Linux kernel vulnerabilities

Memory corruption occurs when copying data from a freed source during a performance counter deselect operation. The flaw arises when data is copied from a memory area that has already been freed, potentially leading to unpredictable system behavior.

A vulnerability in the Linux kernel's GSO fallback for tunneled traffic with IPV6_CSUM flag was found. Incorrect network header length checking caused tunneled packets with IPv6 extension headers to not fall back to software checksumming, potentially leading to processing errors.

In the Linux kernel, when processing user options in IPv6 Router Advertisement (RA) messages, the nduseroptmsg structure sent in RTM_NEWNDUSEROPT netlink message does not zero its padding fields, potentially leaking kernel memory. The fix initializes these padding fields to zero.

A vulnerability in the Linux kernel leaks kernel heap memory to userspace via the tc_chain_fill_node() function, which fails to initialize the tcm_info field of the tcmsg structure before sending netlink messages, exposing 4 bytes of uninitialized memory.

In the Linux kernel, the crypto authencesn module has a vulnerability where high-order sequence bits (hiseq) are unnecessarily placed at the end of the destination buffer during out-of-place decryption (src != dst), causing incorrect hashing data arrangement.

In the Linux kernel, a vulnerability was found in the regsafe() function related to pointers to packets. The bug may cause a state with a valid packet range not to be explored, leading to potential security issues.

In the Linux kernel, the netfilter x_tables module lacks validation that names are nul-terminated. This flaw can cause invalid data to be passed to functions expecting C strings, potentially leading to errors or security breaches.

In the Linux kernel netfilter subsystem, a use-after-free vulnerability was found in nf_conntrack_helper_unregister(). When destroying expectations for a helper being unregistered, a NULL pointer was passed instead of the helper pointer, so expectations were not removed and the freed helper structure was still referenced.

In the Linux kernel, a vulnerability in netfilter ctnetlink causes uninitialized saved_addr and saved_proto fields in expectation structures when CTA_EXPECT_NAT is missing, leaking stale data from previous slab allocations to userspace.

A vulnerability in the Linux kernel netfilter ctnetlink module fails to validate the helper for new expectations, allowing an attacker to supply an arbitrary helper from userspace, leading to a slab-out-of-bounds read and potential kernel memory leak.

A vulnerability was found in the Linux kernel's netfilter nf_tables subsystem, allowing an immediate NF_QUEUE verdict. This verdict is not used by userspace nftables tools, and the ARP family lacks queue support, potentially leading to unexpected behavior.

A vulnerability has been identified and resolved in the Linux kernel. It concerns a potential use-after-free (UAF) in the set_cig_params_sync function related to Bluetooth connections.

A vulnerability in the Linux kernel's BPF subsystem allowed attaching sleepable kprobe.multi programs to atomic/RCU contexts. The bpf_kprobe_multi_link_attach() function lacked validation of the sleepable flag, enabling sleepable helpers like bpf_copy_from_user() to be called from non-sleepable context, causing a kernel splat.

In the Linux kernel, a vulnerability was found in the BPF verifier related to incorrect path pruning due to precision tracking for atomic fetch operations (BPF_ATOMIC with BPF_FETCH). The backtracking logic did not account for the source register also being the destination, leading to missing precision marks on stack slots. This could cause the verifier to incorrectly consider two states equivalent and prune one branch, potentially allowing unsafe BPF programs.

In the Linux kernel, the ti-adc161s626 ADC driver used stack memory for spi_read(), which is not DMA-safe. A dedicated DMA-safe buffer has been added, and conversion functions updated accordingly.

In the Linux kernel, the MPU3050 gyroscope IIO driver called iio_device_register() before completing device initialization, potentially causing race conditions. The fix moves registration to the end of the probe function and adjusts unregistration accordingly.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the USB cdns3 gadget driver's ep_queue function. When the endpoint is disabled or not configured, the ep->desc pointer can be NULL, causing a kernel crash when __cdns3_gadget_ep_queue() is called.

A vulnerability was found in the Linux kernel's bridge br_nd_send() function, which processes Neighbor Discovery (ND) options. Lack of option length validation may allow out-of-bounds read or use of a too-short source LLADDR option.

In the Linux kernel, the ftgmac100 driver had a memory leak vulnerability during ring allocation on network interface open failure. The ftgmac100_alloc_rings() function did not free previously allocated resources (rx_skbs, tx_skbs, rxdes, txdes, rx_scratch) on error, causing memory leaks.

In the Linux kernel, a resource leak was found in gpiochip_add_data_with_key() on error paths. After commit aab5c6f20023, `gdev->dev.release` is unset, so the reference count to `gdev->dev` is not dropped on errors. The fix drops the reference and reorders code to prevent double-free.

A vulnerability has been identified in the Linux kernel that leads to a NULL pointer dereference in the eth_get_drvinfo function. The issue occurs when a userspace tool queries the interface while the device is detached.

A vulnerability has been identified in the Linux kernel within the smb_check_perm_dacl() function, allowing for out-of-bounds (OOB) reads due to improper ACE size validation. An attacker can exploit this flaw to access memory, potentially leading to kernel state corruption.

A vulnerability has been identified in the Linux kernel that leads to a leak of the active connection count on transport allocation failure in the ksmbd_tcp_new_connection() function. This issue can be exploited by an unauthenticated remote attacker to induce memory pressure, resulting in the rejection of all subsequent connection attempts.

In the Linux kernel, a vulnerability was resolved in the SMB client regarding the directory separator in SMB1 UNIX mounts. When calling cifs_mount_get_tcon() with SMB1 UNIX mounts, cifs_sb->mnt_cifs_flags must be read or updated only after calling reset_cifs_unix_caps(), otherwise the CIFS_MOUNT_POSIXACL and CIFS_MOUNT_POSIX_PATHS bits may be missing.

In the Linux kernel, a vulnerability was found in the CIFS implementation where build_sec_desc() and id_mode_to_cifs_acl() improperly validate the DACL structure from the server. A malicious server can supply a truncated DACL with a fake ACE count, causing an out-of-bounds read during security descriptor rewrite.

A vulnerability has been identified in the Linux kernel that allows for out-of-bounds read in the smb2_ioctl_query_info function. The issue arises when a server returns a buffer length greater than the actual QUERY_INFO response, potentially exposing kernel memory to userspace.

In the Linux kernel, a use-after-free vulnerability exists in inode_switch_wbs_work_fn() in the writeback mechanism. The processing loop can cause a wb object to be freed while a pending work item still exists, leading to use-after-free.

A vulnerability has been identified in the Linux kernel in the tpacket_snd() function, allowing for a TOCTOU race condition using mmap'd vnet_hdr. As a result, a user-space thread can modify vnet_hdr fields between validation and use, bypassing all safety checks.

In the Linux kernel FUSE filesystem, a vulnerability exists due to missing validation of directory entry (dirent) size before copying into the page cache. A malicious FUSE server can send a dirent exceeding PAGE_SIZE, causing a buffer overflow during memcpy() that overwrites adjacent kernel pages.

A race condition vulnerability in the kernel could allow an attacker to trigger a kernel heap overflow, potentially leading to local privilege escalation and system-level access.

In the Linux kernel, a vulnerability was found in the IPv6 flowlabel mechanism. The `ip6fl_seq_show()` function reads from the global flowlabel hash under RCU protection, but exclusive flowlabels freed `fl->opt` immediately when `fl->users` dropped to zero, while the `ip6_flowlabel` structure remained visible in the hash table. This race condition allowed a concurrent read of `/proc/net/ip6_flowlabel` to access freed memory, causing a system crash.

In the Linux kernel, a vulnerability was found in the netfilter ip6t_rt module where the lack of validation of the addrnr field in rt match rules can lead to an out-of-bounds read of the rtinfo->addrs[] array. An attacker could install a malicious rule that, during IPv6 packet processing, accesses memory beyond the allowed range.

An information leak was discovered in the build_report() function in the xfrm_user subsystem of the Linux kernel. The xfrm_user_report structure contains unzeroed padding bytes that are copied to userspace, potentially exposing kernel memory.

A vulnerability in the Linux kernel's rfkill mechanism allows userspace to create an unlimited number of rfkill events without consuming them from the file descriptor, potentially leading to an out-of-memory condition.

A use-after-free vulnerability was found in the Linux kernel's netfilter module during timeout object destruction. The nft_ct_timeout_obj_destroy() function frees the object memory without waiting for an RCU grace period, allowing concurrent access to freed memory by other CPU cores.

In the Linux kernel, a vulnerability in the build_polexpire() function of the xfrm subsystem fails to clear trailing padding bytes after the 'hard' field in the xfrm_user_polexpire structure, leaking uninitialized heap memory to userspace via netlink multicast.

In the Linux kernel, a vulnerability was found in the xfrm subsystem where, after async crypto completion, xfrm_input_resume() immediately released the device reference (dev_put()) before the skb reached transport_finish and NF_HOOK. This caused a race condition with device teardown, as skb->dev was used after the reference was dropped.

In the Linux kernel, the altera-tse driver had a memory leak. The tse_start_xmit() function did not free the skb buffer after a DMA mapping failure, causing memory leak on every DMA error.

In the Linux kernel, a NULL-pointer dereference vulnerability was found in the vub300 driver for MMC/SD cards over USB during device disconnect. The issue occurs because the controller is not deregistered before dropping the driver data reference, potentially causing a crash.

In the Linux kernel's RxRPC subsystem, a heap buffer overflow vulnerability was found in RxGK token loading. The function rxrpc_preparse_xdr_yfs_rxgk() incorrectly rounds key and ticket lengths, causing values >= 0xfffffffd to wrap to zero and bypass validation, allowing ~4 GB of data to be copied into a small buffer. The flaw can be triggered by an unprivileged user via the add_key() syscall.

A reference count leak was discovered in the Linux kernel's rxrpc_server_keyring() function. The issue occurs when the rx->securities field is already set, leading to improper memory management.

In the Linux kernel, a vulnerability was found in AMD Zen1 processors where the hardware divider can leave partial results from previous operations, which can be leaked by an attacker thread. The fix applies a chicken bit to mitigate the issue.

In the Linux kernel, the USB f_ncm gadget driver (CDC NCM network function) lacks validation of the minimum block_len in ncm_unwrap_ntb(). When block_len is smaller than the NDP size, arithmetic underflow occurs, bypassing bounds checks and allowing a malicious USB host to copy adjacent kernel memory into the network skb.

In the Linux kernel, a vulnerability was found in ksmbd (kernel SMB server implementation) involving a mechToken memory leak when SPNEGO decode fails after token allocation. The ASN.1 BER decoder calls action callbacks as it processes data. When ksmbd_decode_negTokenInit() reaches the mechToken element, it allocates memory for conn->mechToken. If a later element in the blob is malformed, the decoder returns an error but the memory remains allocated. The decode_negotiation_token() function sets conn->use_spnego = false, and cleanup in smb2_sess_setup() is gated on use_spnego, so the memory is not freed. Untrusted clients can cause slow memory leaks on the server.

A deadlock vulnerability was found in the Linux kernel's RDMA/irdma driver during netdev reset with active RDMA connections. The netdev reset triggers removal of the irdma auxiliary driver, causing a circular dependency where uverbs_client waits for QP reference count to reach zero while cma_client holds the final reference, leading to an indefinite wait in iWARP mode.

In the Linux kernel, a vulnerability was found in the MACB (Cadence MACB/GEM) driver where napi_consume_skb() was called in an IRQ-disabled context, causing a warning and potential synchronization issues. The fix replaces it with dev_consume_skb_any().

In the Linux kernel, a bug in futex_lock_pi() was found where the local pointer to an exiting thread was not cleared on retry. This caused a WARN_ON_ONCE() when a stale pointer was passed to wait_for_owner_exiting().

In the Linux kernel bonding driver, a NULL pointer dereference vulnerability was found in bond_debug_rlb_hash_show. The function iterates over RLB hash table entries without checking if the slave field is NULL, potentially causing a system crash.

A vulnerability in the Linux kernel's module loader lacks bounds checking for the ELF section index in simplify_symbols(). An out-of-bounds st_shndx value (e.g., 0xffff) can cause a kernel panic due to invalid memory access.

A vulnerability was found in the Linux kernel's ESP over TCP (espintcp) implementation with async crypto. When the transmit queue is full, esp_output_tail_tcp returns an error but does not free the skb buffer, causing a memory leak. With synchronous crypto, the issue does not occur because the xfrm code drops the packet automatically.