Linux kernel vulnerabilities

In the Linux kernel, visconti_clk_register_gate() fills in init.parent_data and assumes init.parent_names is NULL, but the latter is uninitialized. This may cause subtle issues or even a crash, especially with CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE enabled.

In the Linux kernel, snd_ice1712_probe() performs multiple initialization steps after snd_card_new(), but directly returns on failures from later steps without releasing the ALSA card, causing resource leaks when probing fails.

In the Linux kernel, ntfs_mft_record_alloc() reads the old update sequence number from an unvalidated MFT record using the untrusted usa_ofs field. A corrupted record can place usa_ofs past the end of the record, causing a two-byte read outside the folio and a use-after-free.

In the Linux kernel, the bnxt_en driver passes the platform device instead of the hardware monitoring device as the first parameter to hwmon_notify_event(). This API break results in undefined behavior and may cause a crash.

In the Linux kernel, the ptp netc driver has a period truncation and potential divide-by-zero issue in PEROUT. The max_period value exceeds U32_MAX, causing silent truncation of period_ns to zero and a divide-by-zero in roundup_u64(). Additionally, a zero pp->period causes an unsigned wraparound to 0xFFFFFFFD, mis-programming the FIPER hardware register.

In the Linux kernel, the sparx5 driver has a sleep-in-atomic-context issue in MAC table access. sparx5_set_rx_mode() runs with netif_addr_lock_bh held and iterates dev->mc, leading to taking the sparx5->lock mutex and polling a register in atomic context, which is not allowed. The fix converts the driver to the new .ndo_set_rx_mode_async callback.

In the Linux kernel, the hv vmbus module attempts to clean up an uninitialized VMBus module for a non-nested root partition. hv_acpi_init() does nothing in that scenario but reports success, so the module is loaded. Later unloading tries to clean up never-initialized resources, resulting in memory faults and a panic.

In the Linux kernel, a vulnerability was found in the FUSE filesystem related to direct writes with the O_APPEND flag. The fuse_direct_write_iter() function used a stale position before write checks, causing invalidation of the wrong page range after the write. This can lead to data inconsistency when the file size is not page-aligned.

In the Linux kernel, a bug was fixed in context management for ARM64 processes related to the Memory Tagging Extension (MTE) store-only mode. The SCTLR_EL1.TCSO0 bit was not included in SCTLR_USER_MASK, so after a context switch the setting was not cleared and could leak into another task. The fix adds SCTLR_EL1_TCSO0_MASK to SCTLR_USER_MASK to ensure proper clearing during switch.

In the Linux kernel, the btmtksdio Bluetooth driver's TX path rounds the transfer size up to the 256-byte SDIO block size but hands the controller the SKB buffer as-is. The controller therefore reads up to 255 bytes of uninitialised memory, and the read can extend past the end of the buffer.

In the Linux kernel, the Bluetooth RFCOMM rfcomm_apply_pn() accepts the MTU value from a remote Parameter Negotiation frame without checking for zero. When a peer sends an MTU of zero, d->mtu becomes 0, causing an infinite loop during data fragmentation and exhausting system memory.

In the Linux kernel, the xsk zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set XDP_TX_METADATA. The fix passes descriptor options through the metadata helpers and ignores metadata unless the option is set.

In the Linux kernel, the octeontx2-af driver's rvu_dbg_nix_tm_tree_display() dereferences pfvf->sq_ctx without checking whether the SQ context has been allocated. Reading /sys/kernel/debug/octeontx2/nix/tm_tree for a NIX LF without configured transmit queues triggers a kernel oops.

In the Linux kernel, the octeontx2-vf driver has a workqueue and netdev race in the probe/remove paths. The VF workqueue is not initialized before register_netdev(), so ndo_set_rx_mode can queue work on a NULL workqueue, and the workqueue is destroyed before the netdev is unregistered.

A vulnerability in the Linux kernel's act_ife module (net/sched) causes a kernel panic (skb_under_panic) when processing non-Ethernet frames. The issue stems from using skb->dev->hard_header_len instead of ETH_HLEN, leading to incorrect skb buffer operations. The fix restricts IFE to Ethernet frames only and enforces the correct header length.

In the Linux kernel, net/rds rds_cong_map_updated() uses waitqueue_active() without the required memory barrier, leading to a store-buffering pattern. The updater can observe an empty wait queue while the waiter still sees the port as congested, so no wake-up is issued.

In the Linux kernel, the octeontx2-pf driver lacks NULL checks before calling test_bit() on the af_xdp_zc_qidx pointer. This pointer is only allocated for AF_XDP zero-copy paths, while representors and other paths leave it NULL, causing a NULL dereference when switching devlink eswitch mode.

In the Linux kernel, the net/sched act_skbmod module has header length calculation errors. The tcf_skbmod_act() function calls skb_network_header_len() without guaranteeing transport_header is set and calls skb_mac_header_len() on L3 devices, causing warnings and incorrectly dropping valid short packets.

In the Linux kernel, the copy_net_ns() function has a resource leak in its error handling path. When preinit_net() fails, the code jumps to the dec_ucounts label, skipping the release of resources allocated by net_alloc(), such as key_remove_domain() and net_passive_dec().

In the Linux kernel, the net/sched fq module has an integer overflow when computing quantum and initial_quantum. A device with a huge MTU makes psched_mtu() return 0x80000000, and multiplication by 2 and 10 wraps to zero, causing an infinite loop in fq_dequeue() and a soft lockup.

In the Linux kernel, the net/sched fq_codel module fails to clamp quantum and mtu values. A device with a huge MTU overflows the signed flow->deficit to INT_MIN, causing an infinite loop and soft lockup, and also silently disables the CoDel mechanism.

In the Linux kernel, the net/sched fq_pie module fails to clamp the default quantum value. A device with a huge MTU overflows the signed flow->deficit to INT_MIN in fq_pie_qdisc_dequeue(), causing an infinite loop and soft lockup.

In the Linux kernel, the net/sched hhf module lacks an overflow check when setting quantum. A device with a huge MTU overflows the signed deficit in hhf_dequeue(), causing an infinite loop, and also causes -EINVAL when adding qdisc with options.

In the Linux kernel, the net/sched sfq module fails to clamp the quantum value. A device with a huge MTU makes slot->allot equal INT_MIN, and INT_MIN + INT_MIN toggles between INT_MIN and 0, causing an infinite loop in sfq_dequeue() and a soft lockup.

In the Linux kernel, st33zp24_status() ignores the transport read result and returns data even when no byte was received. In the I2C transport, when the register-select write is short or fails, i2c_master_recv() is skipped, leaving data uninitialized. The resulting stack value can be interpreted as TPM_STS flags and let status checks complete spuriously.

In the Linux kernel, snd_soc_dapm_put_enum_double() rejects item[0] once it reaches e->items, but lets item[1] be equal to it. Both go to snd_soc_enum_item_to_val(), which indexes e->values with no bound of its own, so an enum with a value table reads one element past the end. Only adav80x pairs a value table with two shifts.

In the Linux kernel, ftrace_direct_multi_init() assigns kthread_run()'s return value to simple_tsk without an IS_ERR() check. When kthread_run() fails it returns ERR_PTR(-ENOMEM), but init still returns 0, so the module loads with simple_tsk holding an error pointer. On unload, ftrace_direct_multi_exit() passes that ERR_PTR to kthread_stop(), leading to a null-pointer-dereference.

In the Linux kernel, IPPROTO_SMC sockets create an internal TCP sock ("clcsock") from the proto->init hook. When socket creation fails after proto->init has run — e.g. a cgroup BPF program attached to BPF_CGROUP_INET_SOCK_CREATE denies the socket — sk_common_release() only invokes sk_prot->destroy if it is set, but neither smc_inet_prot nor smc_inet6_prot defines it, and smc_destruct() returns early. As a result, every failing socket(AF_INET, SOCK_STREAM, IPPROTO_SMC) call leaks one tcp_sock.

In the Linux kernel, in the drm/xe driver, having scratch enabled does not make a VM capable of handling recoverable page faults. Allowing scratch VMs through the ASID lookup also admits dma-fence mode VMs. If such a VM faults on an already valid VMA, the handler reports success without fixing the fault, causing the GPU to retry indefinitely.

In the Linux kernel, in virtio-net the user can specify any gso_size in a packet crafted with an AF_PACKET PACKET_VNET_HDR socket, even smaller than TCP_MIN_GSO_SIZE = 8. Since GSO_MAX_SIZE = 8 * GSO_MAX_SEGS = 8 * 65535, with gso_size < 8 there is a risk of overflowing the 16-bit gso_segs field when dividing the SKB length by gso_size.

In the Linux kernel's ALSA control layer, there is a NULL pointer dereference vulnerability. A write-only control element without a get callback can be created, leading to a kernel Oops in snd_ctl_led_notify().

Vulnerability in the Linux kernel net/sched component allows causing a soft lockup via crafted size table (stab) in DRR and ETS schedulers. An attacker with CAP_NET_ADMIN in a namespace can trigger a huge qdisc_pkt_len value (~1 GiB), leading to a loop in the scheduler and system hang.

In the Linux kernel's FEC driver, fec_ptp_stop() is called unconditionally on error and removal paths, but fec_ptp_init() is only called when bufdesc_ex is available. This can stop PTP that was never initialized.

A bug in the Linux kernel's usbatm (USB ATM) module was found where the ci_range fields vpi_bits and vci_bits were initialized to ATM_CI_MAX (-1). These values are used as bit shift counts in net/atm/common.c, causing undefined behavior (shift-out-of-bounds) and UBSAN warnings. The fix sets vpi_bits to 8 and vci_bits to 16.

In the Linux kernel's TCP implementation, there is corruption of urgent data on multi-segment retransmission. The retransmit path lacks a guard against multi-segment TSO, causing wrong urg_ptr copying and the receiver treats in-band data as urgent.

In the Linux kernel, htb_classify() in net/sched/sch_htb did not bound the number of hops between HTB inner classes selected by filters. A filter on an inner class can point back to itself or form a cycle, causing an infinite loop in the packet classification path with the qdisc lock held and BH disabled — a single packet triggers a soft lockup or kernel panic. The fix introduces a hop counter bounded by TC_HTB_MAXDEPTH and drops the packet with a rate-limited warning once the limit is exceeded.

In the Linux kernel, in the net/sched fq module, a vulnerability was found related to insufficient clamping of quantum and initial_quantum values during configuration changes by a user. This allows restoring a condition that may cause excessive network transmission slowdowns, due to the ability to set too small quantum values.

In the Linux kernel zram module, the slot lock bit is set in the wrong position on 64-bit big-endian systems. Instead of landing in the flags field, it lands in ac_time, so with ZRAM_TRACK_ENTRY_ACTIME enabled, storing the access time wipes out the held lock bit and lets another CPU take the same slot lock. An access time value with that bit set can make the slot appear locked forever. The fix shifts the lock bit into the flags half on big-endian 64-bit.

In the Linux kernel, get_estimated_bw() in the drm/amd/display driver divides by bw_granularity, which is zeroed and only populated after DP_TUNNELING_BW_ALLOC_CAP_CHANGED is handled. If a USB4/DPIA device reports an estimated-bandwidth change before a capability change, the DPCD interrupt handler triggers a division by zero.

In the Linux kernel, the usb image mdc800 driver uses kmalloc() for irq_urb_buffer and download_urb_buffer in usb_mdc800_init(). If a shorter message is received in mdc800_usb_irq() or mdc800_usb_download_notify(), stack data may leak.

In the Linux kernel, snd_usbmidi_us122l_output() in ALSA usb-audio picks a count of 2 for anything slower than high speed without relating it to ep->max_transfer. With a device declaring a one-byte bulk endpoint, the memset computes 1 - 2 in int and wraps to SIZE_MAX, causing an out-of-bounds write.

A null-pointer dereference vulnerability exists in the Linux kernel's USB gadget MIDI 2.0 function, specifically in f_midi2_free_ep_reqs(). When configuring a MIDI 2.0 gadget via configfs with block direction set to SNDRV_UMP_DIR_INPUT, the midi1_ep_out endpoint is not initialized, leaving usb_ep->card as NULL. When the host later sets the alternate setting, f_midi2_free_ep_reqs() is called for the uninitialized endpoint, causing a kernel crash.

In the Linux kernel, f_midi2_opts_str_show() in the USB gadget driver has a use-after-free. Callers dereference the opts->info.<field> pointer before taking the lock, racing with f_midi2_opts_str_store(), which frees the old string under the lock. A concurrent attribute write can cause a read of a freed pointer.

In the Linux kernel, f_midi_alloc() does not initialize the work structure if f_midi_bind() is never called. The condition in f_midi_free then becomes true, causing a warning in __flush_work due to work->func = 0. The fix moves INIT_WORK from f_midi_bind() to f_midi_alloc().

In the Linux kernel, gadget_dev_ioctl() reads dev->gadget before acquiring dev->lock, while dev->state is checked after acquiring the lock. A concurrent bind can change the device state, leaving a stale NULL gadget pointer and causing a NULL pointer dereference at gadget->ops->ioctl.

In the Linux kernel, usb_put_function_instance() attempts to dereference fd inside the fi struct in the uvc_alloc_inst() error path. However, fd is not allocated until later in try_get_usb_function_instance(), so it is guaranteed to be NULL in the error path. The fix adds a NULL check for fi->fd.

In the Linux kernel, the staging rtl8723bs driver's rtw_action_frame_parse() does not check the frame_len parameter before indexing into the frame body. Reading frame_body[0] and frame_body[1] requires frame_len >= 26, so a shorter frame (e.g. 24 bytes) causes a 1-2 byte out-of-bounds read. This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx().

In the Linux kernel, the newly added show_event_filters and show_event_triggers files do not take a reference to the trace_array they display. Without this reference, the trace_array may be freed via 'rmdir' while a task is reading the file, causing a use-after-free. The fix makes opening both files take the reference via trace_array_get().

In the Linux kernel, the scsi bsg completion copies scmd->sense_len to the user response buffer without honoring max_response_len. After a valid sense, the midlayer sets sense_len to the real length (up to SCSI_SENSE_BUFFERSIZE), overrunning a smaller user buffer.

In the Linux kernel, the scsi bsg function scsi_bsg_uring_cmd() reads bsg_uring_cmd from the shared mmap'd SQE, allowing userspace to change a field between check and use (TOCTOU). request_len can grow past sizeof(scmd->cmnd) after the bound check and overflow scmd->cmnd in copy_from_user().