Linux kernel vulnerabilities

In the Linux kernel, the scsi pm8001 driver function pm8001_request_msix() uses index i instead of j in the rollback loop when request_irq() fails, passing the wrong IRQ/dev_id pair to free_irq(). Earlier registered handlers remain installed.

In the Linux kernel, samples/damon/mtier function damon_sample_mtier_stop() assumes damon_stop() always succeeds and deallocates DAMON contexts after the call. If a context is already stopped, damon_stop() fails, leaving running contexts, leading to use-after-free. The issue is only in mtier.

In the Linux kernel, the samples/damon/wsse sample module's damon_sample_wsse_start() function did not free the DAMON context memory when damon_start() failed. This leads to a memory leak, and more broadly, similar mishandling of damon_start() and damon_stop() failures across DAMON sample modules can cause memory leaks, disruptions of subsequent DAMON operations, and use-after-free.

In the Linux kernel, mm/damon/core function damon_apply_min_nr_regions() assumes damon_split_region_at() always succeeds. On memory allocation failure and when the region was the last, fetching the next region returns an invalid pointer, leading to invalid memory dereference and corruption. The fix breaks all loops on any split failure.

A use-after-free vulnerability exists in the Linux kernel's futex implementation during requeue PI operations on PREEMPT_RT kernels. A race between an early wakeup of a waiting task and a PI requeue can cause the requeue task to call rcuwait_wake_up() on a futex_q structure that has already been freed from the waiter's stack. The issue is resolved by skipping rcuwait_wake_up() in the Q_REQUEUE_PI_LOCKED case.

In the Linux kernel, a race condition exists in the HID BPF subsystem between the device destruction path (__hid_bpf_ops_destroy_device) and the unregistration path (hid_bpf_unreg), which can double-put the same device reference. This frees the hid_device structure while hid_destroy_device() is still using it, resulting in a use-after-free. The fix serializes the reference release decision under the prog_list_lock.

In the Linux kernel, the HID RMI driver is vulnerable to out-of-bounds (OOB) access due to undersized report buffers. The driver allocates buffers based on device-declared report sizes without a minimum bound, then reads/writes at fixed offsets, leading to memory corruption. Additionally, the read loop can hang indefinitely if the device returns zero-length replies, blocking the probe worker.

A race condition exists in the Linux kernel device-mapper subsystem when loading and unloading a table concurrently. dm_setup_md_queue walks &md->table_devices without any lock, so racing with dm_table_destroy can lead to access to invalid memory.

A race condition exists in the Linux kernel device-mapper subsystem between resume and remove ioctls. If a user issues resume and remove at the same time, the device may be resumed after being suspended in __dm_destroy, so the table is destroyed without calling the postsuspend method, breaking dm target expectations and potentially causing use-after-free (e.g. in dm-integrity).

In the Linux kernel, dma_direct_alloc_from_pool() returns a CPU address instead of a struct page *, which does not match the expectations of dma_direct_alloc_pages(). The bug was introduced by commit 5b138c534fda and can lead to incorrect behavior or a crash.

In the Linux kernel, the fsl-edma dmaengine driver tracing events store a pointer to struct fsl_edma_engine and dereference it when printing a log entry, at which point the pointer may no longer be valid. Event injection (e.g. via the inject file) can trigger a kernel crash.

In the Linux kernel, the dw-edma dmaengine driver passes struct dw_edma_irq to request_irq() before dw_edma_channel_setup() fills the back pointer. A shared interrupt can therefore enter the handler with dw_irq->dw still NULL, causing a NULL pointer dereference.

In the Linux kernel, dt_idle_pd_alloc() allocates memory for the full node path and then sets pd->name to point to the basename of that string. dt_idle_pd_free() frees pd->name, which no longer points to the start of the allocation, leading to an invalid free.

A bug was fixed in the Linux kernel's BPF pcpu_freelist mechanism that caused an infinite loop in __pcpu_freelist_push(). The issue occurs when only one CPU is possible (e.g. CONFIG_SMP=n, nr_cpus=1 or possible_cpus=1) and an NMI re-enters pcpu_freelist_push() while the interrupted context holds that CPU's freelist lock. The fallback loop then has no other possible CPU to examine and can never acquire the lock.

In the Linux kernel, validate_hash_algo() passes the result of dentry_path() directly to integrity_audit_msg() without checking for ERR_PTR. When the path exceeds the buffer, dentry_path() returns ERR_PTR(-ENAMETOOLONG), leading to a strlen() call on an invalid pointer and a page fault.

In the Linux kernel, __within_kprobe_blacklist() traverses the kprobe_blacklist without holding kprobe_mutex. When a module is unloaded, entries are immediately freed, leading to a use-after-free in a concurrent call to within_kprobe_blacklist().

A vulnerability in the Linux kernel's handling of huge pages for tmpfs was found. During unmapping (zap), the dirty bit from the PMD entry is not transferred to the folio, leading to loss of write information. As a result, data in MAP_SHARED tmpfs segments can be silently lost during unmap if the page is PMD-mapped and swap is enabled.

In the Linux kernel, alloc_pages_bulk_weighted_interleave() hardcodes GFP_KERNEL when allocating the temporary weights array, even when called in atomic/RCU context. This can trigger a might_alloc() splat due to a sleeping allocation in an invalid context.

In the Linux kernel, memcg_reparent_objcgs() assumes that a folio's objcg matches its node. Folio migration across nodes breaks this assumption, leading to inconsistency and potential use of the wrong LRU lock, which can cause data corruption or crashes.

A vulnerability in the Linux kernel's perf/x86/intel subsystem allows kernel address leakage to user space. The intel_pmu_lbr_filter() function did not fully validate the privilege level of sampled entries, so the LBR stack could contain kernel addresses even when PERF_SAMPLE_BRANCH_USER was requested. The fix extends software filtering to validate both from and to addresses against br_sel.

In the Linux kernel, i2c_del_adapter() frees the adapter's debugfs directory before unregistering the device, but the new_device sysfs attribute remains writable. A race between a write and removal can lead to a use-after-free in i2c_device_probe().

In the Linux kernel, the i2c mux subsystem has a reference leak of the Device Tree channel node when adapter registration fails. i2c_mux_add_adapter() takes a reference before registering, but on error it does not release it, causing a memory leak.

In the Linux kernel for arm64, there is an issue with reading the GMID_EL1 register when MTE is disabled. The read is performed even when MTE is off, leading to an Undefined instruction error and kernel panic in pKVM environments.

In the Linux kernel, the ALSA harmony driver has an issue with lock initialization before IRQ registration. The IRQ is registered before h->lock and h->mixer_lock are initialized, which can lead to the interrupt handler using uninitialized locks.

A race condition exists in the Linux kernel between non-atomic ALSA PCM operations (hw_params, hw_free, prepare) and the atomic trigger-start operation. While one thread performs a non-atomic operation, another thread can trigger the PCM start, leading to state inconsistencies and ODEBUG warnings reported by syzkaller. The fix prevents trigger-start during non-atomic operations by checking the runtime->buffer_accessing value.

In the Linux kernel, the amdxdna accelerator has an issue with zero-length SYNC_BO operations. A request for zero bytes leads to drm_clflush_virt_range() accessing an address before the mapping, causing a page fault and system crash.

In the Linux kernel, the ethosu accelerator has an issue with missing MMIO mapping error checks during probe. devm_platform_ioremap_resource() can return an error pointer, which is used without checking, leading to a crash.

In the Linux kernel, the ethosu accelerator has an issue with job completion fence cleanup. In some error paths, the fence is not initialized and then freed, leading to memory leaks or use of uninitialized data.

In the Linux kernel, the nvme-fabrics subsystem has a DHCHAP secret leak on parse failure. nvmf_parse_options() duplicates the secret before validation, and on error does not free the temporary string, leading to a memory leak.

In the Linux kernel's nvme-fc subsystem, a double free of fabrics options occurs when nvme_add_ctrl() fails. The bug was introduced by commit 1a9e218195a5 and can be triggered under memory pressure or fault injection, leading to use-after-free.

In the Linux kernel, nvme_tcp_handle_c2h_data() failed to check the data direction of a C2HData PDU. A malicious or misbehaving NVMe/TCP controller could respond to a write command with a C2HData frame, triggering a kernel warning (WARN_ON_ONCE) and resetting the controller. No data is copied, so this is not memory corruption.

A vulnerability was found in the Linux kernel's nvmet-tcp subsystem. The NVMe-over-TCP target accepts unsolicited H2CData PDUs without checking whether an R2T was sent for the command. A remote attacker can exploit this to cause a double-add of the command to the response list, leading to a system hang (soft-lockup) or kernel panic (kernel BUG).

In the Linux kernel, migrate_device_range() and migrate_device_pfns() clear entries following a compound folio without limiting them to the number of slots remaining in the npages-sized array. If a compound folio extends beyond the end of the caller-provided range, the loops cause an out-of-bounds write.

A vulnerability in the Linux kernel's hugetlb CMA allocation mechanism was found. The hugetlb_cma_alloc_frozen_folio function does not properly handle a NULL nodemask, leading to a NULL pointer dereference and kernel panic. An unprivileged user can crash the system by requesting a gigantic hugepage allocation with MPOL_PREFERRED_MANY on a system where CMA is configured only on a subset of NUMA nodes.

In the Linux kernel, the nfree field in the BTT info block is read from the medium without validation. btt_freelist_init() and btt_rtt_init() size the freelist[] and rtt[] arrays by nfree, but the I/O path indexes them by the lane bounded by num_lanes rather than nfree. An arena with nfree below the lane count causes an out-of-bounds write.

In the Linux kernel, eisa_irq_setup() prints an error message and continues without advancing the current position when an invalid value is passed via the "eisa_irq_edge=" kernel command line parameter. This causes the same invalid value to be parsed repeatedly, resulting in an infinite loop during kernel boot.

In the Linux kernel, kexec_extra_fdt_size_ppc64() can trigger a NULL pointer dereference. On platforms without any reserved memory regions, get_reserved_memory_ranges() can return 0 while leaving 'rmem' as NULL, and evaluating 'rmem->nr_ranges' then causes a kernel panic.

In the Linux kernel, the __merge_memory_ranges() function (powerpc/kexec_file) has a logic flaw when merging overlapping memory ranges. It compares the current range's start against the previous element instead of the running target index and unconditionally overwrites the range end, causing valid memory ranges to be truncated. As a result, memory fragments may be lost from kexec exclude lists, potentially allowing the crash kernel to overwrite active memory.

In the Linux kernel, vmemmap_populate_compound_pages() on powerpc manually advanced addr_pfn in a way that did not match the loop's progression through vmemmap addresses. This caused pfn_offset to be computed from the wrong PFN and led to incorrect head/tail mapping decisions for compound pages.

In the Linux kernel, vfio_ap_mdev_set_kvm() sets kvm->arch.crypto.pqap_hook before acquiring update locks and checking for a conflicting assignment. On error, it returns -EPERM without restoring the hook pointer, leaving a stale pointer that can lead to a use-after-free when a guest executes a PQAP instruction.

In the Linux kernel, vfio_ap_config_remove used bitmap_andnot to clear bits from the matrix_mdev->matrix.adm bitmap, which prevented explicitly unplugged control domains from being removed from the KVM guest. The fix replaces bitmap_andnot with bitmap_and.

In the Linux kernel, the s390/vfio-ap driver fails to check whether matrix_mdev->kvm is NULL before acquiring the matrix_mdev->kvm->lock mutex. If matrix_mdev->kvm has never been set, attempting to take the lock triggers a NULL pointer dereference. The fix adds checks for matrix_mdev->kvm == NULL before taking the mutex.

In the Linux kernel, vfio_ap_mdev_hot_unplug_cfg() relied on the return value of bitmap_andnot() to decide whether to update the guest APCB. When the resulting bitmap was empty, the function returned false, so the update was skipped and the KVM guest retained stale hardware access to unplugged AP devices.

In the Linux kernel, vfio_ap_mdev_probe_queue() created the sysfs attribute group before the queue's driver data was set. A concurrent read of the 'status' attribute could call dev_get_drvdata() and get NULL, which was then dereferenced in vfio_ap_mdev_for_queue(), causing a NULL pointer dereference.

In the Linux kernel, the AFS v2 parser uses footer[8] to locate the image information block within the erase block, then uses region_count to walk entries in a fixed local array. The footer offset and region count come from flash contents and were not validated before use.

In the Linux kernel, mtdoops_notify_add() allocates the oops_page_used bitmap when the configured MTD device is registered, but mtdoops_notify_remove() leaves it allocated. Re-registering the same MTD device leaks one vmalloc allocation per remove/add cycle.

In the Linux kernel, nand_flash_detect_ext_param_page() allocates memory based on the length declared in the ONFI parameter page, then reads the header and variable-length sections without verifying they fit within the allocation. This missing validation can lead to an out-of-bounds read. The fix rejects pages shorter than the fixed header, tracks the remaining variable area, and requires the ECC section to contain every field read from struct onfi_ext_ecc_info.

In the Linux kernel batman-adv module, fragment reassembly reuses the skb from the highest-numbered buffered fragment, and if the interface it was received on is deleted before the chain completes, the merged packet can re-enter the receive path with a stale skb->dev and skb_iif. This can lead to use of a freed net_device. The fix refreshes the receive device metadata before running packet handlers.

In the Linux kernel batman-adv module, batadv_mcast_forw_packet() and batadv_mcast_forw_scrape() can be called indirectly via batadv_mcast_forw_mcsend() without linearizing the skb, triggering SKB_LINEAR_ASSERT() and a fatal BUG(). Linearization should occur during head expansion. The fix ensures proper buffer linearization.

In the Linux kernel batman-adv module, regardless of ARP packet alignment in the SKB, either batadv_arp_ip_src or batadv_arp_ip_dst may cause an unaligned access on hardware without native unaligned read support. The fix uses get_unaligned() to handle this properly on all architectures.