Linux kernel vulnerabilities

In the Linux kernel, KVM for ARM64 in kvm_hyp_handle_mops() lacks translation of the synthetic SPSR_EL2 value before writing to hardware in nested virtualization. This causes incorrect SPSR_EL2 restoration.

In the Linux kernel, a use-after-free vulnerability was found in the br_ip6_fragment() bridge function. The prevhdr pointer becomes stale after skb_checksum_help() reallocates the skb head, leading to a write to freed memory.

In the Linux kernel, the psample module's open-coded nla_put() for PSAMPLE_ATTR_DATA misses clearing the pad, potentially leaking information via unzeroed padding bytes in the Netlink message.

In the Linux kernel, the virtio-net driver's receive_big() function checks the device-announced length too loosely, allowing a malicious virtio backend to write out-of-bounds past the frag array in skb. This can lead to NULL pointer write and potential exploitation.

In the Linux kernel, the rmnet driver (Qualcomm) lacks MAP frame length validation before parsing in the non-aggregation path. A short frame can lead to out-of-bounds buffer read, exploitable by a malicious device or attacker.

In the Linux kernel, the Bluetooth bpa10x driver's bpa10x_setup() reads the revision string from device response without length checking, leading to out-of-bounds buffer read. Unterminated or short responses leak adjacent kernel memory to logs and debugfs.

In the Linux kernel, BPF sockmap's bpf_msg_push_data() lacks overflow check when adding copy + len, leading to undersized allocation and out-of-bounds write. An attacker with BPF privileges can exploit this to corrupt memory.

In the Linux kernel, the net1080 USB network driver's net1080_rx_fixup() reads a pad byte before checking frame length, allowing a malicious NetChip 1080 device to cause out-of-bounds buffer read by sending a short frame with a large packet_len.

In the Linux kernel, DRM EDID's drm_parse_tiled_block() reads the full displayid_tiled_block structure without checking block length, leading to heap out-of-bounds read. A crafted EDID with a small tiled-display block can cause data leak.

A vulnerability in the Linux kernel's xdp_master_redirect() function dereferences a master pointer without a NULL check. Under certain conditions during bond slave release, this can lead to a NULL pointer dereference and kernel panic.

In the Linux kernel, the pefile_digest_pe_contents() function is vulnerable to an out-of-bounds (OOB) read. A crafted PE file can cause an unsigned subtraction underflow, leading to reading a huge memory region and a kernel panic.

A use-after-free vulnerability was found in the Linux kernel's TIPC subsystem in the tipc_disc_rcv() function. The bearer_disable() function frees the discoverer structure (b->disc) with kfree(), but tipc_disc_rcv() still dereferences it in RX softirq context, leading to a use-after-free. The issue affects the UDP bearer, which lacks a proper grace period before deallocation.

In the Linux kernel, the accept_untracked_na() function is vulnerable to a NULL pointer dereference. It re-fetches the inet6_dev pointer without a NULL check, which can be exploited by a concurrent addrconf_ifdown() call, causing a kernel panic.

In the Linux kernel usbnet gl620a driver, an out-of-bounds read vulnerability exists in genelink_rx_fixup(). A malicious GeneLink (GL620A) device can send a short URB with an inflated packet size, causing data to be copied beyond the allocated buffer and leaking kernel heap memory.

A stack out-of-bounds write vulnerability was found in the Linux kernel's Bluetooth EIR component when building advertising data. The eir_create_adv_data() function may prepend a 3-byte Flags AD structure and then copy instance data without checking if it fits into the fixed 31-byte buffer, causing a stack overflow.

In the Linux kernel, the fib6_nh_mtu_change() function is vulnerable to a NULL pointer dereference. It re-fetches the idev pointer without a NULL check, which can be exploited by addrconf_ifdown(), causing a general protection fault.

In the Linux kernel's bridge CFM module, the ccm_tx_work_expired() function is vulnerable to memory exhaustion (OOM). It re-arms itself with a 0 interval when exp_interval is invalid, leading to continuous buffer allocation and memory exhaustion.

In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full interrupt handler gates the write_requested() callback on dw->state != CMD_SEND, and dw->state is only reset to READY on a STOP interrupt. The START_DET interrupt, which would reset the state on every (re)START, was never added to the enabled interrupt mask, so that recovery path was dead code. As a result, if the STOP interrupt is lost or the bus master issues a legal WRITE-repeated-START-WRITE sequence, the driver remains in CMD_SEND permanently and never invokes write_requested() again.

In the Linux kernel, a vulnerability in the CAN BCM module has been fixed by switching the timer to HRTIMER_MODE_SOFT, which executes the callback in softirq context and removes the hrtimer_tasklet.

In the rtl8723bs driver in the Linux kernel, the loop in is_ap_in_tkip() does not properly validate buffer bounds when processing information elements (IEs). This can lead to an out-of-bounds (OOB) read when accessing the IE header or its data.

In the NTFS3 filesystem in the Linux kernel, the log_replay() function does not validate the lcns_follow field during record conversion. A malicious filesystem image can provide an oversized lcns_follow value, causing an out-of-bounds (OOB) read during the memmove operation.

In the NTFS3 filesystem in the Linux kernel, the UpdateRecordDataRoot and UpdateRecordDataAllocation functions do not validate the view.data_off field in the NTFS_DE structure. A malicious filesystem image can provide an oversized view.data_off value, causing an out-of-bounds (OOB) write during the memmove operation.

In the Linux kernel's Open vSwitch module, a vulnerability was found due to missing validation of nested action attribute sizes. An attacker can exploit this to create oversized action containers, leading to incorrect stream interpretation and potential system integrity compromise.

In the Linux kernel, the next hop weight was increased from 8 bits to 16 bits to support larger ECMP weight ratios in CLOS networks. The change repurposed the reserved field resvd1 in the nexthop_grp structure to store high-order weight bits.

In the Linux kernel, the unused character device and IOCTLs in the QAT driver have been removed, reducing the attack surface. Device management is already handled via sysfs.

In the Linux kernel, redundant port lock acquisition in Samsung serial driver RX helpers has been removed, which caused a deadlock when console flow control was enabled.

In the Linux kernel DRM driver for Hyper-V, a vulnerability was found due to missing validation of VMBus packet size in the receive callback. An attacker in a virtual machine can send a crafted packet, causing an out-of-bounds read and potentially leaking data from previous messages.

In the Linux kernel, the tsconfig_prepare_data() function in ethtool was missing a call to ethnl_ops_complete() before returning an error, which could lead to lock management issues.

In the Linux kernel, a vulnerability was found in the XFRM subsystem where RCU synchronization in xfrm_policy_fini() was performed in the per-netns .exit handler, causing serial delays when removing multiple network namespaces. The fix moves the synchronization to the .pre_exit handler, reducing RCU grace periods from O(N) to O(1) per batch.

In the Linux kernel DRM Hyper-V driver, the resolution_count field in SYNTHVID_RESOLUTION_RESPONSE was not validated, potentially causing an out-of-bounds read of the supported_resolution array. Also, when the WIN10 resolution probe failed, screen_*_max / preferred_* were left unset, causing all userspace framebuffers to be rejected.

In the mlx5e driver in the Linux kernel, during handling of temporary SAs (acquire SA) in IPsec, the eswitch mode block was skipped, but the success label called unblock, causing an underflow of the num_block_mode counter.

In the pinctrl driver for Amlogic A4 SoCs in the Linux kernel, accessing the pinconf-pins sysfs node caused a deadlock because pinctrl_find_gpio_range_from_pin() tried to acquire the same mutex again.

In the arm_ffa firmware in the Linux kernel, the register-based PARTITION_INFO_GET_REGS path trusted firmware-provided indices, potentially allowing writes past the allocated array when copying partition descriptors.

In the Linux kernel NFSD, the nfsd4_revoke_states() function for layouts (SC_TYPE_LAYOUT) never set sc_status before calling nfsd4_close_layout(), causing an infinite loop in layout state revocation.

In the Linux kernel, in tcp_ao_established_key(), lockdep_sock_is_held() was used for a TCP_TIME_WAIT socket (twsk) which lacks sk_lock, causing an out-of-bounds memory access.

In the DRM Xe driver in the Linux kernel, in xe_gsc_init_post_hwconfig(), a managed BO was explicitly freed using xe_bo_unpin_map_no_vm(), causing a double-free because devm had already registered a cleanup action.

In the DRM AMDGPU driver in the Linux kernel, for VCE 1, the VCPU BO size did not account for the offset where the firmware resides, potentially causing an out-of-bounds read. Also, stack and data were not aligned to the 32K TLB size, and firmware was not checked to fit in the reserved space.

In the Linux kernel mac80211 subsystem, the MLE (Multi-Link Element) defragmentation routine was called with a pointer to the defragmented copy but the original elements, potentially causing a heap over-read if the original frame was at a higher address.

In the Linux kernel, a vulnerability in userfaultfd reads PTE entries without page table lock, causing undefined results on swap or migration entries. This may leave a thread asleep waiting for a UFFDIO_WAKE that may never arrive.

In the Linux kernel's KVM subsystem for x86, a vulnerability was found where the TPR threshold in VMCS is not properly recomputed after a PPR update. Under certain conditions, when no new interrupts are pending, apic_update_ppr() does not call kvm_lapic_update_cr8_intercept(), leaving a stale, high TPR_THRESHOLD value. This can cause a VM entry failure with hardware error 0x7 on older platforms or under nested virtualization (e.g., Hyper-V).

In the Linux kernel, the ACPI CPPC driver triggers a UBSAN warning due to misuse of the access_width field. When space_id is ACPI_ADR_SPACE_PLATFORM_COMM, access_width can exceed 4, causing a shift-out-of-bounds in a 32-bit int.

In the Linux kernel, the ACPI NFIT driver has a potential NULL pointer dereference. Installing a notify handler before checking the NFIT table presence can lead to acpi_nfit_uc_error_notify() being called without an allocated acpi_desc object.

In the Linux kernel, a use-after-free vulnerability was found in the ACPI NFIT driver. The error cleanup in acpi_nfit_init() fails to remove the acpi_desc object from the acpi_descs list, leading to a dangling pointer that can be accessed during subsequent Machine Check Exceptions (MCE), causing a use-after-free condition.

In the Linux kernel, the Rust block driver has a cleanup issue in GenDiskBuilder::build(). The error path before registration leaks a temporary gendisk and request_queue, potentially retaining blk-mq state after the tag set is dropped.

In the Linux kernel, the BPF JIT allocator is vulnerable to JIT spraying attacks. Reusing JIT memory can allow exploiting branch predictions from a previous program. A mechanism to flush branch predictors before reusing JIT memory has been added.

In the Linux kernel, the Spectre-v2 mitigation lacks IBPB flush on BPF JIT memory reuse. Enabling IBPB flush for BPF JIT allocations has been added, skipping when the BPF dispatcher uses retpoline.

In the Linux kernel, the rtw89 WiFi driver has a bug in the drop logic for malformed AMPDU frames. The previous fix fails with the first AMPDU packet in a certain sequence number range, causing unexpected packet drops and possible disconnection from the AP during rekey.

In the Linux kernel, the USB gadget rndis function lacks a length check for the RNDIS header in rndis_rm_hdr. The fields MessageType, MessageLength, DataOffset, and DataLength are accessed without verifying their presence.

A stack buffer overflow vulnerability was found in the BMC150 accelerometer driver in the Linux kernel. The device can report up to 127 FIFO frames, but the destination buffer is sized for only 32 frames, causing an out-of-bounds write on the stack.

In the kxsd9 accelerometer driver in the Linux kernel, a runtime PM usage-counter reference leak was found in the write_raw() error path. When a scale with a non-zero integer part is requested, the function returns -EINVAL without releasing the PM reference, preventing the device from autosuspending.