Linux kernel vulnerabilities

In the Linux kernel ftrace subsystem, readers of set_ftrace_filter and set_ftrace_notrace files use a pointer to the global hash instead of a copy. After releasing locks, the global hash can be updated, leading to use-after-free and similar bugs.

In the Linux kernel tracing module, a slab-out-of-bounds read vulnerability exists in the strsep function. The issue occurs when trace_get_user fails to set the parser buffer end to 0 after processing an overly long string, leading to an out-of-bounds access in ftrace_regex_release.

In the Linux kernel, Hygon processors lacked the resctrl_cpu_detect() call in BSP initialization, causing a division by zero fault during boot. The issue appeared after the function was moved to vendor-specific code.

In the i2c driver for the RTL9300 chip in the Linux kernel, an out-of-bounds read vulnerability was found in the rtl9300_i2c_smbus_xfer function. The data->block[0] variable comes from user input and without proper validation can be very large, leading to memory corruption.

A vulnerability was found in the Linux kernel's backlog accounting in qdisc_dequeue_internal for hhf, fq, fq_codel, and fq_pie qdiscs. When a tbf parent runs out of tokens, packets are placed in gso_skb, and backlog is not properly decremented when dropping packets due to limit changes. This causes a backlog underflow in the parent tbf, potentially leading to network queueing issues.

In the Linux kernel, a vulnerability was found in the asix_devices driver for USB Ethernet devices. During MDIO bus initialization, the PHY address was not masked to 5 bits, potentially allowing invalid addresses and causing a shift-out-of-bounds exception.

In the GVE driver in the Linux kernel, a vulnerability allows ethtool operations to be invoked after shutdown(), causing dereference of freed pointers and leading to a kernel panic.

In the Linux kernel for the s390 architecture, a vulnerability was found where the identity mapping always includes the lowcore area, even when the relocate_lowcore option is set. This causes double mapping of lowcore and allows NULL pointer accesses to succeed instead of causing an exception.

In the Linux kernel, a dst refcount leak was discovered for loopback packets in the netfilter nf_reject module. The issue occurs when nf_reject_fill_skb_dst attempts to replace the dst entry in a packet that already has one (e.g., loopback traffic), triggering a WARN() and potential memory leak.

In the Linux kernel, a double-free vulnerability was found in the DRM driver for Intel Xe GPUs (drm/xe) in the xe_vm_bind_ioctl function. When an array bind argument check fails, the bind_ops structures are freed twice, leading to a system crash.

In the Linux kernel's io_uring/net subsystem, a vulnerability allows ring-provided buffers to be pinned across retries, leading to potential use of invalid pointers or data corruption when buffer groups are shared.

A vulnerability in the Linux kernel's netlink subsystem causes infinite retry looping in netlink_unicast(). The issue stems from an incorrect check of socket read memory constraints, leading to CPU stalls (RCU stall) and system unresponsiveness.

In the Linux kernel, the asix_devices driver for ASIX AX88772 USB Ethernet chips lacked a phy_mask setting for the MDIO bus. This caused up to 32 dummy PHY devices to be created, with only one binding to the network driver. During system suspend/resume, a NULL pointer dereference occurred in phy_state_machine(), leading to a crash.

In the habanalabs driver in the Linux kernel, a use-after-free (UAF) vulnerability was found in the export_dmabuf() function. After inserting a file reference into the descriptor table, another thread could close the file, and then the function continued to access objects that may have already been destroyed.

A reference count leak in ctnetlink_dump_table() in the Linux kernel's netfilter subsystem occurs when ct == last, causing a double increment that prevents conntrack object release. This blocks netns dismantle or conntrack module removal, leading to potential denial of service.

A vulnerability in the Linux kernel's SCTP stack involves unsafe access to shared fraglist buffers in cloned GSO packets. A cloned head skb shares fragments with the original, leading to uninitialized memory reads. The fix linearizes cloned GSO packets in sctp_rcv().

In the Linux kernel's KCM module, a race condition was found in kcm_unattach(). Missing check of the kcm->tx_stopped flag before calling queue_work() can re-queue tx_work after socket release, leading to use-after-free.

In the HFS filesystem in the Linux kernel, a vulnerability allows slab-out-of-bounds read in hfs_bnode_read() due to missing validation of offset and length, leading to access beyond allocated memory.

A slab-out-of-bounds read vulnerability was found in the Linux kernel's HFS+ filesystem in the hfsplus_bnode_read() function. It can be triggered during file or attribute deletion, potentially causing a system crash or security compromise.

A vulnerability in the Linux kernel's HFS+ filesystem allows a slab-out-of-bounds read in the hfsplus_uni2asc() function. The issue is triggered during directory listing (readdir) and can cause a system crash.

In the Linux kernel, a vulnerability in the RCU NOCB mechanism was found where improper checking of the `nocb_cb_kthread` pointer can lead to invalid memory access. The issue occurs during CPU NOCB de-offload and re-offload when `rcuop` thread creation fails.

In the DRM/Xe driver in the Linux kernel, a vulnerability allows dma-fences to point to data that is freed before an RCU grace period, leading to use-after-free on external access.

In the Linux kernel JFS filesystem, the dbAllocAG function does not check if the tree index exceeds the size of the stree array. This can occur with corrupted filesystem metadata.

In the iommufd subsystem in the Linux kernel, a vulnerability allows overflow during IOVA range alignment using the ALIGN() macro, potentially causing value wrap and creating overlapping mappings.

A race condition was found in the comedi driver of the Linux kernel between poll and device detaching. During detach, the async area was removed even though poll requests were still active on the wait_queue_head, leading to use-after-free.

In the Linux kernel fbdev driver, an out-of-bounds write vulnerability exists in the fast_imageblit function. The issue occurs when the FBIOPUT_CON2FBMAP operation fails during console resize but still proceeds to update the screen with invalid references, leading to an out-of-bounds write.

A race condition vulnerability was found in the Linux kernel between ptdump_walk_pgd() and memory hot remove operations. While ptdump scans kernel page tables, concurrent modifications can cause use of freed memory, leading to potential security issues. The fix moves the memory hotplug lock inside ptdump_check_wx(), protecting both the dump and W+X page checking paths.

In the venus (media) driver in the Linux kernel, a vulnerability allows out-of-bounds (OOB) read in event_seq_changed() due to missing payload size validation against message length.

In the Linux kernel netfilter (nf_tables) subsystem, duplicate devices can be added to a chain/flowtable in the same batch, causing the netdev event path to remove only the first device and leave the duplicate's hook unregistered, triggering a WARNING.

In the Linux kernel, a vulnerability in the F2FS filesystem causes an out-of-bounds access in the dnode page. A corrupted filesystem image with a dnode sharing the same node ID as its inode leads to incorrect block address calculation and memory access beyond bounds.

An initialization issue with state_ptrs was found in the xfrm_state_find function of the Linux kernel. Under preemption, a state lookup could hit a different CPU, and if a cached state was found, it was ignored and the 'acquire' block was entered using uninitialized state_ptrs.

In the Linux kernel, functions `cpu_switch_to()` and `call_on_irq_stack()` on ARM64 manipulate the stack pointer (SP) and Shadow Call Stack pointer (x18) non-atomically. Interrupts (SErrors, Debug Exceptions, pseudo-NMIs) can occur during the switch, causing stack mismatch and SCS pointer corruption, leading to kernel panics.

In the IIO (Industrial I/O) subsystem in the Linux kernel, a potential out-of-bound write vulnerability was found. The buffer is 20 characters long, and the simple_write_to_buffer function truncates data, but there is no check whether the input data fits in the buffer before copying.

In the Linux kernel, a vulnerability in the ASoC driver for Mediatek MT8365 passes an incorrect structure size to mt8365_dai_set_priv, causing a global-out-of-bounds read. This can lead to system crashes.

In the alienware-wmi-wmax platform driver for x86 in the Linux kernel, a vulnerability was found due to a missing empty element at the end of the dmi_system_id array named awcc_dmi_table. This could lead to out-of-bounds read during array processing.

In the Linux kernel, a vulnerability in the NVMe over PCI Endpoint Function (nvmet-pci-epf) driver causes double completion of commands after nvmet_req_init() fails. This sends two completions to the host and corrupts the NVMe target state, leading to a kernel oops.

In the rtw89 WiFi driver in the Linux kernel, there is a shift wrapping vulnerability in rtw89_core_mlsr_switch(). The link_id value from debugfs can exceed BITS_PER_LONG, causing incorrect shifting and potential out-of-bounds access. Limiting to IEEE80211_MLD_MAX_NUM_LINKS (15) fixes the issue.

In the Linux kernel iwlwifi driver, a code error causes ERR_PTR(0) (NULL) to be returned instead of a proper error code when iwl_setup_deferred_work() fails. This can lead to a use-after-free related to debugfs.

A use-after-free (UAF) vulnerability was found in the Linux kernel's proc_reg_open() function. The issue occurs when directly checking the proc_lseek pointer, which can lead to a security breach during module removal.

In the F2FS filesystem in the Linux kernel, there is an out-of-bounds read/write vulnerability in the devs.path array. When the device path length equals MAX_PATH_LEN, the lack of a null terminator causes adjacent structure fields to be treated as part of the path, leading to incorrect parsing.

In the Linux kernel's cfg80211 subsystem, a missing lock in cfg80211_check_and_end_cac() was found. The wdev_chandef() function requires the wiphy mutex, but the cfg80211_propagate_cac_done_wk() worker does not acquire it, triggering a warning and potential race condition.

In the Linux kernel, a vulnerability was found in the nf_hook_run_bpf() function in the netfilter BPF mechanism. The BPF program can be called without migration disabled in the packet transmit path, causing an assertion failure in __bpf_prog_run() and a system crash.

A slab-out-of-bounds read vulnerability was found in the Linux kernel's netfilter xt_nfacct module. The issue occurs when the nfacct_mt_checkentry() function assumes the account name is null-terminated, which is not always the case.

In the Linux kernel, a vulnerability in the rdev_addable function in the md module can lead to a NULL pointer dereference and kernel panic. The issue occurs when rdev->mddev is set to NULL before RCU synchronization, causing an error in RCU context. The fix uses READ_ONCE and checks if rdev->mddev is still alive.

In the Linux kernel's j721e-csi2rx driver, a list_del corruption vulnerability occurs when ti_csi2rx_start_dma() fails in ti_csi2rx_dma_callback(). The buffer is marked done with an error but not removed from the DMA queue, causing it to be retried and leading to a double list deletion and list corruption.

In the Linux kernel vsock module, a use-after-free vulnerability exists due to the ability to autobind a socket to VMADDR_PORT_ANY. The socket returned by accept() also has port VMADDR_PORT_ANY but is not on the list of unbound sockets, leading to an extra refcount decrement.

In the Linux kernel, in the net/packet subsystem, there is a race condition between packet_set_ring() and packet_notifier(). When packet_set_ring() releases po->bind_lock, another thread can run packet_notifier() and process a NETDEV_UP event. The patch temporarily sets po->num to zero to keep the socket unhooked until the lock is retaken.

In the Linux kernel, a vulnerability in the TLS ULP mechanism occurs when data disappears from the TCP socket receive queue. This can lead to incorrect parsing state and potentially a kernel crash.

In the Linux kernel ntfs3 filesystem, a vulnerability exists where a live inode is marked as bad after a file name removal fails. This can lead to icache inconsistencies and potentially a use-after-free.

A vulnerability in the Linux kernel's epoll mechanism allows semi-unbounded recursion during loop checking. The lack of proper depth limits in the epoll graph can lead to kernel stack overflow.