, the NFSv3 client may treat it as a callback (bcall) when the bc service does not exist. This leads to a NULL pointer dereference in rpcrdma_bc_receive_call. The fix treats all calls as not a bcall when bc_serv is NULL.

In the Linux kernel, the f2fs filesystem functions f2fs_is_valid_blkaddr and __is_bitmap_valid triggered WARN_ON warnings that could be exploited with malicious data. The fix replaces WARN_ON with dump_stack to avoid unnecessary warnings.

In the Linux kernel, the f2fs filesystem has a vulnerability causing an infinite loop when flushing node pages. The issue occurs when I/O operations return EIO errors, leading to a system hang.

In the Linux kernel, a deadlock in rtw_surveydone_event_callback() in the staging rtl8723bs driver was fixed. The deadlock occurred due to holding a lock while calling del_timer_sync().

A vulnerability in the Linux kernel's Ceph filesystem can cause a deadlock when a client holds Fwb caps and waits for a getattr(Fsr) response while the MDS server tries to revoke caps. This blocks write operations.

In the Linux kernel, in the AMD Display driver, there is a vulnerability involving division by zero. If a read modulo value is 0, it can cause a kernel panic.

In the Linux kernel, in ALSA OSS, the PCM OSS buffer allocation overflow was fixed. A 1MB limit for period size was added and array_size() and array3_size() are used for multiplications to prevent integer overflow.

In the Linux kernel, a vulnerability was found in the access_ok() function on three architectures, where checking the end of a user access against the address limit does not account for possible integer overflow. Passing a negative length or another overflow returns success when it should not.

In the Linux kernel, an issue in tpm2_del_space() in the TPM module was fixed, where missing use of try_get_ops() could lead to a NULL pointer dereference in a tiny race window.

In the Linux kernel, there is a vulnerability involving integer overflow on 32-bit systems in the operation 'len * sizeof(*p)' in the NFSD module. This could lead to incorrect behavior or potential exploitation.

In the Linux kernel, a bug in the OCFS2 filesystem caused a crash when mounting with quota enabled. The issue occurred during initialization of dqi_gqlock when the corresponding dqi_type and dqi_sb were not properly initialized. The bug was introduced by commit 6c85c2c72819, which aimed to avoid accessing uninitialized variables in error cases. The fix properly initializes global quota info.

In the Linux kernel, a use-after-free (UAF) vulnerability was found in the BFQ scheduler. The issue involves moving the oom_bfqq queue, which can lead to a write to freed memory during module removal.

In the Linux kernel, a bug in the memstick/mspro_block driver regarding read-only devices was fixed. Instead of checking for read-only state in ->open and leaking a reference in case of a read-only device, set_disk_ro is used to propagate the read-only state to the block layer.

A use-after-free vulnerability was found in the bfq_dispatch_request function of the BFQ scheduler in the Linux kernel. The issue occurs during normal SCSI-MQ testing and can lead to memory corruption.

In the Linux kernel for the parisc architecture, a vulnerability was found involving non-access data TLB cache flush faults. The fdc and fic instructions in flush_user_dcache_range_asm and flush_user_icache_range_asm cause faults that do not invalidate the cache line, potentially leading to memory corruption. The problem was hidden by nullification of the flush instructions.

In the Linux kernel, the F2FS filesystem lacked validation of the curseg->alloc_type value, which could lead to an out-of-bounds access to the sbi->block_count[] array when mounting a corrupted image, triggering a UBSAN error. The issue was reported by Wenqing Liu and affected kernel versions 5.17-rc4 and 5.17-rc6.

In the Linux kernel, a vulnerability in the f2fs filesystem causes a hang during statistics read and unmount operations. The issue is due to using a mutex instead of a spin_lock, leading to thread deadlock.

In the Linux kernel, the btrfs filesystem has a double bio completion issue during errors in compressed reads. The function btrfs_submit_compressed_read() may call bio_endio() on the bio, and then btrfs_submit_data_bio() does it again, leading to incorrect behavior.

In the Linux kernel, the imx-jpeg media driver has an out-of-bounds array access bug. During a JPEG parsing error, the slot is not yet acquired and may have the default value MXC_MAX_SLOTS, leading to out-of-bounds read and modification of adjacent data.

In the Linux kernel, a bug in the sm712fb driver (video: fbdev) caused a crash when writing three bytes to the framebuffer. The issue occurred in the smtcfb_write() function and was caused by an error in the endianness conversion code. The fix removes the open-coded endianness fixup-code.

In the Linux kernel, the SCSI qla2xxx driver incorrectly freed a pre-allocated structure during purex packet handling, causing a system crash during module load/unload tests. The fix skips that entry.

In the Linux kernel, the qla2xxx SCSI driver has a race condition between the timeout handler and the async completion function, leading to use-after-free and a NULL pointer dereference. The fix introduces a reference counter for the SRB structure to synchronize access.

In the Linux kernel, the Bluetooth subsystem (hci_event) ignores multiple connection complete events for the same handle. Previously, this led to multiple device registration and memory corruption.

In the Linux kernel, in the AMDGPU driver, there is a reference count leak of a dma_fence object in the error path of amdgpu_cs_fence_to_handle_ioctl(). When info->in.what falls into the default case, the function returns -EINVAL without decrementing the reference count, leading to memory leaks.

In the Linux kernel, in the AMDKFD driver, there is a deadlock during SVM range restore work when a process exits. kfd_process_notifier_release flushes svm_range_restore_work, which can deadlock with deferred_list work when mmput releases the last user and calls exit_mmap.

A vulnerability in the Linux kernel's ath11k PCI driver causes a system crash during suspend when the board file is not found. The issue arises from asynchronous driver initialization not completing before the suspend handler runs. The fix adds a check for the ATH11K_FLAG_QMI_FAIL flag during both suspend and resume.

In the Linux kernel, the mt76/mt7921 driver has a crash vulnerability when the network interface fails to start. If startup fails, the scheduled reset_work may execute after memory cleanup, leading to a use-after-free. The fix cancels the work item before cleanup.

In the Linux kernel, a memory leak in the mpi3mr SCSI driver was fixed. Memory segments of the operational reply queue were not freed when unloading the driver.

A vulnerability in the Linux kernel's ath11k driver causes a deadlock when flushing the management transmit queue. This prevents management frames from being sent within 5 seconds, leading to errors and frame drops.

In the Linux kernel, in the HISI SAS driver for v3 hardware, there is an issue with the order of freeing IRQ vectors. If the driver fails to request the channel IRQ or fatal IRQ during probe, it frees the IRQ vectors before freeing the IRQs, leading to a kernel BUG.

In the Linux kernel's SCSI libfc driver, there is a use-after-free vulnerability in fc_exch_abts_resp(). fc_exch_release(ep) decreases the reference count, and when it reaches zero, the object is freed, but it is still used in subsequent code, leading to use-after-free.

In the Linux kernel, a crash in monitor mode with the mt76 SDIO driver was fixed. The RXD size was increased from 128 to 256 to avoid nonlinear buffer issues.

In the Linux kernel, the netfilter conntrack module has an issue with garbage collection autotuning. The change in gc behavior causes netlink event overflows when the hash table is large. The fix adjusts the gc schedule to avoid overflows.

In the Linux kernel, an inode reference leak in ceph_get_snapdir() was fixed. The reference was not released in error handling cases.

In the Linux kernel, a memory leak in ceph_readdir was fixed when note_last_dentry returns an error. last_readdir is reset and a comment was added.

In the Linux kernel, an error handling issue in wfx_init_common() in the staging wfx driver was fixed. One error handler did not call ieee80211_free_hw(hw), potentially causing a memory leak.

In the Linux kernel, an issue in the staging vchiq_core driver was fixed where find_service_by_handle could return NULL for an invalid handle, leading to a NULL pointer dereference.

In the Linux kernel, a possible memory leak in MMU DR fini in the habanalabs driver was fixed. A copy-paste error caused a leak when host-resident shadow is NULL.

In the Linux kernel's qede driver, a vulnerability exists where skb allocation is not confirmed before use. qede_build_skb() assumes build_skb() always works, but it can fail under memory pressure, causing a kernel panic. The fix adds a check for NULL return from build_skb().

A vulnerability in the Linux kernel's AMD GPU driver (amdgpu/drm) affects the dcn30_internal_validate_bw function. Missing FPU protection during swath width calculations (CalculateSwathWidth) can lead to a general protection fault, causing system crashes during prolonged WebGL Aquarium usage, especially with DRM debug logs enabled.

In the Linux kernel, a NULL dereference crash in the svc_deferred_event trace class in SUNRPC was fixed, occurring when an svc_rqst is deferred while sunrpc tracing is enabled.

In the Linux kernel, in Hyper-V drivers (vmbus), sysctl_record_panic_msg is now deactivated by default in isolated guests. The panic page may contain guest-sensitive information, so it is no longer dumped to Hyper-V by default. Comments in hyperv_panic_event and hyperv_die_event were also updated.