Linux kernel vulnerabilities

In the Linux kernel, the ad_sigma_delta driver for registerless ADC devices (has_registers=false) without rdy_gpiod, the ad_sigma_delta_clear_pending_event() function may read conversion data instead of status, corrupting the data stream. Additionally, when num_resetclks=0, a memset with negative size causes a heap overflow.

In the ad_sigma_delta ADC driver in the Linux kernel, issues were found with CS (chip select) being left asserted and SPI bus lock state leaks. In ad_sigma_delta_single_conversion(), set_mode() and disable_one() are called while keep_cs_asserted is still true, leaving CS active after conversion. Additionally, in the error path of ad_sd_buffer_postenable(), the device may remain in continuous conversion mode with CS asserted, and the bus_locked flag may stay set, allowing concurrent SPI access.

In the lpc32xx_adc ADC driver in the Linux kernel, an initialization order bug was found: init_completion() is called after registering the interrupt handler (devm_request_irq()). If an interrupt occurs before initialization, the handler calls complete() on an uninitialized completion structure, causing a NULL pointer dereference and kernel panic.

In the ti-ads1119 ADC driver in the Linux kernel, a runtime PM usage-counter reference leak was found in the buffer preenable function. When i2c_smbus_write_byte() fails, the error is returned without releasing the PM reference, leaving the device active.

In the hw-consumer IIO buffer driver in the Linux kernel, a memory leak was found: after the scan mask allocation was changed to a separate bitmap, iio_hw_buf_release() does not free the mask before freeing the buffer structure.

In the scd30 chemical sensor driver in the Linux kernel, a sign-extension bug was found when processing float32 values. The bitwise AND with ~BIT(31) (0xFFFFFFFF7FFFFFFF) corrupts the exponent, leading to incorrect readings. Code readability was also improved by refactoring variable initializations.

A race condition in the Linux kernel's IIO event FIFO reset allows a concurrent thread to read from the FIFO during reset, causing an out-of-bounds read and kernel memory leak to userspace.

In the bmg160 gyroscope driver in the Linux kernel, an out-of-bounds array read was found in bmg160_get_filter() and bmg160_set_filter(). When the requested bandwidth/filter value is not in the bmg160_samp_freq_table[], the functions read past the array, potentially causing incorrect values or crashes. The set_filter() path is reachable from userspace via sysfs.

In the Linux gp2ap002 light sensor driver, a runtime PM reference leak occurs when gp2ap002_read_raw() fails, skipping the put_autosuspend call and preventing device autosuspend.

In the Linux mpl115 pressure sensor driver, a runtime PM reference leak happens on read error because pm_runtime_put_autosuspend() is skipped.

In the Linux tmp006 temperature sensor driver, the trigger is allocated with devm but registered with plain iio_trigger_register(), leaving a dangling pointer after module unload.

In the ALSA usx2y driver for us144mkii, a use-after-free occurs because URBs can resubmit and re-arm work after cancellation, leading to work on freed memory.

In the ALSA virtio-snd driver, control metadata from the device is not validated, allowing a malicious device to cause out-of-bounds access.

In the ALSA ymfpci driver, snd_ymfpci_create_spdif_controls() does not check the return value of snd_ctl_new1(), which can return NULL on memory allocation failure, leading to NULL pointer dereference.

In the ALSA aoa driver, the layout.c function does not check the return value of snd_ctl_new1(), which can return NULL, leading to NULL pointer dereference.

In the ALSA caiaq driver for Traktor Kontrol S4, an out-of-bounds read occurs because the parser assumes 16-byte blocks but the device can send a short block, causing unsigned underflow and reading past the buffer.

In the ALSA cmipci driver, snd_cmipci_spdif_controls() does not check the return value of snd_ctl_new1(), which can return NULL, leading to NULL pointer dereference.

In the ALSA compress driver, snd_compr_task_new() leaks driver resources on error after successful task_create() and may incorrectly report success due to uninitialized retval.

In the Linux kernel's ALSA es1938 driver, the return value of snd_ctl_new1() is not checked. If memory allocation fails, NULL is returned and then dereferenced, leading to a NULL pointer dereference.

In the Linux kernel's ALSA firewire isight driver, the sample count from the device packet is not bounded to MAX_FRAMES_PER_PACKET. A malicious or faulty Apple iSight device can send a packet with an excessive sample count, causing out-of-bounds read of the payload and out-of-bounds write of the PCM DMA buffer.

In the Linux kernel's ALSA gus driver, the return value of snd_ctl_new1() is not checked. If memory allocation fails, NULL is returned and then dereferenced, leading to a NULL pointer dereference.

In the Linux kernel's ALSA hda/cs35l41 driver, there is a teardown issue with firmware load work. ALSA controls are not removed on component unbind, and fw_load_work may be cancelled only conditionally. If the component or device is removed before the queued work runs, a use-after-free can occur.

In the Linux kernel's ALSA ice1712, ice1724, and aureon drivers, the return value of snd_ctl_new1() is not checked in multiple places. If memory allocation fails, NULL is returned and then dereferenced, leading to NULL pointer dereferences.

In the Linux kernel's ALSA seq, snd_seq_event_dup() leaks uninitialized heap data. For legacy (non-UMP) events, the trailing word in cell->ump.raw.extra is not zeroed, causing uninitialized heap data or leftover event data to be copied to user space.

In the Linux kernel's ALSA usb-audio driver for DualSense controllers, snd_dualsense_ih_match() uses kobject_get_path() to compare kobject paths. During rapid disconnect/reconnect, a dangling kobject name can be dereferenced, causing a fault in strlen() and a system crash.

In the Linux kernel's resctrl subsystem on x86 with SNC enabled, an out-of-bounds access can occur during CPU offline. When a monitoring domain is going offline, its cpu_mask is empty, and the NUMA node ID query via cpu_to_node() uses nr_cpu_ids as argument, causing an out-of-bounds access.

In the Linux kernel, a vulnerability was found in the vfio/pci driver related to the disable_idle_d3 parameter. Initially writable and directly controlling device power state, later code changes made it globally modifiable, causing unbalanced power management (PM) operations. The fix latches the flag per device, ensuring consistent PM behavior.

In the Linux kernel's vfio/pci driver, after a reorder in vfio_pci_core_register_device(), the VGA arbiter client registration is not unwound on failure. This can leave a callback with a freed vdev cookie, which becomes unsafe when the callback follows drvdata to the vfio device.

In the Linux kernel, vfio_mig_get_next_state() has an infinite loop when handling blocked state transitions. The skip loop does not account for the ERROR sentinel, causing a spin and potential soft lockup.

In the Linux kernel VFIO, debugfs is removed after devres release, leaving stale debugfs entries visible. The issue is in the order of vfio_device_del() and vfio_device_debugfs_exit().

In the Linux kernel vfio/mlx5 driver, bitfields are used in a racy manner because bitfield operations are not atomic. They are split into dedicated storage units for concurrently modified flags.

In the Linux kernel Bluetooth btusb driver, a use-after-free occurs on controller registration failure. Sibling interfaces are not released, leading to double-free on disconnect.

In the Linux kernel Bluetooth btusb driver, a use-after-free occurs on Marvell OOB wakeup probe failure. Submitted TX URBs are not stopped, leading to access to freed memory.

A use-after-free (UAF) vulnerability was found in the Linux kernel's binder_thread_release() function. A race condition between thread exit and concurrent transaction freeing can lead to accessing freed memory.

A use-after-free vulnerability was found in the Linux kernel's binder_free_transaction() function in the Binder driver. The issue occurs because the target process pointer (t->to_proc) is read under a lock, but after the lock is released, the process can be freed, leading to access to freed memory.

In the Linux kernel rust_binder driver, an incorrect stride (usize instead of u64) is used when cleaning up the offsets array. On 32-bit kernels, this causes over-decrement of reference counts and corrupted reference accounting.

In the Linux kernel rust_binder driver, the freeze listener is not cleared on node removal when the user does not do it explicitly. This can lead to a memory leak due to a reference cycle.

In the Linux kernel xhci driver, xhci_free_streams() calls dma_free_coherent() with irqs disabled, which can cause a 'sleep in atomic context' error. The issue occurs when disconnecting a USB device with active streams.

In the Linux kernel, the xHCI driver has a memory leak in xhci_ring_to_sgtable(). The temporary pages array is not freed after successfully creating the sg_table, leaking memory each time a sideband client gets an endpoint or event ring buffer.

In the Linux kernel's TCPCI rt1711h driver, the TCPCI port is not unregistered if later steps in probe() fail. The port remains registered, potentially causing issues on re-initialization or driver detach.

In the Linux kernel's PCI Altera driver, resource leaks occur when pci_host_probe() fails. The chained IRQ handler and INTx domain are not removed, and controller interrupts remain enabled, leading to use of a stale data pointer.

In the Linux kernel's PCI MediaTek driver, an IRQ domain leak occurs when a port fails to enable. IRQ domains created by mtk_pcie_init_irq_domain() are not freed, leading to resource leaks.

In the Linux kernel, the sriov_restore_vf_rebar_state() function has an out-of-bounds access to the barsz[] array when a VF Resizable BAR Control register read returns PCI_ERROR_RESPONSE. This can lead to memory corruption and system instability.

A vulnerability in the Linux kernel's DAMON module was found in the damon_hot_score() function, which mishandles extreme monitoring interval values (zero or too high). Setting a zero sampling interval causes a divide-by-zero error, while a zero aggregation interval returns an incorrect value, also leading to division by zero. An excessively high aggregation interval can cause an out-of-bounds array access, resulting in memory corruption.

A bug in the Linux kernel's virtio_pci driver causes a NULL pointer dereference when unbinding a virtio_balloon device. The issue stems from incorrect indexing of the vqs_info array when queues are conditional (e.g., stats, free_page, reporting), creating holes. During device removal, a dense index (queue_idx) is used to look up in a sparsely populated array, leading to a crash.

In the Linux kernel's virtio hwrng driver, a buffer over-read vulnerability exists. A malicious or buggy virtio-rng backend can report an inflated used.len, causing memcpy() to read past the vi->data array into adjacent heap memory.

A use-after-free vulnerability was found in the Linux kernel's chaoskey driver in the chaoskey_release() function. When a user closes the device after USB unplugging, a debug log statement accesses the usb_interface structure after it has been freed, causing memory corruption.

In the Linux kernel's dwc3 USB driver, dwc3_gadget_suspend() calls the gadget disconnect callback with IRQs disabled, causing a Lockdep violation. The issue was found by a static analysis tool and manually confirmed.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's USB misc/usbio driver. During device disconnect, the usbio_disconnect() function iterated over clients and freed them, but the loop continued to access freed memory, causing a KASAN error. The fix replaces the loop with list_for_each_entry_safe_reverse() to prevent use after free.

In the Linux kernel's 6LoWPAN stack, a race condition in lowpan_nhc_do_uncompression() can lead to use-after-free of an NHC descriptor after releasing the lock. KASAN reported the issue as a slab-use-after-free.