Linux kernel vulnerabilities

In the Linux kernel's networking core, skb_copy and skb_copy_expand do not reject fraglist GSO skbs, which must not be linearized, potentially causing a crash later.

In the Linux kernel, an uninit-value access vulnerability was found in __ip_make_skb(). The issue is caused by a race condition when checking the HDRINCL flag and missing initialization of fl4_icmp_type and fl4_icmp_code fields in the flowi4 structure.

In the Linux kernel, a vulnerability was found in the __ip6_make_skb() function for IPv6, involving potential uninitialized value access. The issue arises from incorrect checking of the HDRINCL flag on the socket, which can lead to a race condition and reading uninitialized data.

In the Linux kernel, an out-of-bounds access vulnerability was found in the ops_init function. The issue arises from reading max_gen_ptrs twice without proper locking, potentially leading to a smaller allocated array than later used.

In the Linux kernel's tty n_gsm driver, there is an out-of-bounds write vulnerability in gsm0_receive() when switching modes and sending data exceeding gsm->len, potentially causing memory corruption.

In the Linux kernel, the net/smc module has a NULL pointer dereference vulnerability in smc_vlan_by_tcpsk(). Coverity found that netdev_lower_get_next can return NULL, and this pointer is then used without a check in is_vlan_dev(). The fix replaces the manual iteration with netdev_walk_all_lower_dev().

In the Linux kernel, the AMD KFD driver has a vulnerability causing kernel panic when reset fails and is triggered again. In SRIOV configuration, if reset fails to bring the ASIC back to normal but stop_cpsch has already been called, a subsequent reset may cause the driver to perform uninitialization again.

In the Linux kernel, a use-after-free bug was found in the mlx4_en driver in function mlx4_en_try_alloc_resources(). After calling mlx4_en_copy_priv() and on error, tmp->tx_cq is freed, and then in mlx4_en_alloc_resources() there is a dereference of &tmp->tx_cq[t][i], leading to use-after-free. A check of mlx4_en_copy_priv() was added to fix this.

In the Linux kernel, the pch_can driver for CAN bus has a use-after-free vulnerability in the pch_can_rx_normal function. After calling netif_receive_skb(skb), dereferencing skb is unsafe, and the can_frame structure is still used.

In the Linux kernel's seg6 (IPv6 Segment Routing), during encapsulation of an IPv4 packet into an IPv6+SRH header, the seg6_do_srh_encap function clears the IPv6 control block, losing the receiving interface index. This can lead to a NULL pointer dereference when forwarding stats are enabled.

In the Linux kernel, a slab-use-after-free vulnerability was found in the Bluetooth L2CAP subsystem's l2cap_connect() function. The issue arises from an insufficiently extended critical section, allowing premature freeing of the chan structure before use. The patch extends the critical section and changes the return type to void to prevent pointer leaks.

In the Linux kernel, a flaw in the abort logic of btrfs_replace_file_extents can lead to a corrupt file system with a missing extent in the middle of a file. The incorrect condition may cause an abort when it should not, especially in prealloc code paths.

In the Linux kernel, the HSR subsystem has a use-after-free vulnerability in prp_create_tagged_frame(). The prp_fill_rct() function can fail, freeing the skb and returning NULL, but the original skb is returned on the success path, leading to use of freed memory.

In the Linux kernel's atl1c driver, a vulnerability related to DMA RX overflow is addressed by checking the allocated skb address and using skb_reserve() to avoid the problematic 0x...fc0 address. Tested on AR8131 on Acer 4540.

In the Linux kernel, the iommufd subsystem has a vulnerability due to missing update of the domains_itree after splitting an iopt_area. If the original area was linked to a domain, pages are not properly reinserted, leading to tree corruption and use-after-free (UAF).

In the Linux kernel, the ath11k wifi driver lacks RCU read-side critical section marking during DFS radar event handling. The code calling ath11k_mac_get_ar_by_pdev_id() was not marked as an RCU read-side critical section, which can lead to use-after-free issues.

In the Linux kernel, in the ath12k Wi-Fi driver, an RCU locking issue was found in the handling of DFS-radar and temperature events. The code was not marked as an RCU read-side critical section, which may lead to use-after-free issues.

In the Linux kernel, the ath12k WiFi driver has a locking issue in the htt mlo-offset event handling. The code was not marked as an RCU read-side critical section, which could lead to use-after-free issues.

In the Linux kernel, the AMDGPU driver has a pin_count leak for the gart.bo object. The GART disable function is not called in SRIOV scenarios, leading to a leak when the driver is unloaded.

In the Linux kernel, the AMDKFD driver's svm_migrate_fini function performs redundant resource release operations, causing warnings and potential issues during driver disconnect.

In the Linux kernel, the SCTP function sctp_rcv_ootb does not check if skb_header_pointer returns NULL before using it, which could lead to a NULL pointer dereference. The fix adds a check and breaks out if the return is NULL.

In the Linux kernel, the mac80211 subsystem has a use-after-free vulnerability during CCMP/GCMP RX. Under certain conditions, the 'hdr' variable may be invalid, leading to use of freed memory.

In the Linux kernel, the dma-debug module can generate an error message millions of times per second, causing printk buffer spam and CPU usage up to 100%. This affects drivers using the DMA API.

In the Linux kernel's enetc driver, there is an illegal memory access when reading the affinity_hint file in procfs. irq_set_affinity_hit() stores a reference to a temporary stack variable, leading to a page fault on later access. The issue is fixed by the get_cpu_mask() helper, which provides permanent storage.

In the Linux kernel's drm/sched (GPU scheduler), before killing a job, all its dependencies must complete to avoid data corruption.

In the Linux kernel, the wl1251 driver's wl1251_cmd_scan function calls memcpy without checking the length, which could lead to a buffer overflow. The fix adds a check to ensure the length is within the maximum allowed size.

In the Linux kernel, a vulnerability in the f2fs filesystem was fixed where multiple filesystem instances could race on accessing the global fsync_entry_slab pointer, leading to a use-after-free issue during recovery. The fix initializes and destroys this slab cache only once during module init/destroy to avoid the issue.

In the Linux kernel, a NULL dereference in nfs3svc_encode_getaclres in nfsd was fixed, occurring in error cases when dentry may be NULL.

In the Linux kernel, a vulnerability in scsi/libfc was fixed, addressing an array index out of bound exception in fc_rport_prli_resp().

In the Linux kernel CIFS module, there is a NULL pointer dereference vulnerability in cifs_compose_mount_options(). The optional @ref parameter may contain a NULL node_name, leading to a NULL pointer dereference.

In the Linux kernel, the SCSI target subsystem has a NULL pointer dereference when completing XCOPY operations. The function target_complete_cmd() uses the se_tpg_wwn pointer, which is NULL for the global tpg used by XCOPY, leading to a panic. The fix checks if se_tpg_wwn is NULL and then uses se_cmd->cpuid.

In the Linux kernel's NFS, a use-after-free occurs in nfs4_init_client() when attempting to mount two different exports through two different NICs belonging to the same server. KASAN reported the issue.

In the Linux kernel, the AMD Display Manager (DMUB) driver has a memory leak during system suspend/resume operations. The initialization function allocates memory on every resume, leading to a growing leak.

In the Linux kernel, the TCP option parser in synproxy (synproxy_parse_options) could read one byte out of bounds. When the length is 1, the execution flow enters the loop, reads one byte of the opcode, and if the opcode is neither TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, exceeding the length of 1. The fix adds an early return when length < 0.

In the Linux kernel's mptcp (Multipath TCP), the TCP option parser (mptcp_get_options) can read one byte out of bounds when the option length is 1. The fix is inspired by a similar fix for IPv4 TCP.

A vulnerability has been identified in the Linux kernel related to integer overflow when accessing stack size. The patch reintroduces protection against negative access size to stack memory, which could lead to out-of-bounds array accesses.

In the Linux kernel's io_uring/kbuf subsystem, a vulnerability exists where the io_buffer_list reference is not held over mmap, potentially allowing the buffer to be unregistered before use. The fix holds a reference to the buffer list under RCU to prevent unregistration.

In the Linux kernel, the icmp_build_probe() function has potential NULL dereferences. A double call to __in_dev_get_rcu() can return NULL, and reading dev->ip6_ptr lacks a NULL check. The fix uses the correct RCU API.

In the Linux kernel, in the mlx5e network driver, a double-free vulnerability was found in the arfs_create_groups function. When memory allocation fails, the function frees ft->g, and then a call to mlx5e_destroy_flow_table frees it again.

In the Linux kernel's cachestat for shmem, two bugs exist due to races with swapping and invalidation. The first can cause out-of-bounds access to swapper_spaces[] on a poisoned swap entry. The second can cause false results in workingset_test_recent() when the shadow entry is missing. The fix validates the entry and handles the missing shadow case.

In the Linux kernel s390 AES crypto module, there is a buffer overread vulnerability in CTR mode. When processing the last block, the code always reads a full block even if less data remains, causing an out-of-bounds read.

In the Linux kernel's atlantic network driver, there is a double free in error handling logic where aq_ring_free can be called multiple times on the same ring under memory pressure.

In the Linux kernel's NTFS3 filesystem, a fixed overflow check in mi_enum_attr() addresses a potential overflow issue.

In the Linux kernel, in the firewire nosy driver, an issue was found where packet_buffer_get did not take user_length into account. If the head packet length exceeds user_length, the function now returns 0 to indicate that no data was read and a larger buffer is needed. This helps prevent user space overflows.

A vulnerability related to Use-After-Free has been identified in the Linux kernel within the gtp_dellink function. The issue arises from improper management of the RCU critical section, which may lead to the key being freed during traversal.

In the Linux kernel, dead code related to SCM_RIGHTS was removed from io_uring. After dropping support for passing io_uring fds over SCM_RIGHTS, the code was removed.

In the Linux kernel, a vulnerability related to sending io_uring files over AF_UNIX sockets was found. File reference cycles caused problems and races, so the decision was made to completely disallow sending io_uring files via sockets using SCM_RIGHTS.

In the Linux kernel, the PECI subsystem has a use-after-free vulnerability in the adev_release() function. When auxiliary_device_add() returns an error, auxiliary_device_uninit() is called, which decrements the device refcount and triggers the .release callback. Re-calling auxiliary_device_uninit() in adev_release() leads to use-after-free.

In the Linux kernel, an unnecessary synchronize_net() call was removed from the ipv6_mc_down() function. This call caused delays from 200 microseconds to 5 milliseconds under load.

In the Linux kernel, in the ttpci media driver, two memory leaks were found in budget_av_attach. When saa7146_register_device and saa7146_vv_init fail, resources are not freed. The fix adds proper resource deallocation.