Linux kernel vulnerabilities

In the Linux kernel batman-adv module, regardless of ARP packet alignment in the SKB, either batadv_arp_ip_src or batadv_arp_ip_dst may cause an unaligned access on hardware without native unaligned read support. The fix uses get_unaligned() to handle this properly on all architectures.

In the Linux kernel batman-adv module, when the mesh interface is deleted, batadv_bla_del_backbone_claims() is not executed because batadv_bla_free() sets claim_hash to NULL before the call, preventing all claims from being freed. Additionally, batadv_handle_unclaim() may fail to find the backbone due to missing rehashing handling. The fix simplifies the claim freeing process.

A vulnerability in the Linux kernel was found, involving an out-of-bounds read in the clock driver for Amlogic GXBB platforms. The issue stems from a hard-coded number of parents for the gxbb_32k_clk_sel clock, which is inconsistent with the actual count, leading to a KASAN error during clock registration. The fix uses ARRAY_SIZE instead of a hard-coded value.

In the Linux kernel, the ASoC cs35l33 driver's cs35l33_runtime_suspend() switches the codec into regcache_cache_only(true) and powers it down without first quiescing the threaded IRQ registered by devm_request_threaded_irq(). This leaves a window where cs35l33_irq_thread() can still run after live register access is closed, reading volatile INT_STATUS_1/2 and driving the AMP_SHORT_RLS, CAL_ERR_RLS, OTE_RLS, and OTW_RLS release paths.

In the Linux kernel, the ASoC cs35l34 driver's cs35l34_runtime_suspend() switches the codec into regcache_cache_only(true), asserts reset low, and powers the device off without first quiescing the threaded IRQ registered by devm_request_threaded_irq(). This leaves a window where cs35l34_irq_thread() can still run after suspend has removed live hardware access, reading volatile INT_STATUS_1..4 and executing the PROT_RELEASE_CTL release sequence or BST fault power-down writes.

In the Linux kernel, the ASoC hdac_hda driver's hdac_hda_dev_probe() gets the HDA link with snd_hdac_ext_bus_link_get() before registering the ASoC component. If component registration fails, the function returns without dropping the link reference, causing a reference leak.

In the Linux kernel, the ASoC loongson driver's loongson_card_parse_acpi() ignores the return value of device_property_read_string() for the `codec-dai-name` property. If the property is missing or invalid, an uninitialized pointer is used later, potentially leading to undefined behavior.

In the Linux kernel, in the IIO buffer subsystem, an anonymous buffer handle holds a reference to the underlying IIO device, which is dropped in the buffer handle's release function. If the device has been removed (unbind or hot-unplug), the buffer handle might hold the last reference. The release function takes the mutex for the buffer using a guard, so the unlock happens after iio_device_put(), which might free both the IIO device and the buffer containing the mutex, leading to use-after-free when the mutex is unlocked.

In the Linux kernel, in the IIO buffer subsystem, the iio_dma_fence implementation uses kfree() to free the dma_fence object, which violates the dma_fence documentation requiring RCU-safe freeing. This might result in a use-after-free.

In the Linux kernel, in the IIO buffer subsystem, the iio_dma_fence implementation uses a lock embedded in iio_dmabuf_priv, but iio_dma_fence can outlive iio_dmabuf_priv, causing a use-after-free. The fix ties the lifetime of the lock to the lifetime of the fence by embedding them in the same struct.

In the Linux kernel, in the IIO chemical atlas-sensor driver, atlas_buffer_postenable() acquires a runtime PM reference with pm_runtime_resume_and_get() but returns the result of atlas_set_interrupt() directly. If atlas_set_interrupt() fails, the runtime PM reference is leaked and the device can never autosuspend.

In the Linux kernel, in the IIO chemical atlas-sensor driver, the driver requests its hardware data-ready IRQ with devm_request_threaded_irq(); its threaded handler queues an irq_work, atlas_work_handler(), that calls iio_trigger_poll(data->trig). Since the IRQ is devm-managed, free_irq() runs after atlas_remove() without flushing that irq_work, so a pending irq_work can run after the unwind has freed atlas_data/indio_dev and the trigger, causing a use-after-free when atlas_work_handler() dereferences data->trig.

In the Linux kernel, in the IIO chemical sgp30 driver, sgp_probe() stores the error pointer returned by kthread_run() and returns success, registering the device without its IAQ thread. Later, sgp_remove() passes the error pointer to kthread_stop(), which can lead to issues.

In the Linux kernel, the m62332 digital-to-analog converter driver does not track the current channel state when enabling and disabling the Vcc regulator. This causes a regulator reference count imbalance, leaving the regulator enabled indefinitely after changing a channel from one non-zero value to another.

In the Linux kernel, the apds9306_read_data() function in the apds9306 light sensor driver calls pm_runtime_resume_and_get() but several error paths return directly without releasing the runtime PM reference. This leaks the reference and prevents the device from autosuspending.

In the Linux kernel, the ltrf216a_get_lux() function in the ltrf216a light sensor driver acquires a runtime PM reference, but if ltrf216a_read_data() fails, it returns without dropping the reference. This leaves the runtime PM usage count unbalanced and prevents the device from autosuspending after a failed read.

In the Linux kernel, the dps310 pressure sensor driver crashes during ACPI probe when the device is enumerated through its ACPI HID (IFX3100). i2c_client_get_device_id() returns NULL, and dps310_probe() dereferences that NULL pointer, causing a kernel crash.

In the Linux kernel, KVM nVMX does not flush vpid02 on first use because last_vpid is not reset when vpid02 is freed on VMXOFF. This can lead to the use of stale TLB entries from a previous lifetime of the VPID, associated with a different vCPU or VM.

In the Linux kernel, KVM nVMX does not always clear the KVM_REQ_GET_NESTED_STATE_PAGES flag when emulating a nested VM-Exit, especially when KVM is built with CONFIG_KVM_HYPERV=n. This can lead to double-mapping of vmcs12 pages if KVM bails from VM-Enter without processing the request.

In the Linux kernel, KVM nVMX may execute INVVPID on a different physical CPU than the one L2 is running on. This can lead to TLB entries not being invalidated on the correct CPU if L1 migrates between CPUs.

In the Linux kernel KVM (x86/mmu) subsystem there is a use-after-free in the rmap aging path. If a writer populates the rmap between the lock's read and the iterator's re-read, the lockless aging path walks the newly installed rmap without holding its lock. This can cause a writer to free the pte_list_desc chain via kmem_cache_free() while the walk is in progress, resulting in a slab use-after-free.

A flaw exists in the Linux kernel's KVM x86 Hyper-V synthetic timer emulation. When a guest or userspace sets the timer COUNT to a value close to U64_MAX, the deadline calculation can overflow and cause the timer to fire immediately, resulting in a CPU livelock and RCU stall reports.

In the Linux kernel, KVM for s390 has a vulnerability due to an incorrect length check in __import_wp_info(). The len field in struct kvm_hw_breakpoint is user-controlled and can be larger than int, leading to memory allocation based on an unvalidated value, which can result in failed allocation and a WARN.

In the Linux kernel, KVM for s390 has a memory leak in guest debug handling. bp_data is freed only on error, and every successful KVM_SET_GUEST_DEBUG leaks memory.

In the Linux kernel, KVM for s390 has a memory leak in the guest debug error path. __import_wp_info() allocates old_data buffers for watchpoints, but if a later watchpoint fails to import, these buffers are not freed, leading to memory leaks on repeated requests.

In the Linux kernel, KVM for s390 has a memory leak on vCPU destruction. Guest debug data (hw_bp_info, hw_wp_info, and old_data buffers) is not freed when a vCPU is destroyed, leading to unbounded memory leaks over VM lifetimes.

In the Linux kernel, KVM for s390 has an issue with not holding srcu when importing watchpoint data. __import_wp_info() reads guest memory, which requires holding kvm->srcu to avoid a race with memslot updates, potentially leading to use-after-free.

In the Linux kernel, KVM for s390 has a memory corruption vulnerability due to reinjecting CK machine checks. Channel-subsystem damage machine checks should not be forwarded to the guest, and reinjecting them can lead to kfree of a stack variable.

In the Linux kernel, KVM for s390 has an issue with reading gmap->asce without holding mmu_lock in the keyop operation. Other functions read this field inside the mmu_lock read-side, but keyop does not, which can lead to using a stale value and memory corruption.

In the Linux kernel, KVM for arm64 has a race between VNCR TLB invalidation and vcpu_put() unmapping the VNCR page. This can lead to a TOCTOU pattern and a BUG_ON(), potentially causing a system crash.

In the Linux kernel, vgic_v3_save_pending_tables() in KVM arm64 iterates over dist->lpi_xa without holding a reference to the vgic_irq structures, relying only on temporary RCU coverage. A concurrent path can free the LPI, leading to a dangling pointer dereference after the RCU grace period. The fix re-fetches each LPI via vgic_get_irq() and drops it with vgic_put_irq().

In the Linux kernel, range-based TLB invalidation (TLBI Range) in KVM arm64 can encode large ranges in few bits, making it easy for a guest to cause an overflow if the hypervisor naively adds the range to the base address. The fix caps the range to the limit dictated by the address bit determining the VA range, and for IPA invalidation further ignores the upper range.

In the Linux kernel, the vector[] variable declared on the stack in dmsintc_inject_irq() in KVM for LoongArch is sometimes used without initialization. The fix initializes this variable to avoid using uninitialized data.

In the Linux kernel, kvm_loongarch_init() in KVM for LoongArch calls kvm_loongarch_env_init() to allocate resources, then calls kvm_init(). If kvm_init() fails, resources are not freed because module_exit() is not run on module init failure. The fix calls kvm_loongarch_env_exit() when kvm_init() fails.

In the Linux kernel, kvm_arch_prepare_memory_region() in KVM for LoongArch computes arch flags for a memslot only for KVM_MR_CREATE and KVM_MR_MOVE, returning early for KVM_MR_FLAGS_ONLY. Since the generic code allocates a zeroed memslot, after a KVM_MR_FLAGS_ONLY update the arch flags are cleared, potentially causing guest memory to be mapped to wrong host pages. The fix carries arch flags over from the old memslot for KVM_MR_FLAGS_ONLY.

In the Linux kernel for LoongArch, the BPF subsystem had a bug in jump offset calculation for tail calls. The old macro-based method could lead to incorrect branch offsets and soft lockups under extra JIT passes. The fix calculates the offset directly on the absolute target and adds a guard for null image.

In the Linux kernel for LoongArch, the BPF subsystem had a stack layout issue with the arena register slot. When arena_vm_start is dynamically enabled, it shifts the relative offset of the tcc_ptr slot, potentially causing memory misalignment or corruption. The fix moves the arena register save/restore sequences below the tail call counter context slots and updates the epilogue.

In the Linux kernel for LoongArch, the acpi_package_ids[] array can overflow on virtual machines with many sockets. With a typical one-core-per-socket configuration, the number of sockets can reach 256, causing the array to overflow. The fix increases the array size to the maximum of MAX_PACKAGES and KVM_MAX_VCPUS.

In the Linux kernel on LoongArch, the rethook trampoline saved and restored the percpu base register ($r21) in its frame. If the task migrated to another CPU while the handler ran, the stale percpu base was restored, causing incorrect this_cpu_*() accesses and corruption of scheduler and timer state.

In the Linux kernel for LoongArch, there is a vulnerability related to break 11 handling in the context of Kprobes. A user can issue the same break instruction, causing kprobe_singlestep_handler() to be called without an active probe, leading to preempt count underflow. This may result in incorrect socket attribution to the root cgroup, bypassing BPF policies.

A vulnerability in the Linux kernel's media: airspy driver was fixed, where the wrong function was used on device disconnect. airspy_disconnect() cleared the s->udev pointer while airspy_stop_streaming() still dereferenced it without checking, leading to a NULL dereference. video_unregister_device() was replaced with vb2_video_unregister_device() and moved before clearing s->udev.

A kernel memory leak (kmemleak) exists in the Linux media CEC subsystem. A previous change removed the implicit rc_free_device() call from rc_unregister_device() but left the adap->rc = NULL assignment, so rc_free_device() is never called on an allocated rc device. The issue is triggered e.g. on dw-hdmi unbind.

In the Linux kernel's CEC subsystem, there is an issue with delayed work during an interrupted transmit. If the wait for transmission is interrupted by a signal, cancel_delayed_work_sync() may run before the CEC kthread arms the work, leading to freeing data with pending work. The fix uses disable_delayed_work_sync() to cancel and disable the work, preventing re-arming.

In the Linux kernel's CEC subsystem for the Extron DA HD 4K Plus device, there is a lack of input validation that could lead to overflowing the msg.msg[] buffer when malformed data is received. The fix adds a sanity check.

In the Linux kernel's CEC subsystem, there is a serialization issue with delivering messages to the exclusive follower. cec_receive_notify() reads the follower pointer without the adapter lock, which can lead to a race with mode changes or release. The fix serializes the no-follower check and message delivery.

In the cedrus_init_ctrls() function of the Linux kernel media cedrus driver, the V4L2 control handler is initialized before allocating memory for ctx->ctrls. If this allocation fails, the function returns -ENOMEM without freeing the previously allocated handler resources, leading to a memory leak.

In the Linux kernel media cobalt driver, snd_cobalt_card_create() stores cobsc in sc->private_data and installs snd_cobalt_card_private_free() as sc->private_free. If cobalt_alsa_init() fails, the err_exit_free path calls snd_card_free(sc) and then kfree(cobsc), causing a double free of the same object.

In the Linux kernel media cx23885 driver, netup_ci_exit() frees a netup_ci_state while its work item netup_read_ci_status() may still be pending or running on the system workqueue. The worker obtains the state via container_of() and dereferences it, so it must not outlive the state.

In the Linux kernel media em28xx driver, the audio-only path registers extensions while probing the primary device, which for a dual-TS board happens before dev_next is created. The duplicate device inherits is_audio_only and is independently inserted into em28xx_devlist, potentially leading to a use-after-free during disconnect.

In the Linux kernel media em28xx driver, when a device with has_dual_ts=1 takes the is_audio_only path, both dev and dev->dev_next are added to the global em28xx_devlist. During disconnect, em28xx_close_extension(dev) only removes dev->devlist, leaving dev->dev_next->devlist linked in the global list, which after dev_next is freed leads to a dangling pointer and list corruption.