Linux kernel vulnerabilities

In the Linux kernel, the aqc111 USB driver has out-of-bounds access vulnerabilities in the aqc111_rx_fixup() function. A malicious or defective USB device can trigger out-of-bounds reads of the metadata array, corruption of data in cloned SKBs, and construction of a packet with a tail beyond the buffer end. The fix is not described in this description.

In the Linux kernel IPv6 module, there is a kernel panic vulnerability when forwarding a packet if the input interface has no associated in6 dev. This can be triggered using tc commands with netem corrupt.

In the Linux kernel, the dm-integrity module has a memory corruption vulnerability when the tag_size parameter is smaller than the actual digest size. This can cause writes beyond the end of the ic->recalc_tags array, leading to memory corruption. The issue is fixed by increasing the tags array with sufficient padding.

In the Linux kernel, a vulnerability related to the BFQ scheduler was fixed, which could lead to use-after-free (UAF). The commit regarding honoring already-setup queue merges was restored after being reverted, as the bug was fixed in another commit.

In the Linux kernel, a vulnerability in the zoran driver (media: staging: media: zoran) was fixed where the buffer number was miscalculated in zoran_reap_stat_com when tmp_dcim=1. This led to a NULL pointer dereference later. The fix corrects the calculation and adds a check to prevent recurrence.

In the Linux kernel, a vulnerability in the zoran driver (media: staging: media: zoran) was fixed by moving the videodev allocation. Code was moved out of zr36057_init() into new functions handling zr->video_dev, which eases code reading and fixes a zr->video_dev memory leak.

A vulnerability in the Linux kernel's pfifo_tail_enqueue function allows incrementing the qlen counter without dropping packets when sch->limit is set to 0. This causes a mismatch between parent and child qlen values, potentially enabling user-to-kernel privilege escalation.

A race condition was found in the Linux kernel between device unregistration and ethtool operations (e.g., changing channel count). During unregistration, a mutex is destroyed, causing a DEBUG_LOCKS_WARN_ON warning and potential deadlock. The fix adds a broader check to deny ethtool operations on devices being dismantled.

In the GFS2 filesystem in the Linux kernel, the address space of an inode is not truncated when flipping the GFS2_DIF_JDATA flag. This can lead to mixing pages using buffer heads and iomap_folio_state, which is not allowed.

In the Linux kernel, the v3d graphics driver failed to set the job pointer to NULL after job completion. This caused a false warning when unloading the driver, indicating the job was still active.

In the Linux kernel's vfio/platform driver, lack of bounds checking for count and offset arguments from userspace in read/write syscalls. Limiting offset to 40 bits does not prevent out-of-bounds device access.

In the Linux kernel, the bnxt_en driver fails to recalculate network features after XDP detachment, causing HW-GRO not to re-enable automatically. This can lead to a NULL pointer dereference and system crash during subsequent reconfiguration.

A vulnerability in the Linux kernel's GTP driver causes the gtp network device to remain active after removing the network namespace (netns) where the UDP socket was created. This leads to a ref_tracker warning and potential reference leak.

In the Linux kernel, a vulnerability in the PFCP driver caused the network device (e.g., pfcp0) to be linked to the device's network namespace instead of the UDP socket's namespace. This led to a reference leak and a kernel splat when the namespace containing the UDP socket was removed.

In the Linux kernel's FEC (Fast Ethernet Controller) driver, a vulnerability was found where the error return from page_pool_dev_alloc_pages is not handled. When memory allocation fails, the driver uses a NULL pointer, causing a system crash. This occurs under memory pressure, e.g., during SMB writes to a SATA HDD on i.MX6Q.

In the Linux kernel, the vsock/virtio mechanism did not discard packets after a transport change. This can lead to a NULL pointer dereference of vsk->transport when the socket is reassigned or detached.

In the Linux kernel's dm-thin module, a vulnerability was found in the get_first_thin function, which used an unsafe list_empty() + list_first() sequence in RCU-protected code. This can lead to a race condition where one thread removes a list entry while another reads it, causing a pointer dereference to the pool structure and a system crash.

In the Linux kernel, a vulnerability in the gpio-virtuser module was found due to missing cleanup of the lookup table after a failed virtual GPIO device probe. This leads to inability to retry the device and memory leaks.

In the Linux kernel, a vulnerability in the netdev module was found where NAPI IDs were not fully namespaced. The netlink interface must ensure that a NAPI instance belongs to the same network namespace as the genl socket owner.

In the Linux kernel's io_uring/eventfd subsystem, a vulnerability was found where io_eventfd_do_signal() called from an RCU callback may directly free the io_ev_fd structure instead of deferring it to another RCU grace period. This could lead to use-after-free or other memory errors.

In the Linux kernel, a vulnerability was found due to overly strict assertions (WARN_ON) when file handle encoding fails. These assertions are incorrect because encoding can fail for various reasons, and main users (nfsd, name_to_handle_at) are already prepared to handle errors.

A race condition was discovered in the Linux kernel when printing the CPU map (cpumap). Modifying the CPU mask during the print operation causes a mismatch in formatted string length, leading to a warning and potential error in kvasprintf. The fix caches the cpumask into a temporary variable before printing.

In the Linux kernel HNS3 network driver (hclge), hclge_fetch_pf_reg() does not account for the TQP BAR space split into two segments (TQPs 0-1023 and 1024-1279), leading to out-of-bounds BAR memory access when the number of TQPs exceeds 1024.

In the Linux kernel, a vulnerability in the netfilter conntrack module allows the hashtable size to exceed INT_MAX during resize, triggering a WARN_ON_ONCE in __kvmalloc_node_noprof() due to missing __GFP_NOWARN flag. This issue is limited to the init_netns namespace.

In the Linux kernel, a vulnerability was found in the sch_cake network scheduler due to an underflow of per-host bulk flow counters, leading to out-of-bounds memory access. Bounds-checking helper functions were added to prevent such issues.

In the Linux kernel's AFS filesystem (kafs), the maximum allowed cell name length (256 bytes) exceeds the procfs filename limit of 255 characters, causing a warning and failure when creating a directory under /proc/net/afs/. The fix limits the maximum cell name length to 253 characters, also ensuring safe creation of the /afs/.<cell>/ mount point.

A vulnerability in the Linux kernel's AMD PMC driver (platform/x86/amd/pmc) causes an unbalanced IRQ1 wake disable when i8042 did not enable the wakeup, leading to a WARN() warning and potential wake_depth underflow.

In the Linux kernel's SCTP subsystem, sysctl cookie_hmac_alg uses current->nsproxy to obtain the net structure, which can lead to null-ptr-deref during process exit, causing system crash.

In the Linux kernel's SCTP subsystem, sysctl auth_enable uses current->nsproxy to obtain the net structure, which can lead to null-ptr-deref during process exit, causing system crash.

In the Linux kernel, in the SCTP subsystem, a vulnerability was found in the sysctl handler for UDP port, which uses the 'current->nsproxy' structure. This can lead to a null-pointer dereference (Oops) when the current process is exiting, potentially exploited by an attacker to cause a system crash.

A bug in the Linux kernel disabled hardware checksum offload for BIG TCP IPv6 packets with extension headers. The issue specifically affected the IPV6_TLV_JUMBO header, which is only used for packet capture (e.g., tcpdump) and not transmitted by physical devices. The fix restores offload support for this specific case.

In the Linux kernel's net/smc module, during CLC message reception, the length field in the header can exceed the buffer size, leading to a deadloop when draining data. The patch checks the return value of sock_recvmsg to prevent infinite looping.

In the Linux kernel's DLM (Distributed Lock Manager), a vulnerability was found causing a possible null pointer dereference in a logging function when called from request_lock(), as lkb->lkb_resource is not yet assigned. Additionally, a resource name could be a non-printable byte array, leading to incorrect ASCII assumption.

A vulnerability in the Linux kernel causes soft lockups in fib6_select_path under high IPv6 next hop churn. The issue occurs when traversing a multipath circular linked list while nodes are concurrently deleted on another core, leading to an infinite loop and system panic. The fix applies RCU primitives to protect list access.

In the Linux kernel, the ACPI NFIT module has a vulnerability involving an out-of-bounds read (vmalloc-out-of-bounds) in the acpi_nfit_ctl function. The issue arises from lack of buffer size validation before accessing the nd_cmd_pkg structure, which could lead to undefined behavior.

A use-after-free vulnerability was found in the sg_release() function of the Linux kernel's SCSI sg driver. The issue occurs because kref_put() is called before releasing the open_rel_lock mutex, potentially causing premature memory deallocation and access to freed memory.

In the Linux kernel, a bug in ksmbd (SMB server) regarding out-of-bounds read in ksmbd_vfs_stream_read was fixed. An offset from client could be a negative value, which could lead to an out-of-bounds read from the stream_buf. This issue occurs when setting 'vfs objects = streams_xattr parameter' in ksmbd.conf.

In the Linux kernel, a vulnerability was found in ksmbd that allows an out-of-bounds write in ksmbd_vfs_stream_write. The issue occurs when a client sends a negative offset value, potentially allowing data to be written outside the allocated buffer. This is triggered when 'vfs objects = streams_xattr' is set in ksmbd.conf.

A use-after-free (UAF) vulnerability was found in the Linux kernel's flush request mechanism during tag iteration. The issue occurs because blk_mq_clear_flush_rq_mapping() is not called during SCSI scanning, as QUEUE_FLAG_INIT_DONE is cleared in del_gendisk, leading to use of freed memory.

In the Linux kernel, the NFS blocklayout module has an issue with unregistering an invalid block device. During unmount of an NFS filesystem with pNFS SCSI layout, a NULL pointer dereference on block_device may occur, leading to a crash.

In the Linux kernel, the svcrdma component has an integer overflow issue. An untrusted segcount value can cause overflow when calculating buffer size, potentially leading to boundary check failures and security issues.

In the Linux kernel, the Bluetooth subsystem (hci_event) aligns the BR/EDR JUST_WORKS pairing method with LE. The change now requires user confirmation for JUST_WORKS pairing, consistent with policies of tools like bluetoothd.

In the Linux kernel, the netfilter ipset module lacks a range check in the bitmap_ip_uadt function when IP_TO is not present but CIDR is set. This can lead to incorrect IP range validation, potentially allowing unauthorized access or other security issues.

A data race vulnerability was found in the Linux kernel around the sk->sk_forward_alloc field in the TCP stack. It occurs when two threads concurrently call tcp_v6_do_rcv() on a socket in TCP_LISTEN state without locking, leading to incorrect memory management and potential kernel warnings.

In the Linux kernel, the dvbdev media driver has a risk of out-of-bounds memory access. Lack of explicit boundary checks in dvb_register_device() and dvb_device_open() can lead to memory issues, especially when dynamic minors are not used.

In the Linux kernel's s5p-jpeg driver (for hardware JPEG encoder), missing checks could lead to buffer overflows when the 'word' value was less than 2. The fix adds extra checks to prevent this.

In the Linux kernel, the enetc driver has a null pointer dereference vulnerability. The issue occurs when enetc_pf_set_vf_mac() is called before vf_state memory is allocated, leading to a system crash.

In the Linux kernel's btrfs filesystem, when updating a delayed ref, the ref list is not reinitialized after deletion, which can lead to invalid memory access and system crash.

A vulnerability in the Linux kernel related to insufficient attribute size checks in the NTFS3 filesystem has been resolved.

In the Linux kernel's nilfs2 filesystem, the 'checked' flag of a page/folio is not cleared when discarded, which after reloading a directory page skips sanity checks of directory entries and can trigger a kernel bug.