Linux kernel vulnerabilities

In the Linux kernel, in the vivid driver, there are cleanup bugs in vivid_init(). When platform_device_register() fails, the embedded struct device in vivid_pdev has already been initialized, but the failure path does not drop the device reference, leading to a reference leak. Additionally, the unreg_driver label incorrectly calls platform_driver_register() instead of platform_driver_unregister(), breaking cleanup when workqueue creation fails after successful driver registration.

A vulnerability was found in the Linux kernel's ALSA sequencer subsystem. The issue is that the queue deletion function does not close a re-opened timer, leading to a use-after-free condition. An attacker with access to /dev/snd/seq can exploit this flaw to corrupt kernel memory.

In the Linux kernel, in the ALSA timer subsystem, there is an issue with draining slave callbacks before the master detaches them. When a master instance is closed, remove_slave_links() clears each slave's ->timer, and the slave's own close then skips the drain entirely, which can lead to use-after-free if the slave's callback is still running.

In the Linux kernel, in the ALSA timer subsystem, there is an issue with re-entering an instance callback that is still running. The userspace-driven timer (utimer) TRIGGER ioctl calls snd_timer_interrupt() directly with no serialization, so two threads can run snd_timer_interrupt() on the same timer concurrently. The SNDRV_TIMER_IFLG_CALLBACK bit cannot represent two concurrent callbacks, leading to use-after-free.

In the Linux kernel, in the wifi ath6kl driver, there is an out-of-bounds (OOB) access issue caused by the firmware-supplied ADDBA window size. The aggr_recv_addba_req_evt() function logs a debug message when win_sz is out of range but does not return. The out-of-range win_sz is then used to compute an allocation size, leading to zero-size or overflowed allocations and subsequent out-of-bounds access.

In the Linux kernel, in the wifi ath6kl driver, there is a use-after-free issue in the aggr_reset_state() function. The function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_destroy(). If the timer callback is executing at that time, it may access freed memory.

In the Linux kernel's mwifiex driver, there is a NULL pointer dereference vulnerability. When an access point (AP) advertises HT Capabilities but lacks the HT Operation element, the driver attempts to read a non-existent bcn_ht_oper pointer during TDLS link setup, causing a system crash.

In the Linux kernel's wilc1000 driver, there is an out-of-bounds read vulnerability when processing association responses. The driver does not validate that the frame length is sufficient to contain the header, which can lead to reading beyond the buffer or length wrap-around.

In the Linux kernel's mt76 driver (mt7615 subsystem), there is a NULL pointer dereference vulnerability. The TXRX_NOTIFY event is handled on all buses, but the DMA queue cleanup function is only implemented for mmio buses, leading to a NULL call on USB and SDIO buses.

In the Linux kernel's mt76 driver (mt7921 subsystem), there is a NULL pointer dereference vulnerability. The TXRX_NOTIFY event is handled on all buses, but the DMA queue cleanup function is only implemented for mmio buses, leading to a NULL call on USB and SDIO buses.

In the Linux kernel's mt76 driver (mt7925 subsystem), there is a NULL pointer dereference vulnerability. The TXRX_NOTIFY event is handled on all buses, but the DMA queue cleanup function is only implemented for mmio buses, leading to a NULL call on USB bus.

In the Linux kernel's brcmfmac driver, there is a double-free vulnerability of DMA buffers. The function releasing scratch buffers does not null the pointers after freeing, so when called multiple times (e.g., during reset and removal) it leads to freeing the same allocation again.

A vulnerability in the Linux kernel's ath12k WiFi driver causes a NULL pointer dereference during driver unbinding. Two hash tables are destroyed without checking if they were initialized, leading to a crash when device initialization fails, such as in VMs due to MSI addressing issues.

In the Linux kernel's staging rtl8723bs driver, there is an out-of-bounds read vulnerability in the rtw_get_wps_ie() function. The function processes IE data from network frames without validating that the header and payload fit within the buffer, which can lead to reading beyond memory.

A use-after-free vulnerability was found in the Linux kernel's Bluetooth subsystem (hci_sync). The issue stems from missing synchronization of the UUID list between asynchronous work and add_uuid/remove_uuid operations, potentially leading to reading freed memory.

A use-after-free vulnerability was found in the Linux kernel's Bluetooth RFCOMM subsystem. The rfcomm_tty_set_termios() function accesses the session without holding the proper lock, allowing the krfcommd thread to free the session while it is still in use, leading to memory corruption.

A vulnerability in the Linux kernel's transfer_args_to_stack() function in fs/exec.c involves unsigned long loop counter wrap. When bprm->p drops below PAGE_SIZE, the loop condition becomes always true, leading to out-of-bounds read and copying data from an invalid address to the process stack. The issue affects only CONFIG_MMU=n builds and can cause a system crash.

In the Linux kernel's binfmt_misc mechanism, the have_execfd flag is set before the interpreter is opened. If the interpreter open fails, the flag remains set, leading to a NULL pointer dereference in begin_new_exec() and a system crash.

In the Linux kernel for the LoongArch architecture, there is an initialization order bug: jump_label_init() is called after parse_early_param(), causing static key modifications in early param handlers to not work correctly. As a result, when memory allocation profiling is enabled and disabled via a boot parameter, the kernel fails to boot. The fix moves jump_label_init() before parse_early_param().

In the Linux kernel CD-ROM subsystem, there is a stack out-of-bounds read vulnerability in CDROMVOLCTRL. During processing, a 32-byte stack buffer is read beyond its boundary when the device returns a block descriptor. The fix reduces cgc->buflen by the same amount as the buffer pointer adjustment so the MODE SELECT transfer covers only the intended parameter list.

In the Linux kernel Stratix10 Service Layer firmware, there are bugs causing memory leaks and list corruption. The fix adds memory freeing on the error path, changes allocation from devm_kzalloc() to kzalloc() with explicit kfree(), and removes an erroneous list_del() that corrupted the list head.

In the Linux kernel comedi_parport driver, there is an issue with premature interrupts that can lead to a general protection fault. The fix changes the initialization order in parport_attach() so hardware registers are initialized before requesting the interrupt, and adds a test in the interrupt handler to ensure the comedi device is fully attached.

In the Linux kernel, the MEI bus cleanup has a concurrency issue where mei_device is accessed without proper locking, potentially leading to use-after-free. The fix protects queue cleanup and WARN traversal with the device lock and moves the traversal before dropping the bus reference.

In the Linux kernel, the Intel TH driver has a reference leak for MSC output devices. intel_th_output_open() takes a reference that is not released on file close, causing a memory leak on every MSC output open. The fix moves the reference drop to intel_th_msc_release().

In the Linux kernel, the NSM misc driver's nsm_dev_ioctl() can unlock a mutex that was never locked when copy_from_user fails before acquiring the lock, leading to a bad unlock balance warning. The fix returns immediately on pre-lock failure.

In the Linux kernel, the NSM misc driver does not set the owner field in file operations, so opening /dev/nsm does not take a module reference. If the driver is a module, an open file descriptor can survive rmmod, leading to calls into unloaded code. The fix sets owner to THIS_MODULE.

In the Linux kernel tracing subsystem, there is an issue with delayed module refcount for the 'enable_event' trigger. The module refcount is released immediately while trigger data may still be used after the RCU grace period, leading to use-after-free. The fix moves the module ref release into the delayed callback.

In the Linux kernel tracing subsystem, the mmiotrace read() function can dereference a NULL pointer when hiter->dev is not found (e.g., no PCI device). The fix adds a check for hiter->dev before dereferencing.

In the Linux kernel tracing subsystem, there is a resource leak when closing the trace_pipe file for mmiotrace. mmio_pipe_open() allocates resources that are not freed on close because the pipe_close callback was not set. The fix sets .pipe_close to mmio_close.

In the Linux kernel tracing subsystem, there is a union collision between the module pointer and refcnt in struct trace_event_call for dynamic events. When refcnt is non-zero, the module field is interpreted as a pointer, leading to invalid pointer dereference during event filtering. The fix checks the TRACE_EVENT_FL_DYNAMIC flag before using the module field.

In the Linux kernel, a vulnerability in the ublk subsystem was found where waiting on ub->completion instead of the actual device readiness (ublk_dev_ready()) can lead to a deadlock. If the ublk server sends END_USER_RECOVERY without a successful START_USER_RECOVERY, the device may be marked LIVE and the requeue list not kicked again, causing requests (e.g., flush_rq) to be stranded and blocking fsync and teardown.

In the Linux kernel for ARM64, huge_ptep_get() can be passed an unaligned virtual address, leading to incorrect determination of contiguous PTE count and potential out-of-bounds access, causing kernel panic. The fix aligns the pmdp pointer to the contpmd base before comparison.

A use-after-free vulnerability was found in the Linux kernel's mptcp_pm_userspace_get_local_id() function for MPTCP. The address entry is looked up under a spinlock, but its id is read after the lock is dropped, allowing a concurrent deletion to free the entry before the read. The issue was confirmed by a KASAN report.

In the Linux kernel, the afs_edit_dir_remove() function incorrectly uses afs_dir_find_block() instead of afs_dir_get_block() to get block 0. This may cause the page containing the block to be switched, leading to incorrect behavior.

In the Linux kernel, a vulnerability was found in the Btrfs filesystem related to data compression for data relocation inodes. During data relocation, when a relocation inode is written back under memory pressure, compression can cause an inline extent to be created, leading to an error in get_new_location() and a system crash.

In the Linux kernel, the vma_can_userfault() function did not reject registration of shadow stack and VM_SPECIAL VMAs, allowing registration of special memory areas via userfaultfd. The fix adds rejection of VM_SHADOW_STACK and VM_SPECIAL, except for hugetlb VMAs.

In the Linux kernel, the damon_set_regions() function did not validate ranges, allowing empty monitoring regions to be set. This may lead to WARN_ONCE() warnings and division by zero in damon_merge_two_regions(). The fix adds range validation.

In the Linux kernel, the damon_set_regions() function did not check whether input ranges are sorted and non-overlapping, which could lead to unexpected DAMON behavior, including creation of negative-size regions and division by zero. The fix restores validation of the assumptions.

A vulnerability was found in the Linux kernel's handling of device-private PMD entries during rmap walks. The bug causes these entries to be incorrectly treated as migration entries, potentially leading to memory corruption. Additionally, a race condition with PMD splitting can occur, worsening the issue.

In the Linux kernel, the SCTP protocol has a use-after-free vulnerability in the auth_enable sysctl during network namespace teardown. The sysctl registration was performed before the control socket was created, allowing access to a non-existent object. The fix moves sysctl registration to sctp_ctrlsock_init() and properly handles unregistration.

In the Linux kernel's libceph module, a NULL pointer dereference can occur during localized read selection when a CRUSH type name is missing. The fix skips such malformed parent buckets unless both bucket name and type name metadata are present.

In the Linux kernel's libceph module, a monmap with zero monitors was treated as valid, potentially leading to a client crash. The fix rejects such monmaps during decoding.

In the Linux kernel's libceph module, debugfs files were removed after the monitor client teardown, potentially leading to a use-after-free. The fix removes debugfs files before stopping the OSD and monitor clients.

In the Linux kernel's AMT module, delayed works could access the freed amt_dev structure after device removal. The fix uses disable_delayed_work_sync() in amt_dev_stop() to prevent re-queueing of works.

In the Linux kernel's binfmt_elf_fdpic module, there is a vulnerability where only the first PT_INTERP entry is supposed to be handled, but due to a loop logic error, binaries with multiple PT_INTERP entries overwrite interpreter_name and interpreter pointers, causing memory leaks and keeping a write denial on the file. An unprivileged user can exploit this to permanently block file writes.

A vulnerability in the Linux kernel's do_thaw_all() function in fs/super causes a double unlock of the s_umount semaphore during emergency thawing of frozen filesystems. This corrupts the rwsem state and triggers a DEBUG_RWSEMS warning, potentially destabilizing the system.

In the Linux kernel's forget_cached_acl() function, the ACL_DONT_CACHE state is not preserved, which for filesystems that opted out of ACL caching (e.g., FUSE) can lead to returning stale ACL values. The issue arises because forget_all_cached_acls() calls in FUSE code do not account for this state and remove it.

In the Linux kernel's fscrypt module, in find_or_insert_direct_key(), there is a missing comparison of the super_block pointer, causing entries in the global fscrypt_direct_keys table to be shared between different super_blocks. This can lead to a use-after-free when a key is evicted after the super_block's lifetime ends.

In the Linux kernel's fscrypt module, fscrypt_get_devices() uses dynamic allocation for an array of block device pointers, which can fail, especially during key eviction under direct reclaim. The unhandled failure leads to a use-after-free.

In the Linux kernel's ftrace module, the trace_parser structure is shared between threads during write and release operations, leading to a race condition on the idx, cont, and buffer fields. This can cause corrupted input or undefined behavior.