Linux kernel vulnerabilities

In the Linux kernel, the tmpfs filesystem has a race condition when handling the dquot rbtree. Fetching the root node is not protected by the dqio_sem semaphore, which can lead to errors and warnings.

In the Linux kernel, the iwlwifi (mvm subsystem) driver has a vulnerability where the TX queue for the offloading TID is not guaranteed to exist during resume. In the rare case that no packets were sent on TID 0, the queue is not allocated, causing a system crash.

In the Linux kernel, in the AMD Display driver, a potential buffer overflow was found in function dp_dsc_clock_en_read(). The snprintf() function was writing up to 30 bytes into a 10-byte buffer. The fix limits the write to at most 10 bytes.

In the Linux kernel, the DVB subsystem has a use-after-free vulnerability. In dvb_register_device, *pdvbdev is set to dvbdev, which is freed in error paths, but not set to NULL, leading to use of freed memory in later calls such as dvb_unregister_device.

In the Linux kernel, in the amdgpu graphics driver, an out-of-bounds access was found in the mmhub client ID. The fix adds proper handling for cid 0x140.

In the Linux kernel, the netfilter module (nft_set_pipapo) has an issue with walking over the current view during netlink dump. The generation mask can be updated during the dump, so the iterator cannot rely on it. A notation was added to specify if the user wants to read/update the set.

In the Linux kernel, a vulnerability in the netfilter nf_tables subsystem causes memory leaks when a set deletion operation fails, due to incorrect element iteration logic in the abort path that skips active instead of inactive elements.

In the Linux kernel, the speakup module has a crash risk on very long words. If a console is very large and contains a word longer than 256 characters, it must stop before exceeding the word buffer length.

In the Linux kernel, in the ksmbd subsystem, a potential out-of-bounds read was found when the buffer offset field in some requests is invalid. The fix sets the minimum value of the buffer offset field to the buffer offset to validate buffer length.

In the Linux kernel, the SLUB subsystem fixed flush_cpu_slab() and __free_slab() invocations in task context. The issue occurred when flush_all_cpu_locked() called from task context could cause a dependency issue when a workqueue with WQ_MEM_RECLAIM bit set flushed the global workqueue.

In the Linux kernel, the gma500 graphics driver (drm/gma500) has a bug where a destroyed mutex object is used during psb_gem_unpin(). This triggers a WARN_ON(lock->magic != lock) warning and may lead to system instability. The fix moves the drm_gem_object_release() call after the unpin operation.

In the Linux kernel, the binder driver lacks an offset alignment check in the binder_get_object() function. A previous fix removed this check, which may lead to issues when unwinding objects.

In the Linux kernel, a vulnerability in the netfilter module (nft_set_pipapo) can lead to a system crash during large batch add/remove operations. The issue arises from incorrect element removal when multiple elements share the same key, potentially unmapping the wrong element and leaving a stale pointer in the data structure.

In the Linux kernel, a vulnerability in the amdgpu driver was fixed, involving insufficient validation of buffer mapping operation parameters. Lack of proper verification could lead to incorrect behavior or potential security issues.

In the Linux kernel, a use-after-free vulnerability was found in the AoE driver in aoecmd_cfg_pkts(). The fix addresses the issue from CVE-2023-6270, where improper refcnt updates on net_device could lead to use-after-free. The dev_put() call was removed from the success path and added after skb transmission.

A vulnerability has been identified in the Linux kernel related to incorrect overflow checking in the devmap code. The issue occurs on 32-bit architectures where overflow may happen during the rounding of the number of hash buckets.

A vulnerability related to stack overflow in 32-bit architectures has been fixed in the Linux kernel, which could lead to unpredictable behavior.

A vulnerability in the Linux kernel's ip_tunnel_rcv() function for IP tunnels was found. The lack of proper inner header pulling can lead to reading uninitialized memory, as reported by syzbot as a KMSAN bug. The issue affects GRE packet processing in the ip_tunnel_rcv path.

A vulnerability has been identified in the Linux kernel that has been resolved. The issue concerns the registration of an event handler before the srpt device is fully set up, which may lead to a use-after-free Write error in the srpt_refresh_port() function.

In the Linux kernel, the USB Type-C driver (tipd) function tps6598x_block_read triggers a WARN_ON when given an excessive length, potentially causing a system panic if panic-on-warn is enabled.

In the Linux kernel, the lpfc (SCSI) driver has a list corruption vulnerability in lpfc_drain_txq(). An error handling bug causes jobs to be added to the completions list even without an error, leading to list corruption.

In the Linux kernel, the lpfc SCSI driver has a NULL pointer dereference vulnerability during link down processing. Under certain conditions, it may reference an invalid structure, leading to a crash.

In the Linux kernel, the netfilter module (nft_set_pipapo) has an issue with double destruction of elements. The clone always provides a current view of the lookup table; it should be used to destroy the set, otherwise elements may be destroyed twice.

A vulnerability in the Linux kernel's IP tunnel infrastructure causes perpetual growth of the needed_headroom value, leading to a 16-bit network_header wrap-around and a use-after-free condition during packet processing. This can result in a kernel crash.

In the Linux kernel, the Bluetooth subsystem has a potential use-after-free in hci_error_reset. While handling the HCI_EV_HARDWARE_ERROR event, if the BT controller is not responding, the GPIO reset mechanism can free hci_dev and lead to use-after-free.

In the Linux kernel, a bug was found in wakeup_kswapd() called with an invalid zone index (-1) on NUMA systems without local memory on a node, causing a page fault and system crash.

In the Linux kernel, a vulnerability in the ext4 filesystem was fixed, which could lead to allocating blocks from a group with a corrupted block bitmap. The issue occurred in ext4_mb_try_best_found() during concurrent access, potentially worsening the state of the corrupted filesystem.

In the Linux kernel, the dm-crypt module has an issue with modifying data when using authenticated encryption. To prevent invalid tag generation, data is first copied into a clone bio and then encrypted inside the clone.

In the Linux kernel, the net/sched module (act_mirred) has an issue with overriding the return value if the skb is already lost. If redirecting the skb and tcf_mirred_forward() has not been called, the retcode should be set to SHOT to drop the skb. If tcf_mirred_forward() has been called, the skb is out of control and returning SHOT leads to use-after-free.

In the Linux kernel, the nct6775 hwmon driver has an issue with accessing temperature configuration registers. The number of temperature configuration registers does not always match the total number of temperature registers, which can lead to access errors reported by KASAN (global-out-of-bounds).

In the Linux kernel, the stmmac Ethernet driver has a vulnerability due to lack of mutual exclusion when updating 64-bit statistics counters. On 32-bit platforms, this can lead to lost seqcount updates and permanent blocking of readers, causing system lockups.

In the Linux kernel, a vulnerability in the libceph library can lead to incorrect data interpretation during a short read from the socket. The read_partial_sparse_msg_data() function may invoke the OSD client state machine, leading to bogus data. The fix reuses cursor->total_resid to determine whether to bail and wait for more data.

In the Linux kernel netfilter nftables exthdr module, there is a 4-byte stack out-of-bounds write vulnerability. If priv->len is a multiple of 4, writing to dst[len / 4] can go past the destination array, causing stack corruption.

In the Linux kernel, NFSv4 fixed a NULL pointer dereference in pnfs_mark_matching_lsegs_return(). The function did not check if the struct pnfs_layout_range argument had a value before dereferencing it, causing an oops.

In the Linux kernel, the mt7530 DSA driver has a vulnerability causing VLAN traffic leaks. The PCR_MATRIX field is not reset when VLAN filtering is disabled, which may lead to unintended traffic forwarding between bridges.

A data-race vulnerability was found in the Linux kernel's ipv6_mc_down / mld_ifc_work functions for IPv6 multicast. The idev->mc_ifc_count field can be written without proper locking, leading to undefined behavior.

In the Linux kernel, a vulnerability related to buffer overflow in the trans_stat_show() function has been fixed. The use of snprintf has been changed to the more secure scnprintf, and conditions checking for exceeding PAGE_SIZE have been added.

In the Linux kernel, the MPTCP protocol has a corruption of the sk_forward_memory field during retransmission. This field is protected by the msk socket spin_lock, but a code path updates it without that lock, potentially leading to data corruption.

In the Linux kernel's NVMe over Fabrics (nvmet) subsystem, there is a bug where it attempts to free p2p memory that was not allocated from the p2p pool. When a p2p device is found but the pool is empty, the NVMe target tries to free the SGL from the p2p pool instead of the regular pool, causing a crash (BUG). The fix assigns p2p_dev only if the memory was actually allocated from the p2p pool.

In the Linux kernel neighbour module, there is a vulnerability where NUD_NOARP entries cannot be forced to be garbage collected. Point-to-point interfaces use NUD_NOARP entries for IPv6, which can fill up the neighbour table and prevent valid connections.

In the Linux kernel, a vulnerability in the cachestat mechanism was fixed, involving use-after-free of a folio during page cache walk. Lack of holding a reference to the folio could lead to concurrent release and reuse of the object.

In the Linux kernel, the iwlwifi driver has a vulnerability leading to memory corruption. The issue is copying data to the data pointer in the iwl_fw_ini_trigger_tlv structure with an offset in bytes, which can write past the buffer.

In the Linux kernel, an alignment check was added for the event ring read pointer in the MHI host driver. Lack of alignment could lead to DoS or ring buffer memory corruption.

In the Linux kernel, the media mtk-jpeg driver has a use-after-free bug due to error path handling in mtk_jpeg_dec_device_run. If an error occurs in mtk_jpeg_set_dec_dst, the timeout worker may be started and the job marked as finished, leading to use-after-free when removing the module or closing the file descriptor.

In the Linux kernel, the JFS filesystem has a use-after-free vulnerability in jfs_evict_inode. When diMount(ipimap) fails, the released ipimap object may be accessed in diFreeSpecial(). Therefore, sbi->ipimap should not be initialized as ipimap when diMount fails.

In the amdgpu driver in the Linux kernel, a potential NULL pointer dereference in amdgpu_ras_query_error_status_helper() was fixed. The function now returns -EINVAL for invalid block IDs.

In the Linux kernel, the Ceph filesystem has an incorrect lock order between a directory entry and its parent, leading to a deadlock or dead code. The fix removes the unused code.

In the Linux kernel, the Marvell Prestera network driver has a vulnerability due to incorrect structure access. The code accesses the upper_dev field, which is relevant only for specific events, leading to invalid memory access.

In the Linux kernel, the mm subsystem has an issue where large anonymous mappings are forced to align on THP boundaries on 32-bit systems. This forcing is not sensible on 32-bit systems due to constrained virtual address space and causes reported problems.

In the Linux kernel, the mac80211 subsystem has a potential key use-after-free vulnerability. When ieee80211_key_link() returns 0 due to KRACK protection, ieee80211_gtk_rekey_add() still returns a pointer to the key, which may lead to use of freed memory.