Linux kernel vulnerabilities

In the Linux kernel, a bug in the Bluetooth HCI stack allowed setting a handle larger than HCI_CONN_HANDLE_MAX, causing a warning when freeing an incorrectly allocated handle, potentially destabilizing the system.

In the Linux kernel, in the ASoC driver for Mediatek MT8195, removing the codec entry for the ETDM1_OUT_BE dai link left the platforms array empty, causing an out-of-bounds read (KASAN) during initialization.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the GFS2 filesystem's gfs2_log_flush function. The issue occurs when glock operations race with an unmount, causing access to a freed sd_jdesc object.

In the Linux kernel, the CAN J1939 subsystem improved error handling for tightly received RTS messages in xtp_rx_rts_session_new. The less informative WARN_ON_ONCE backtraces were replaced with a new error handling method that provides clearer error messages and allows early termination of problematic sessions.

In the Linux kernel, a double free vulnerability was found in the lantiq_etop driver in the detach function. The number of currently released descriptors is never incremented, resulting in the same skb being released multiple times.

In the Linux kernel, a kernel bug was found in the nilfs2 filesystem during rename operation on a broken directory. The nilfs_dotdot() function may return a location exceeding the page size, leading to a BUG_ON in __block_write_begin_int().

In the Linux kernel, the vmalloc memory manager has an issue with hash indexing when cpu_possible_mask has gaps (e.g., on SPARC). The addr_to_vb_xa() function can return an index that accesses a non-existent CPU area, causing an oops.

In the Linux kernel, the toshiba_acpi driver lacks a terminator in the toshiba_dmi_quirks[] array, causing an out-of-bounds access when processing the quirk list. Added an empty terminating entry to fix this.

In the Linux kernel, a race condition was found in the CAN subsystem's ISO-TP protocol in the isotp_rcv() function. Concurrent processes can change data state, leading to skb_over_panic due to buffer overflow.

In the Linux kernel, the behavior of READ near OFFSET_MAX in NFSD was fixed, which caused loff_t overflow and returned EINVAL, leading to infinite client retries.

In the Linux kernel, the qedf driver for Fibre Channel adapters did not initialize delayed work (stag work) for all virtual ports (vports). This caused a warning in the workqueue system and issues with only 32 out of 64 NPIV ports appearing online. The fix initializes this work for all vports.

In the Linux kernel, a reference count issue was found in the qedf (QLogic Fibre Channel) driver when a LOGO request is received during a Task Management Function (TMF). This leads to hung I/O operations and a hung task warning. The fix addresses the reference count problem.

In the IIO subsystem in the Linux kernel, an error handling issue was found in IIO_BUFFER_GET_FD_IOCTL. If copying the file descriptor to userland fails, the cleanup code incorrectly uses put_unused_fd(), which is wrong because the fd was already published by fd_install(). This leaves a partially cleaned up file descriptor table and a partially destructed 'file' object, allowing use-after-free tricks on 'file->private_data'.

In the Linux kernel's IPv6 multicast subsystem, a vulnerability was found due to using an RCU-unsafe version of ipv6_get_lladdr(). After external locks were removed from MLD code, this function can be called without proper synchronization, leading to use-after-free and system crash.

In the Linux kernel MCTP subsystem, there is a use-after-free in route.c. When mctp_key_add() fails, the key is freed but later used in trace_mctp_key_acquire(). Added an else statement to use the key only on success.

In the Linux kernel KVM for ARM64, during teardown of a redistributor region, the pointer to that region was not removed from vcpus, potentially leading to a dangling pointer. The fix ensures vcpus do not hold pointers to removed regions.

In the Linux kernel, ACPICA reverted a previous fix regarding mapping multiple BARs. The previous change caused mapping to stop at page boundaries but read/write attempts covered the full length, leading to a NULL pointer dereference. Now the entire length is mapped.

In the Linux kernel for powerpc/pseries, plpar_hcall() and related functions did not enforce proper result buffer sizes, potentially leading to stack corruption. The fix changes declarations to explicitly-sized arrays, enabling compiler detection of such errors.

In the Linux kernel, the mtk-vcodec driver has a potential NULL pointer dereference in SCP. The return value of devm_kzalloc() needs to be checked to avoid this issue. Similar to CVE-2022-3113.

In the Linux kernel f2fs filesystem, during remount the SB_INLINECRYPT flag is cleared and re-set, causing a window where new files may not use inlinecrypt, potentially leading to data corruption if wrappedkey_v0 is enabled. The fix removes the clearing of this flag in default_options.

In the Linux kernel, the dw-axi-dmac driver has a vulnerability that overruns the hw_desc array when the number of descriptors exceeds allocated memory, potentially causing a kernel panic. The fix adds a new field to track allocated descriptors and removes an unnecessary call.

In the Linux kernel, the blk-flush subsystem has a bug in the use of the request.queuelist, which can lead to a kernel crash. The fix changes the list usage to list_add_tail and adds list initialization in the flush callback.

In the i915 graphics driver in the Linux kernel, an issue was found where the DPT object can be shrunk in some scenarios while the actual framebuffer is not, leaving it on the DPT's bound_list. This leads to an attempt to rewrite PTEs via a stale CPU mapping, causing a panic.

In the Linux kernel, the br_mst_set_state function of the network bridge has suspicious RCU usage that may lead to warnings and potential errors. The fix changes the VLAN group dereference to the appropriate RCU helper.

In the Linux kernel's BPF subsystem, there is a potential use-after-free in bpf_link_free() where the link can be freed by dealloc_deferred but the code still uses dealloc afterward.

In the Linux kernel SCSI driver mpt3sas, there is a potential out-of-bounds access when using test_bit() and set_bit() on a single word. The fix increases the allocation to at least sizeof(unsigned long) to provide sufficient space.

In the Linux kernel, the cachefiles module has a use-after-free vulnerability because requests are not removed from the xarray during flushing. This can lead to use of freed memory. The fix removes requests from the xarray when flushing.

In the Linux kernel's hns3 network driver, a concurrent scenario can cause a kernel crash when link status changes and the roce driver is uninitialized.

In the Linux kernel, the btrfs filesystem has a use-after-free vulnerability caused by a race during device replace. While loading zone info, a device is extracted from the chunk map without proper synchronization, which can lead to use of freed memory after the replace operation completes.

In the Linux kernel, a use-after-free vulnerability was found in the IMA module related to the dname.name field of a dentry. The name can change on rename and the earlier value can be freed, leading to unsafe dereference.

In the Linux kernel, the crypto starfive module has a vulnerability where kfree is called on a stack-allocated buffer. RSA text data uses a variable-length buffer allocated on the software stack, and freeing it causes undefined behavior in subsequent operations.

A vulnerability in the Linux kernel related to the {reserve,release}_compress_blocks() functions with cp_rwsem lock has been fixed. Failure to properly secure this can lead to racing with the checkpoint, resulting in filesystem metadata corruption.

A vulnerability has been identified in the Linux kernel within the enic_set_vf_port function, which incorrectly assumes the length of nl attributes. The length validation of attributes is not precise, potentially leading to unauthorized memory access.

A vulnerability has been identified in the Linux kernel related to an incorrect PDI offset in the SoundWire code, leading to out-of-bounds access. This issue has been resolved by removing the unnecessary offset.

In the Linux kernel, the NTFS3 filesystem used a fixed-size array instead of a variable-length array, causing a smatch warning about the buffer being too small when copying the name. The fix changes to a variable-length array.

A vulnerability has been identified in the Linux kernel related to improper access to an uninitialized value in the nci_rx_work() function. The issue stems from a lack of validation for header size, payload size, and total packet size before processing the packet.

In the Linux kernel's amd-xgbe network driver, a vulnerability causes skb data length underflow, triggering BUG_ON() in include/linux/skbuff.h and leading to intermittent kernel panic. The fix drops the packet when such underflows are seen due to inconsistencies in hardware descriptors.

In the Linux kernel, the ASoC codecs wcd938x has incorrect use of port ID. Mixer controls have the channel ID in mixer->reg, which is not the same as the port ID. The fix derives the port ID from the chan_info array to avoid out-of-bounds access to the port_map array.

In the Linux kernel, the Bluetooth subsystem refactored the malicious advertisement data check. Previously, the out-of-bounds read check was performed at the end of the loop, causing false positives in the journal. The check is now moved to the beginning of the loop to avoid checking after the pointer has been advanced.

In the Linux kernel, HCI_AMP support has been removed because BT_HS has been removed and AMP controllers are no longer useful. The capability to create AMP controllers and the hdev->dev_type field have also been removed.

In the Linux kernel, the mac80211 subsystem does not verify the presence of the extended element ID before parsing an extended element, which may lead to improper frame processing.

In the Linux kernel, the MSM driver (for Qualcomm SoCs) has a null pointer dereference in msm_ioctl_gem_submit, potentially leading to a kernel panic.

A vulnerability has been identified in the Linux kernel related to an incorrect error path in the seg6_init() function when CONFIG_IPV6_SEG6_LWTUNNEL is not defined. In this case, if seg6_hmac_init() fails, the genl_unregister_family() function is not called.

In the Linux kernel, the ALSA core has a bug in the assignment of the module pointer during sound card initialization. When the sound core is built-in (CONFIG_SND=y) and the driver is a module (e.g., CONFIG_SND_USB_AUDIO=m), the module pointer is ignored, leading to missing module references and potential race conditions during module removal.

In the Linux kernel, the speakup module has a bug where sizeof() is used instead of ARRAY_SIZE() for the buf pointer, which is an array of u16 values. This can lead to out-of-bounds access, potentially causing malfunction or security issues.

In the Linux kernel, a potential index out of bounds issue was found in the color transformation function of the AMD Display driver. The issue occurs when index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS), potentially leading to buffer overflow. A bounds check was added to log an error and return false in such cases.

In the Linux kernel, a vulnerability in of_modalias() was fixed. If the buffer is too small even for the first snprintf() call, the len parameter becomes negative and the str parameter (if not NULL initially) points beyond the buffer's end. A buffer overflow check was added after the first snprintf() call and the check after strlen() was fixed (accounting for the terminating NUL char).

A vulnerability has been identified and resolved in the Linux kernel. The issue concerns the multiq_tune() function, where an out-of-bounds write (OOB) may occur due to improper use of the q->bands variable after memory allocation.

In the Linux kernel, the vmwgfx graphics driver has a vulnerability of invalid reads in fence signaled events. The length of the drm_event is set to the size of the parent structure instead of the actual drm_vmw_event_fence structure, leading to out-of-bounds reads when copying the event to user space.

A vulnerability has been identified in the Linux kernel related to incorrect memory freeing in the pinctrl_enable() function. The 'pctldev' struct is allocated in devm_pinctrl_register_and_init() and is managed by devm_, leading to a double free.