Linux kernel vulnerabilities

In the Linux kernel, the neigh_periodic_work() function lacked an annotation when deleting an RCU-protected item from a list, which could lead to store tearing. The fix adds rcu_assign_pointer() on the writer side.

In the Linux kernel's RDMA/siw subsystem, a vulnerability exists in connection failure handling. When immediate MPA request processing fails, the new endpoint unlinks the listening endpoint, and later TCP socket close causes a NULL dereference in siw_cm_work_handler(). The fix cancels the useless MPA timeout and simplifies MPA processing.

In the Linux kernel on LoongArch architecture, a vulnerability causes a system panic during initialization when DEFERRED_STRUCT_PAGE_INIT is enabled. The issue stems from incorrect node id assignment to reserved memory blocks, leading to a NULL pointer dereference in reserve_bootmem_region(). The fix assigns all reserved memory blocks to Node#0 during initialization.

In the Linux kernel, the Ceph filesystem fails to drop messages from MDS during unmount, causing inodes to be held with ihold. With encryption enabled, this triggers a warning when removing keys and later a kernel crash when releasing inodes after superblock destruction.

In the Linux kernel, the EROFS filesystem has a vulnerability in LZ4 in-place decompression that can lead to data corruption. The issue arises from uncertain buffer ordering when mapping two separate virtual buffers, exposed on new Intel x86 processors with FSRM feature.

In the Linux kernel, the AMD Display driver (drm/amd/display) did not wake the DMCUB before sending commands, which could cause a system hang. The fix adds waking DMCUB before command submission.

In the Linux kernel, a workaround for ARM Cortex-A520 erratum 2966298 was added. On affected cores, speculatively executed unprivileged loads might leak data from privileged loads via a cache side channel. The workaround executes a TLBI before returning to EL0.

In the Linux kernel, the ksmbd module has a use-after-free vulnerability in the smb20_oplock_break_ack function, involving the use of opinfo after the reference is dropped. This could lead to incorrect behavior or potential exploitation.

In the Linux kernel's mt76/mt7915 driver, an issue with txrate reporting was found. Improper checking of the rate_info structure led to unexpected reports, which could cause errors in bandwidth calculations.

In the Linux kernel, the ath10k driver has a use-after-free vulnerability in ath10k_htc_send_bundle. The bundle_skb variable may be freed, but later used to read the len field.

In the Linux kernel's xprtrdma (RPC-over-RDMA), after a reconnect, the reply handler opens the congestion window (cwnd) before enough Receive WRs are posted, causing an RNR error and immediate connection loss.

A vulnerability has been identified in the Linux kernel that has been resolved. It concerns the atomisp_alloc_css_stat_bufs() function, where a double free and use after free issue occurs.

In the Linux kernel's CIFS client, the smb2_get_enc_key function returns an incorrect error code, leading to a warning in errseq_set. The issue occurs when the encryption key cannot be obtained, and the error propagates to the write path, generating unnecessary warnings.

In the Linux kernel, the sfc (farch) network driver has a bug in TX event handling, where the TX queue lookup is incorrect. The function efx_channel_get_tx_queue() is used with a TXQ label instead of a type, which can return NULL and cause a panic.

In the Linux kernel, the i2c subsystem has a potential use-after-free. The adap structure is freed before it is done being used, which can lead to accessing freed memory.

In the Linux kernel, the ext4 filesystem has a vulnerability where the buddy bitmap is not regenerated after block freeing fails during fast commit replay. This can lead to corruption of the buddy bitmap and subsequent allocation errors.

In the Linux kernel, the AMD PM driver has a use-after-free vulnerability in kv_parse_power_table. When the allocation of ps by kzalloc returns NULL, the function frees adev->pm.dpm.ps, but later in the call chain kv_dpm_fini uses this freed memory in a loop, leading to use-after-free.

In the Linux kernel's nvmet-tcp subsystem, a vulnerability causes a kernel panic when a host sends an H2CData command with an invalid DATAL length. The issue leads to a NULL pointer dereference in nvmet_tcp_build_pdu_iovec(). The fix raises a fatal error if DATAL is not coherent with the packet size and ensures PDU length does not exceed MAXH2CDATA.

In the Linux kernel, a vulnerability in the UIO subsystem was fixed, involving use-after-free in uio_open. The issue occurred during device unregistration when another process could access already freed memory, potentially leading to double free.

In the Linux kernel, in the f2fs filesystem, when setting an extended attribute (xattr), the xattr list was not explicitly null-terminated. This removes the fragile assumption that unused xattr space is always zeroed.

In the Linux kernel, in the ext4 filesystem (file super.c), there is a use-after-free flaw in __ext4_remount. This occurs when freeing old quota file names before a potential failure, leading to an information leak.

A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on.

An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileges on the system.

A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel's SCTP subsystem. Guests with local user privileges can trigger a deadlock and potentially crash the system.

In the Linux kernel, in the SMB client sub-component (file smb2ops.c), there is an out-of-bounds memory read flaw in receive_encrypted_standard. This issue is caused by an integer underflow on the memcpy length, leading to a denial of service.

In the Linux kernel, the blkgs destruction path in block/blk-cgroup.c causes a cgroup blkio memory leak. A circular dependency prevents freeing blkcg and blkgs after they are offline, potentially leading to system instability like out-of-memory errors.

A heap out-of-bounds write vulnerability exists in the Linux kernel's Performance Events component. The read_size field of a perf_event can overflow, leading to an out-of-bounds write in perf_read_group().

An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This could allow a local attacker to crash the system or leak internal kernel information.

An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component is caused by a race condition between netlink control plane transaction and nft_set element garbage collection. Reference counter underflow leads to use-after-free, exploitable for local privilege escalation.

A use-after-free flaw was found in the memory management subsystem in the Linux Kernel, located in mm/mempolicy.c. This issue is caused by a race between mbind() and VMA-locked page fault, which may allow a local attacker to crash the system or lead to a kernel information leak.

A memory leak flaw was found in nft_set_catchall_flush in the Linux Kernel, which may allow a local attacker to cause double-deactivations of catchall elements, resulting in a memory leak.

A Use After Free vulnerability was found in the Fedora Linux kernel 5.9.0-rc9 in the vgacon_invert_region() function. It allows attackers to obtain sensitive information from kernel memory.

An issue was discovered in l2cap_sock_release in the Linux kernel before version 6.4.10, leading to a use-after-free due to mishandling of children of an sk.

This CVE was rejected because the description attributes a vulnerability to a non-existent Linux kernel function (usb_giveback_urb()) and the reported issue cannot be mapped to any valid codebase.

A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace.

A flaw in the Linux kernel's cpu_entry_area mapping of X86 CPU data to memory allows unauthorized memory access. Despite the 'Randomize per-cpu entry area' feature implemented in /arch/x86/mm/cpu_entry_area.c (based on CVE-2023-0597), there is still a risk of per-cpu entry area leaks. A local user may guess the location of exception stacks or other important data, potentially leading to privilege escalation.

A use-after-free flaw was found in vcs_read in vc_screen.c in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information.

A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.

A flaw was found in the skcipher_recvmsg function in the Linux kernel’s interface for symmetric key cipher algorithms. This flaw allows a local user to crash the system.

A vulnerability exists in the memory management subsystem of the Linux kernel, related to incorrect lock handling for accessing virtual memory areas. This can lead to use-after-free issues, allowing arbitrary kernel code execution and privilege escalation.

A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. A local attacker with user access can escalate privileges.

A NULL pointer dereference flaw exists in the Linux kernel's submit_lookup_cmds function due to a lack of check on the return value of kmalloc(). This issue allows a local user to crash the system.

An issue was discovered in the Linux kernel before version 6.3.2 related to a use-after-free in the rkvdec_remove function in rkvdec.c.

An issue was discovered in the Linux kernel before version 6.3.2 related to a use-after-free in the renesas_usb3_remove function in renesas_usb3.c.

An issue was discovered in the Linux kernel through 6.3.8 related to a use-after-free in the ravb_remove function in ravb_main.c.

An issue was discovered in the Linux kernel before version 6.3.2 related to a use-after-free in the cedrus_remove function in cedrus.c.

An issue was discovered in the Linux kernel before version 6.3.2 related to a use-after-free in the dm1105_remove function in dm1105.c.

An issue was discovered in the Linux kernel before version 6.3.2 related to a use-after-free in the saa7134_finidev function in saa7134-core.c.

An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c. This flaw could allow a local attacker to crash the system or leak kernel internal information.