Linux kernel vulnerabilities

A NULL pointer dereference vulnerability was found in the func_set_flag() function in the Linux kernel tracing subsystem. When the active tracer is switched from 'function' to another (e.g., 'wakeup_rt'), the current_trace_flags field becomes NULL, and the function reads it before verifying the tracer type, causing a kernel crash.

In the Linux kernel's vme_user driver (staging), the buffer_to_user() and buffer_from_user() helpers did not validate that offset + count stays within the fixed-size kern_buf (128 KiB). This allowed out-of-bounds reads/writes beyond the allocated buffer.

In the Linux kernel's SMB client (cifs), a vulnerability exists due to incorrect application of the +1 byte exemption for responses with a data area. The smb2_check_message() function accepts responses one byte longer than received, which leads to an out-of-bounds read when a data area is present. The issue is reachable during SMB negotiation and session setup, before full authentication.

In the Linux kernel's ipu7_isys_init() and ipu7_psys_init() functions, a double-free and use-after-free occur when kfree(pdata) is called again after the device teardown already freed it. Additionally, the error code is not saved before put_device(), causing ERR_CAST() to dereference a freed pointer.

In the rtl8723bs driver in the Linux kernel, a heap buffer overflow occurs in rtw_cfg80211_set_wpa_ie() when a local user sends a crafted WPA IE of length 255, causing memcpy to copy 257 bytes into a 256-byte buffer, overflowing into the adjacent last_mic_err_time field.

In the rtl8723bs driver in the Linux kernel, an underflow and OOB read occur in OnAuth() when a short authentication frame causes negative length calculation in rtw_wep_decrypt(), leading to out-of-bounds read. Also, memcmp always reads 128 bytes regardless of actual IE length.

In the rtl8723bs driver in the Linux kernel, an OOB read occurs in the IE loop in OnAssocRsp() when a malicious AP sends an AssocResponse with a truncated last IE, causing pIE->length to be read out of bounds. Also, declared IE length may extend beyond the buffer.

In the rtl8723bs driver in the Linux kernel, an OOB read occurs in the IE loop in update_beacon_info() when a malicious AP sends a Beacon with a truncated last IE, causing pIE->length to be read out of bounds. Also, declared IE length may extend beyond the buffer.

In the rtl8723bs driver in the Linux kernel, OOB reads occur in IE loops in issue_assocreq() and join_cmd_hdl() when IE data ends with only an element_id byte, causing pIE->length to be read out of bounds. A malicious AP can trigger this via crafted Beacon or Probe Response frames.

In the rtl8723bs driver in the Linux kernel, OOB reads occur in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() due to missing bounds checks before reading IE/attribute headers and comparing multi-byte OUI identifiers.

In the rtl8723bs driver in the Linux kernel, an OOB write occurs in HT_caps_handler() which iterates over pIE->length bytes and writes into a fixed 26-byte array. A malicious AP can set pIE->length up to 255, causing up to 229 bytes of out-of-bounds writes.

In the Linux kernel, a use-after-free vulnerability was found in the Intel QAT driver during SR-IOV disable. The adf_disable_sriov() function destroys per-VF structures without stopping or synchronizing VF2PF workers, leading to freed memory dereference. The fix adds a vf2pf_disabled flag and synchronizes interrupts and workqueue.

A use-after-free vulnerability was discovered in the Linux kernel's ksmbd module. It occurs when a SMB2_CLOSE on a locking handle is followed by a SMB2_CANCEL request for the same AsyncId, causing a freed file_lock structure to be reused, leading to memory corruption.

In the Linux kernel, the pfkey_msg2xfrm_state() function fails to initialize the alg_key_len field for IPComp states (SADB_X_SATYPE_IPCOMP). This leaves uninitialized slab data, which is later used by xfrm_algo_clone() during state migration (XFRM_MSG_MIGRATE), causing a slab-out-of-bounds read and potential KASAN error.

Data races were discovered in the Linux kernel when reading the audit_queue length via skb_queue_len(). Multiple threads read this field without locking, while writes are protected by a spinlock, leading to inconsistent reads.

A use-after-free (UAF) vulnerability was found in the Linux kernel's Bluetooth L2CAP stack in the l2cap_chan_timeout() function. When a channel timeout is set and the connection is torn down before the timer expires, the timeout handler accesses freed connection memory, causing memory corruption. The fix ensures the connection reference is held for the channel's lifetime.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's Bluetooth MGMT subsystem in the add_device_complete function. It accesses the hci_conn_params object without proper locking, allowing a concurrent remove_device operation to free the memory before it is read.

In the Linux kernel NTFS3 driver, a slab out-of-bounds write vulnerability was found during $LogFile journal replay. An attacker can craft an NTFS image where the lcns_follow field in a log record exceeds the DPT entry capacity, causing a write beyond allocated memory.

In the Linux kernel NTFS driver, a vulnerability was found where post_write_mst_fixup() is called for an invalid index block. An attacker can craft a malicious NTFS image, leading to out-of-bounds memory read or write.

In the NTB (Non-Transparent Bridge) driver for PCIe EPF devices, a problem was found where pci_irq_vector() is called in hardirq context. This function uses a mutex, leading to a 'scheduling while atomic' error and potential system hang.

In the GPIO EIC (External Interrupt Controller) driver for Spreadtrum SoCs, a regular spinlock (spinlock_t) is used in the irq_startup path. On PREEMPT_RT systems, spinlock_t becomes a sleeping lock, causing a 'sleeping function called from invalid context' error.

In the Linux kernel, the GPIO SCH driver has a locking issue in the IRQ startup path. The sch_irq_unmask() function uses a regular spin_lock, which on PREEMPT_RT systems becomes a sleeping lock, causing a bug when called from a non-sleepable context. The fix replaces the lock with raw_spinlock_t, suitable for IRQ context.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the HID logitech-dj driver during DJ_SHORT report validation. The issue occurs when a crafted HID descriptor contains only padding output items, leaving maxfield as zero, and the code dereferences field[0] in the error path.

In the Linux kernel, the io_uring subsystem has a file reference leak in the NOP operation. When a NOP request is submitted with the IOSQE_FIXED_FILE flag but without IORING_NOP_FIXED_FILE, the file is acquired via fget() and never released, causing a memory leak. The fix decides file acquisition based on the REQ_F_FIXED_FILE flag, as in other operations.

In the Linux kernel, the io_uring/io-wq subsystem has an issue with handling the exit flag (IO_WQ_BIT_EXIT) for linked work items. Despite a previous fix, the exit flag was checked only once before processing an entire chain of linked tasks, allowing work to continue after exit began. The fix moves the check inside the loop, covering all linked items.

A use-after-free bug was found in the Linux kernel's netpoll mechanism during shutdown. The issue occurs when a pending TX worker runs in parallel with the cleanup routine, leading to access to already freed memory.

A vulnerability was found in the Linux kernel's IGMP implementation for IPv4. During network device destruction, multicast groups are not removed from the hash table (mc_hash), leading to a use-after-free condition under concurrent RCU access.

In the Linux kernel, the TCP/IP stack has a vulnerability due to missing validation of the net.ipv4.tcp_reordering sysctl value. Negative values written to this sysctl are copied to the tp->reordering field as u32, causing wrap to large values. This can lead to overflow in MTU size calculations and out-of-bounds read. The fix adds validation via proc_dointvec_minmax() and secures calculations by using u64.

In the Linux kernel, the NXP i.MX8 ISI media driver has a use-after-free bug during module removal. The function mxc_isi_remove() calls mxc_isi_crossbar_cleanup() before mxc_isi_v4l2_cleanup(), freeing media entity pads and then attempting to remove links referencing those freed pads. The fix reverses the call order.

In the Linux kernel, the MFD ChromeOS Embedded Controller driver has a use-after-free bug due to premature drvdata setting. The function ec_device_probe() set drvdata before initialization completed, allowing sub-drivers to access freed memory after a failed probe. The fix delays drvdata setting until initialization succeeds.

In the Linux kernel, the shrinker mechanism has a bug where RCU lock is held while calling the ->count_objects() callback in shrinker_debugfs_count_show(). The zswap_shrinker_count() function may sleep via css_rstat_flush(), which is not allowed in an RCU critical section. The fix removes rcu_read_lock()/rcu_read_unlock(), as they are unnecessary.

A race condition in the Linux kernel's shrinker_info teardown and expansion logic was discovered. The expand_shrinker_info() function iterates over memcgs that may not have completed online, while alloc_shrinker_info() frees memory outside the shrinker_mutex lock, leading to potential double-free or use-after-free. This affects memory management in cgroup environments.

In the Linux kernel, the shrinker debugfs mechanism has a NULL pointer dereference bug. The shrinker_debugfs_add() function creates "count" and "scan" debugfs files for every shrinker, assuming each implements both count_objects() and scan_objects(). However, some shrinkers (e.g., xen-backend) only set count_objects(), leaving scan_objects() as NULL, causing a kernel panic when writing to the "scan" file.

A NULL pointer dereference vulnerability in the Linux kernel's lookup_swap_cgroup_id() function on swapless hosts. The function fails to verify that the swap type is registered, causing a system crash when accessing a corrupted PTE entry.

In the Linux kernel, the swap_reclaim_full_clusters() function lacks a cond_resched() call, which can lead to a softlockup on large systems with many CPUs and a large swap device. During heavy reclaim of full swap clusters, the loop may run too long without yielding the CPU, causing a softlockup.

In the Linux kernel netfilter subsystem, there is an issue with unreadable packet fragments (e.g., from devmem TCP). The skb_copy_bits() function returns an error, but the xt_u32 module does not handle it properly. Additionally, gather_frags, nfnetlink_queue, and nfnetlink_log do not cope with such fragments.

In the Linux kernel ebtables subsystem, the chainstack array is not zeroed before use. If cpu_possible_mask is sparse (e.g., CPU 0 and 2 are possible, but CPU 1 is not) and allocation for CPU 2 fails, the cleanup loop may call vfree() on an uninitialized pointer, leading to a potential bug.

In the Linux kernel ebtables subsystem, module names are not properly null-terminated. The request_module() function may receive a non-null-terminated string, leading to potential buffer overflow or incorrect module loading.

In the Linux kernel ebtables subsystem, the update_counters() and compat_update_counters() functions pass a 32-byte table name to find_table_lock() without null-termination. On a lookup miss, try_then_request_module() attempts to load a module, and vsnprintf() reads beyond the name boundary, causing a stack-out-of-bounds read (KASAN).

In the Linux kernel Bluetooth btmtksdio driver, there is an infinite loop in the btmtksdio_txrx_work() function. The bug is due to incorrect use of time_is_before_jiffies() in the loop condition. After the 5-second timeout expires, the condition becomes always true, causing an infinite loop and locking the SDIO host.

In the Linux kernel, the Bluetooth bnep driver reads an L2CAP connection without holding the channel lock during netdev registration, leading to a use-after-free if the controller is torn down concurrently. The fix pins the L2CAP connection reference before registration.

In the Linux kernel Bluetooth btnxpuart driver, an out-of-bounds read occurs in nxp_recv_fw_req_v3() because the offset and length are not validated against the firmware image size, allowing a controller to read past the buffer and send memory over UART.

In the Linux kernel, bt_accept_dequeue() has a use-after-free vulnerability because it drops a temporary reference before bt_accept_unlink(), leading to access to freed memory when the reference was the last one.

In the Linux kernel Bluetooth subsystem, a null pointer dereference was found in hci_abort_conn(). The issue occurs when hdev->sent_cmd is NULL while req_status is HCI_REQ_PEND, potentially causing a system crash.

In the Linux kernel Bluetooth ISO driver, iso_conn_big_sync() can cause a NULL pointer dereference because after releasing the socket lock, the connection may be torn down, and the function reads conn->hcon without re-checking conn validity.

In the Linux kernel Bluetooth L2CAP stack, l2cap_get_conf_opt() reads the option value before verifying that the full option fits in the buffer, allowing an attacker-controlled length to cause an out-of-bounds read of up to 4 bytes.

In the Linux kernel coresight ultrasoc-smb driver, smb_sync_perf_buffer() can write out of bounds of the dst_pages[] array because the initial page index is not normalized modulo the AUX buffer size, leading to an out-of-bounds write.

In the Linux kernel, a vulnerability was found in the SMB client where cifs_swn_notify() uses a stale tcon pointer after memory is freed, leading to use-after-free. The issue arises from the lack of a stable reference to tcon in SWN registration when multiple mounts share the same registration ID.

In the Linux kernel ksmbd SMB server, a path traversal bypass exists in __ksmbd_vfs_kern_path() because the -EXDEV error from vfs_path_parent_lookup() is not intercepted, allowing the caseless retry logic to create files or directories outside the shared resource.

In the Linux kernel, the ksmbd filesystem lacks a permission check for the FSCTL_SET_ZERO_DATA operation. An authenticated SMB client can use a handle opened only with FILE_WRITE_ATTRIBUTES to zero file data without FILE_WRITE_DATA rights.