Linux kernel vulnerabilities

A vulnerability in the Linux kernel BPF verifier overloads the MEM_UNINIT flag, allowing BPF programs to write to read-only maps (e.g., .rodata). When the buffer size is non-constant, the verifier skips write permission checks, enabling modification of protected data.

In the Linux kernel, the UDF filesystem has an uninitialized value use in udf_get_fileshortad. The issue stems from missing overflow check when computing alen in udf_current_aext, potentially leading to incorrect behavior.

A vulnerability has been identified in the Linux kernel related to event length validation that did not consider the NULL character. If the string length equals the maximum buffer length, there is no space for the terminating NULL character.

In the Linux kernel, the Bluetooth SCO subsystem has a use-after-free (UAF) vulnerability in sco_sock_timeout. The conn->sk may have been unlinked/freed while waiting for sco_conn_lock, so a check was added to verify conn->sk is still valid by checking if it is part of sco_sk_list.

A vulnerability has been identified in the Linux kernel that allows out-of-bounds memory access when fetching arguments in the uprobe function. This issue arises from the lack of checks to ensure that data does not exceed a single page size, leading to use-after-free errors.

A vulnerability in the Linux kernel allows tail calls between BPF programs attached to different hooks, bypassing context access and return value verification. This could lead to unauthorized access to kernel function parameters or incorrect return values.

A vulnerability in the Linux kernel related to double free in the driver API during bus_register() has been fixed. This error occurred when any error after kset_register() would cause the @priv pointer to be freed twice.

In the Linux kernel, the ieee80211_get_rate_duration function in the mac80211 subsystem has a possible out-of-bounds array access, which may lead to incorrect behavior or system crash. The issue was reported by UBSAN.

In the Linux kernel's TIPC subsystem, a use-after-free vulnerability exists. After tipc_msg_validate() frees the original skb, dereferencing the old skb cb causes a crash. The fix re-fetches the skb cb from the newly allocated skb after validation.

In the Linux kernel's HSR (High-availability Seamless Redundancy) module, a potential use-after-free was found. After delivering the packet (skb) to netif_rx(), which may free it, further dereferencing the packet could lead to UAF.

In the Linux kernel, the AMD graphics driver (drm/amd/display) has an array index out-of-bounds error in the DCN32 DML module. The LinkCapacitySupport array is indexed with the number of voltage states instead of the maximum number of DPPs, leading to out-of-bounds access. The fix changes the array size to the correct, larger value.

In the Linux kernel, the NFC NCI subsystem lacks bounds checking for arrays in the nfc_target structure, which may lead to out-of-bounds memory writes. The issue was detected by syzkaller with CONFIG_FORTIFY_SOURCE enabled.

In the Linux kernel, a use-after-free vulnerability was found in the ravb driver in the ravb_rx_gbeth() function. After the skb is delivered to napi_gro_receive(), which may free it, dereferencing skb may trigger use-after-free.

In the Linux kernel, the hisilicon network driver (hisi_femac) has a potential use-after-free vulnerability in hisi_femac_rx(). The skb is delivered to napi_gro_receive() which may free it, and dereferencing skb after that may trigger use-after-free.

In the Linux kernel, the hisilicon network driver has a use-after-free vulnerability in the hix5hd2_rx() function. The skb is passed to napi_gro_receive() which may free it, and then dereferencing skb may trigger use-after-free.

In the Linux kernel, an ext4 vulnerability involves accessing an uninitialized spinlock (sbi->s_bdev_wb_lock) during the fast-commit replay path. This triggers a warning about registering a non-static key and can disrupt lock validation. The fix moves the spinlock initialization earlier in __ext4_fill_super().

In the Linux kernel, the mlx5 driver had an error path bug in multi-packet WQE transmit. On DMA mapping failure, the code erroneously unmapped an entry from the active mappings list, potentially removing a random mapping and causing PCI function errors.

A vulnerability was found in the Linux kernel's DSA shutdown sequence. Two issues were identified: a use-after-free in the lan9303 driver due to dev_get_drvdata() calls after shutdown, and a race condition when zeroing conduit->dsa_ptr during packet reception. The fix closes the conduit interface before zeroing pointers, preventing access to the driver after shutdown.

An integer overflow vulnerability was discovered in the Linux kernel's BLKSECDISCARD operation. Passing crafted values (sector 512 and a near-maximum uint64_t sector count) causes an infinite loop in blkdev_issue_secure_erase(), leading to system overload and hang.

A double free issue during the unloading of the amdgpu module has been fixed in the Linux kernel. This issue occurred when flexible endpoints used DIGs from available inflexible endpoints, leading to memory management errors.

A vulnerability in the Linux kernel related to use after free has been fixed in case of platform device registration errors.

In the Linux kernel, the AMD Display module (DCN30) has an index out of bounds issue in cm3_helper_translate_curve_to_hw_format. The index 'i' may exceed the number of transfer function points, leading to buffer overflow in color arrays.

A vulnerability was found in the Linux kernel's ext4 filesystem. If the default hash version is set to DX_HASH_SIPHASH but the casefold feature is not enabled, mounting the filesystem fails.

In the Linux kernel, the xen-netback driver has a use-after-free vulnerability in xenvif_flush_hash. During list iteration in an RCU critical section, calling kfree_rcu may cause access to freed memory.

In the JFS filesystem in the Linux kernel, an out-of-bounds read vulnerability was found in the dbSplit function. The issue occurs because dmt_leafidx can be greater than the number of leaves in the dmap tree. A check for dmt_leafidx was added in dbFindLeaf, covering control pages as well.

In the Linux kernel, the AMD GPU driver (amdgpu) has an out-of-bounds index vulnerability in the cm_helper_translate_curve_to_degamma_hw_format function. The index 'i' can exceed the number of transfer function points, leading to buffer overflow.

A deadlock vulnerability was found in the Linux kernel's EROFS filesystem caused by crafted images with overlapping pclusters. The issue leads to a task hang due to improper handling of managed folios and I/O submission ordering.

A vulnerability has been identified in the Linux kernel related to injecting an error in the driver before stopping the queue. The issue is that the driver does not properly close the master ooo when the accelerator core reports a memory error.

In the Linux kernel, the f2fs filesystem did not wait for all direct write I/O operations to complete before block removal. This could lead to overwriting data in blocks that have been reallocated to another inode.

A vulnerability has been identified and resolved in the Linux kernel. It concerns the dbNextAG() and diAlloc() functions, where the lack of proper checks led to out-of-bounds memory access.

A vulnerability in the Linux kernel related to out-of-bounds access to the SINF array in Panasonic laptop code has been resolved. The issue arises when indices exceed the size of the array, potentially leading to unexpected system behavior.

A vulnerability in the Linux kernel related to error handling in the CMA driver was identified, allowing for a mapping larger than the buffer size. This issue has been resolved by correcting the boundary check in the fault handler.

In the Linux kernel, the AMD Display module has an issue with using GPIO_ID_UNKNOWN (-1) as an array index. Lack of validation before use may lead to out-of-bounds memory access.

A vulnerability in the Linux kernel related to accessing the dc->links[] array without checking the link_index has been fixed. This issue could lead to memory overrun and resource leaks.

In the Linux kernel, the netem queueing discipline has a use-after-free vulnerability in netem_dequeue. When a packet is enqueued to an inner qdisc and returns __NET_XMIT_STOLEN, not updating the qlen counter may lead to use-after-free.

A vulnerability in the Linux kernel's fscache module causes a use-after-free (UAF) when the module is removed without deleting the fscache_cookie_lru_timer. This can trigger a kernel crash or memory corruption in softIRQ context.

In the Linux kernel, the test_run function was removed from lwt_seg6local_prog_ops because lwt_seg6 related BPF ops could be invoked via bpf_test_run() without entering input_action_end_bpf() first. Self tests for BPF_PROG_TYPE_LWT_SEG6LOCAL probably didn't work because the per-CPU variable seg6_bpf_srh_states::srh was never assigned in the test case.

In the Linux kernel, the misc: fastrpc driver has a double free of 'buf' in the error path of fastrpc_req_mmap(). The buffer is freed in fastrpc_req_munmap_impl() if unmap is successful, but at the end there is an unconditional call to fastrpc_buf_free(), causing a double free.

In the Linux kernel, the nvmet-tcp module has a bug causing kernel crash when command allocation fails. When allocation fails, NULL pointer dereference in nvmet_tcp_release_queue_work causes a crash.

In the Linux kernel, an issue was found in the perf/aux subsystem regarding AUX buffer serialization. The mmap_mutex is insufficient to fully serialize, potentially leading to races and data inconsistencies.

In the USB dwc3 driver for ST platforms in the Linux kernel, a reference count issue was found in the probe error path. The probe function never allocates platform devices, so the 'undo_platform_dev_alloc' error path is bogus and decrements the reference count of the probed device. This can lead to unbalanced reference counts and premature release of resources, potentially causing use-after-free.

In the Linux kernel, in the aacraid SCSI driver, a double-free vulnerability was found on probe failure. aac_probe_one() calls hardware-specific init functions that eventually call aac_init_adapter(). If aac_init_adapter() fails after allocating memory for aac_dev::queues, it frees the memory but does not clear that member, leading to a double-free in the error path.

In the Linux kernel's nfsd subsystem, a vulnerability exists in handling cached open files in the nfsd4_open codepath. The issue involves a race where a newly-created nfsd_file can have its PENDING bit cleared while nf_file is still NULL, leading to a crash. Additionally, a memory leak can occur when an existing entry has a valid nf_file. The fix introduces a new nfsd_file_acquirei_opened variant that takes an optional file pointer.

In the Linux kernel, the dmam_free_coherent function has a call order issue that can lead to use-after-free. It frees the DMA allocation first, then removes the devres entry, which in concurrent scenarios may free the wrong entry and trigger a WARN_ON.

In the Linux kernel, the ath12k driver has an invalid memory access while processing fragmented packets. The monitor ring and the reo reinject ring share the same ring mask index, leading to invalid access when the reinject ring is processed. The fix removes the monitor ring mask since monitor support is not yet enabled.

A vulnerability has been identified in the Linux kernel related to improper removal of sysfs attributes before calling the deactivate function. This may lead to a situation where functions operating on trigger-data can be called after it has been freed.

In the Linux kernel, in the Landlock module, a vulnerability was found that loses track of restrictions on cred_transfer. When a process' cred struct is replaced, it almost always invokes the cred_prepare LSM hook, but in one special case (KEYCTL_SESSION_TO_PARENT) the cred_transfer hook is used instead. Landlock only implements cred_prepare, so KEYCTL_SESSION_TO_PARENT causes all Landlock restriction information to be lost. The fix adds a cred_transfer hook that does the same as cred_prepare.

In the Linux kernel's cifs module, during subrequest retry, smb2_async_writev() re-picks the server, causing in_flight counter mismatch and warnings. The fix removes the server re-pick in this function.

In the Linux kernel, the mt76 WiFi driver uses skb_put instead of skb_put_zero, potentially reusing uninitialized data.

In the Linux kernel, a vulnerability in the Bluetooth stack allows too large handle values in BIG to cause erroneous release of an IDA identifier in hci_conn_cleanup.