Linux kernel vulnerabilities

In the Linux kernel, the ksmbd filesystem has a use-after-free vulnerability in the file_lock structure during deferred lock cancellation. When a lock is cancelled and the work is no longer active, freeing the lock before removing it from the async list leads to accessing freed memory.

In the Linux kernel, the ksmbd filesystem lacks a read permission check for the source file during the duplicate extents operation (FSCTL_DUPLICATE_EXTENTS_TO_FILE). A handle opened only with attribute access can be used to copy file contents to an attacker-readable destination.

In the Linux kernel's ksmbd (SMB) filesystem, a missing WRITE_DAC/WRITE_OWNER permission check in the SMB2 SET_INFO SECURITY operation allows a client with a low-privilege handle (e.g., FILE_WRITE_ATTRIBUTES) to rewrite the file's security descriptor and gain unauthorized access.

In the Linux kernel, the ksmbd filesystem has a lock management issue with SMB3 multichannel. A byte-range lock can be removed from the connection list using the wrong spinlock, leading to access to freed objects during concurrent list traversal.

In the Linux kernel, the ksmbd filesystem validates the NTLMv2 response after updating the session key. On authentication failure, the session key can be modified before the error is returned, allowing a client to change the session key of an existing binding session.

In the Linux kernel, SMB3 client with POSIX Extensions ignored chown/chgrp changes unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID were set. The fix checks for posix_extensions in cifs_setattr_nounix() to properly call id_mode_to_cifs_acl() and set ownership/group on the server.

In the Linux kernel, SMB client has a double-free vulnerability in SMB2_open() replay. A response-bearing attempt can free its buffer, and if SMB2_open_init() fails before the next send, cleanup frees the same buffer again. The fix resets response bookkeeping before each attempt.

In the Linux kernel, SMB client function receive_encrypted_standard() allocates next_buffer before checking if the number of compound PDUs reached MAX_COMPOUND. If the limit is exceeded, the function returns immediately and the allocated next_buffer is leaked. The fix moves the MAX_COMPOUND check before allocating next_buffer.

In the Linux kernel, SMB client function posix_info_sid_size() reads sid[1] for subauthority count, but its boundary check still accepts buffers with only one remaining byte. The fix requires two bytes before reading sid[1] so all client paths safely reject truncated POSIX SIDs.

In the Linux kernel, SMB client with modefromsid active, parse_dacl() applies the server-provided sub_auth[2] value from the NFS mode SID to cf_mode without masking to 07777. The fix adds correct masking, same as in the read path.

A race condition between cgroup_writeback_umount() and inode_switch_wbs() in the Linux kernel causes a BUG_ON during filesystem unmount after container exit. This results in busy inodes and potential kernel panic.

In the cpufreq driver for Qualcomm devices, a double free vulnerability was found. The qcom_cpufreq_hw_cpu_exit() function calls kfree() on a pointer to devres-managed memory, which can lead to a double free when the device is detached.

In the firmware_loader subsystem, a device reference leak was found. The firmware_upload_register() function fails to release the device reference on error after initialization, causing a reference count imbalance.

In procfs, a race condition was found in proc_pid_get_link() and proc_pid_readlink(). The ptrace access check and task lookup are performed separately, allowing a race.

A vulnerability was found in the Linux kernel's RT_PUSH_IPI mechanism for the real-time (RT) scheduler. When RT_PUSH_IPI is enabled on a system without PREEMPT_RT, a live lock can occur on a CPU where softirqs run in interrupt context. This causes excessive IPI interrupts that slow down softirq processing, preventing context switching and leading to CPU lockup.

In cpufreq, a race between suspend and CPU hotplug operations during system reboot was found. The cpufreq_suspend() function lacks synchronization with hotplug, which can lead to a null pointer dereference.

In the pcc cpufreq driver, a use-after-free and double free were found during _OSC evaluation. After the first acpi_evaluate_object() call, the output buffer is freed but pointer and length are not reset, causing a write to freed memory on the second call.

In procfs, several functions lack exec_update_lock protection for ptrace_may_access(). Functions do_task_stat(), proc_pid_wchan(), proc_map_files_lookup(), proc_map_files_readdir(), proc_ns_get_link(), and proc_ns_readlink() perform access checks without proper locking.

In POSIX CPU timers, a PID reference leak was found in do_cpu_nanosleep(). On error after timer creation, the function does not release the PID reference, causing a leak.

On s390 architecture, support for DCACHE_WORD_ACCESS was reverted due to exception handling issues with pages donated to the Ultravisor. The load_unaligned_zeropad() function can cause an infinite exception loop.

In the Linux kernel's mm/slab subsystem, a bug was found in the memory zeroing mechanism during allocation. When only red zoning (SLAB_RED_ZONE) is enabled without tracking the requested size (SLAB_STORE_USER), kmalloc may zero only the requested size instead of the full object, breaking the __GFP_ZERO guarantees for krealloc.

In the HID driver for Goodix SPI devices (hid-goodix-spi), there is no validation of the report size before copying it into a 128-byte stack buffer. An attacker can send a report larger than ~116 bytes via the SET_REPORT ioctl, causing a stack buffer overflow.

In the Wacom HID driver (wacom_wac), the wacom_wac_queue_insert() function can call kfifo_skip() on an empty kfifo buffer, causing it to read garbage data and corrupt the internal kfifo state. This can lead to an out-of-bounds write beyond the 256-byte buffer, potentially writing up to 3842 bytes past the memory.

In the Linux kernel HID letsketch driver, a use-after-free (UAF) vulnerability was found in the inrange_timer during device unbind. The missing .remove callback allows the timer to fire on freed memory, leading to a security breach.

In the Linux kernel, a vulnerability in the HID multitouch driver causes out-of-bounds bit access on mt_io_flags, which is used as a per-slot bitmap but sized as unsigned long. This corrupts adjacent struct mt_device fields and leads to a kernel panic.

In the Linux kernel HID appleir driver, a Use-After-Free (UAF) vulnerability was found in appleir_remove(). The key_up_timer callback can fire after input_dev is freed, causing a use of freed memory. The fix introduces a 'removing' flag and timer synchronization.

A use-after-free vulnerability was found in the HID driver for Logitech G keyboards (lg-g15). The driver did not cancel pending work before freeing memory, allowing access to freed memory when the device is unplugged.

An unsigned integer overflow (u32) was found in the check_and_correct_requested_length function in HFS and HFSPlus filesystems in the Linux kernel. A large len value can wrap the off+len sum, bypassing bounds checking and leading to out-of-bounds buffer read.

In HFS and HFSPlus filesystems in the Linux kernel, the hfs_bnode_read function can return early without writing to the output buffer, leaving it uninitialized. Callers like hfs_bnode_read_u16 use the result unconditionally, leading to KMSAN uninit-value reports.

In the Linux kernel's nilfs2 filesystem, a vulnerability was found due to missing validation of segment numbers before starting segment cleaning operations. Invalid user-supplied segment numbers cause thread blocking while printing warnings, leading to system hangs.

In the MediaTek JPEG driver (mtk-jpeg) in the Linux kernel, the mtk_jpeg_release function calls cancel_work_sync even for variants that do not use the workqueue, causing a WARN_ON warning. The fix limits the call to platforms with a defined workqueue callback.

In the XFS filesystem in the Linux kernel, the xfs_exchmaps_estimate_overhead function adds bmbt and rmapbt overhead to a local resblks variable, but the final UINT_MAX check still tests req->resblks, the value before overhead was added. The check should apply to the computed value that is later used.

In the XFS filesystem in the Linux kernel, the xfs_dqinode_metadir_create() function does not free allocated transaction and update state when xfs_metadir_create() fails, causing a memory leak. The fix routes the error path through xfs_metadir_cancel() and releases the inode reference.

In the Linux kernel BTF parser, the btf_repeat_fields() function performs field count calculations in u32 arithmetic, which can wrap with malicious BTF. This bypasses capacity checks and leads to out-of-bounds write to the scratch array. The fix uses checked addition and multiplication.

In the Linux kernel BPF mechanism for ARRAY_OF_MAPS with the BPF_F_INNER_MAP flag, the verifier incorrectly elides lookup result nullness for constant keys, using the template max_entries instead of the concrete inner map. The fix does not elide nullness for maps marked with BPF_F_INNER_MAP.

A vulnerability was found in the Linux kernel's LPM trie map implementation in BPF, causing false lockdep warnings when sleepable BPF programs were executed. The issue involved incorrect RCU usage in trie_lookup_elem, trie_update_elem, and trie_delete_elem functions, which did not account for the rcu_read_lock_trace() context.

In the Linux kernel's USB Kalmia network driver, there is an out-of-bounds read vulnerability. The kalmia_rx_fixup() function incorrectly calculates the USB packet length, which can lead to reading beyond the allocated 14000-byte buffer.

In the Linux kernel's cdnsp USB driver, there is a memory leak during stream allocation. The cdnsp_alloc_stream_info() function does not free the stream context array (stream_ctx_array) if a stream ring allocation fails.

In the Linux kernel's dwc3 USB driver, there is a bug in the dwc3_readl() and dwc3_writel() calls within dwc3_ulpi_setup(). These functions are called with an incorrect argument (dwc3->regs instead of the dwc3 structure), which can lead to memory access errors.

In the Linux kernel's EHCI and FOTG210 USB drivers, there is a memory leak on failed isochronous submits. When a submit fails before linking the URB to the queue, the staged schedule (ehci_iso_sched) remains in urb->hcpriv and is not freed.

In the Linux kernel's USB gadget composite driver, there is an out-of-bounds read vulnerability in the USB_DT_OTG handler. The list_first_entry() function never returns NULL, so the if (!config) check is dead, leading to reading from an invalid address when the configuration list is empty.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's USB gadget subsystem. The issue occurs when gadget_match_driver() accesses freed udc structure memory, potentially leading to a NULL pointer dereference and system crash.

In the Linux kernel's USB gadget f_printer driver, there is a reference leak. The printer_open() function increments the reference count (kref) even on -EBUSY error when the device is already open, but VFS does not call release() for a failed open.

In the Linux kernel's idmouse USB driver, there is a use-after-free vulnerability on disconnect race. The mutex_unlock() function may access the mutex structure after releasing the lock, leading to use-after-free when release() races with disconnect().

In the Linux kernel's ldusb USB driver, there is a use-after-free vulnerability on disconnect race. The mutex_unlock() function may access the mutex structure after releasing the lock, leading to use-after-free when release() races with disconnect().

In the Linux kernel, the USB iowarrior driver has a use-after-free vulnerability on disconnect. Submitted write URBs are not stopped on close(), so they must be stopped unconditionally on disconnect() to prevent use-after-free in the completion handler.

In the Linux kernel, the USB iowarrior driver has a use-after-free vulnerability on disconnect race. mutex_unlock() may access the mutex structure after releasing the lock, so a kref is used to release driver data to avoid use-after-free in mutex_unlock() when release() races with disconnect().

In the Linux kernel, the USB legousbtower driver has a use-after-free vulnerability on disconnect race. mutex_unlock() may access the mutex structure after releasing the lock, so a kref is used to release driver data to avoid use-after-free in mutex_unlock() when release() races with disconnect().

In the Linux kernel, the usbio driver (usb: misc) has a slab-out-of-bounds read vulnerability. The usbio_bulk_msg() function copies data with a device-controlled length but checks it only against the transmit buffer (txbuf), not the receive buffer (rxbuf). A malicious USB device can exploit this mismatch to disclose adjacent kernel memory.

In the Linux kernel, the USB misc uss720 driver has a vulnerability where the parport is not unregistered on probe failure. uss720_probe() registers a parport before reading the 1284 register, and if get_1284_register() fails, the registration is not undone, leading to resource leaks and potential use of a freed pointer.