Linux kernel vulnerabilities

In the Linux kernel media go7007 driver, go7007_snd_init() takes a v4l2_device reference for the ALSA side, but go7007_snd_remove() drops it immediately after calling snd_card_free_when_closed(). This is too early when a userspace process still has the capture PCM open, potentially leading to a use-after-free.

In the Linux kernel media i2c imx415 driver, the VBLANK path returned immediately when programming VMAX failed after pm_runtime_get_if_in_use() had taken a runtime PM reference. This leads to a runtime PM reference leak.

In the Linux kernel media i2c ov02a10 driver, ov02a10_check_hwcfg() calls fwnode_handle_put(ep) immediately after allocating and parsing the endpoint, but subsequently uses the same 'ep' handle in fwnode_property_read_u32(), leading to a use-after-free. Additionally, reading the optional 'ovti,mipi-clock-voltage' property overwrote the 'ret' variable, causing probe to fail entirely.

In the Linux kernel media i2c ov7740 driver, ov7740_remove() had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler that relies on that mutex, leading to a use-after-destroy kernel panic. Additionally, the driver called v4l2_ctrl_handler_free() and mutex_destroy() sequentially, then called ov7740_free_controls() which invokes both again, resulting in a double-free.

In the Linux kernel, isys_notifier_init() in the media intel/ipu6 driver leaks resources. When endpoint parsing or adding fails partway through the loop, the function returns without calling v4l2_async_nf_cleanup(), leaving previously added v4l2_async_connection entries on the notifier's waiting list.

In the Linux kernel, the media platform mtk-mdp3 driver's mdp_probe() mishandles SCP device reference counting. The fallback path drops the reference obtained via __get_pdev_by_id() too early, and scp_put() later drops it again, resulting in a double reference release.

In the Linux kernel, the media platform mtk-mdp3 driver lacks a sanity check after looking up the SCP device. If the SCP driver has not yet been bound, a NULL-pointer dereference can occur.

In the Linux kernel, the media rc sunxi-cir driver does not unregister the rc device on probe failures after rc_register_device() succeeds. Only rc_free_device() is called, leaving the registered rc device and its resources behind.

In the Linux kernel, the media rkvdec HEVC decoder's st_ref_pic_set_prediction() computes the reference RPS index as st_rps_idx - (delta_idx_minus1 + 1) using u8 operands. When delta_idx_minus1 + 1 exceeds the current index, the subtraction wraps and the array access at calculated_rps_st_sets[ref_rps_idx] reads far out of bounds.

In the Linux kernel, the rtl2832_sdr driver's rtl2832_sdr_start_streaming() function failed to release previously allocated DMA buffers and URB structures when allocation or submission of URBs failed. This led to a DMA memory leak and an out-of-bounds read of urb_list[] on the next streaming attempt, potentially passing garbage pointers to usb_free_urb().

In the Linux kernel, the media s2255 driver's s2255_fillbuff() memcpy()s vc->jpg_size bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc->jpg_size is taken verbatim from the S2255_MARKER_FRAME header sent by the device and is never bounded, allowing an out-of-bounds write.

In the Linux kernel, the media s2255 driver's s2255_probe() reads a 4-byte marker and version from the last 8 bytes of the firmware blob. If the firmware file is shorter than 8 bytes, fw_size - 8 underflows and the access reads out of bounds.

In the Linux kernel, the media saa7164 driver's saa7164_dev_setup() adds the device to the global saa7164_devlist before requesting the PCI BAR memory regions. When get_resources() fails, the device remains on the list while the probe error path frees it, leaving a dangling entry.

In the Linux kernel, the media tda18250 driver has a possible integer overflow when the variable exp equals zero. The shift operation 1 << (exp - 1) may then lead to undefined behavior.

In the Linux kernel, the VPE (Video Processing Engine) driver for TI platforms has a vulnerability due to missing synchronization between the FIFO overflow recovery worker and IRQ handling during stream teardown. This can lead to use-after-free of stream resources when an interrupt or worker runs after the stream is released.

In the Linux kernel, the media v4l2-async module incorrectly deletes an unlinked ASC entry on link creation error. Calling list_del() on an entry that was never inserted can dereference NULL instead of returning the original link creation error.

In the Linux kernel, the media v4l2-ctrls module lacks validation of HEVC EXT SPS RPS counts. Decoder drivers may index beyond dynamic arrays if SPS values exceed HEVC limits (64 short-term sets, 32 long-term references) or exceed the DPB maximum.

In the Linux kernel, the v4l2_fwnode_parse_link() function in the media v4l2-fwnode module leaks an fwnode reference. The remote endpoint reference acquired via fwnode_graph_get_remote_endpoint() is not released on the success path.

In the Linux kernel, the media video-i2c driver leaves a kthread error pointer in kthread_vid_cap on failure. This causes a subsequent start_streaming() call to return success without starting the thread, and stop_streaming() to call kthread_stop() on the error pointer, leading to a kernel crash.

In the Linux kernel, the media zoran driver double-frees a registered video_device. The zoran_exit_video_devices() function calls video_unregister_device() and then kfree() on the same object already freed by the zoran_vdev_release() callback.

In the Linux kernel, the media qcom iris driver uses disable_irq_nosync() during power-off, which does not wait for an in-flight threaded IRQ handler to complete. The handler may still run after the VPU is powered down and access hardware registers.

In the Linux kernel, the media chips-media wave5 driver's device_run() defers job_finish() even when no DEC_PIC was queued, leaking the shared v4l2_m2m job slot. This stalls all decoder instances at EOS, e.g. in GStreamer.

In the Linux kernel, the scsi qla2xxx driver's FRU/I2C bsg handlers use a 256-byte DMA buffer that is not zeroed and initialize only a few leading bytes. qla2x00_write_sfp() can override the transfer length with a user-supplied value (up to 255 bytes), causing reads of uninitialized heap memory and writes to device flash.

In the Linux kernel, the scsi qla2xxx driver's I2C bsg handlers use the i2c->length field (16-bit) without bounds checking, while the buffer is a fixed 64 bytes. This can lead to stack and heap overflows and memory leaks when the length exceeds the buffer size.

In the Linux kernel, the scsi qla2xxx driver's qla_chk_edif_rx_sa_delete_pending() function dereferences a NULL pointer when the SCSI command has already been returned or aborted. This can lead to a kernel crash in interrupt context.

In the Linux kernel, the scsi qla2xxx driver's qla28xx_validate_flash_image() function returns QLA_SUCCESS unconditionally, causing the FC BSG transport to not complete the job on error. This leads to block layer resource leaks and the request dangling until timeout.

In the Linux kernel, the scsi qla2xxx driver's qla24xx_report_id_acquisition() function has a use-after-free because the virtual port is used after dropping the vport_slock without taking a reference. Concurrent qla24xx_deallocate_vp_id() can free the port, leading to memory corruption.

In the Linux kernel, the scsi qla2xxx driver's qla_nvme_fcp_abort() and qla_nvme_ls_abort() functions call INIT_WORK() before schedule_work(), which on repeated aborts of the same command can corrupt the workqueue list and lead to crashes or a looping worker.

In the Linux kernel, the scsi qla2xxx driver's qla2x00_update_fru_versions() function copies the user-supplied BSG request into a fixed 256-byte stack buffer and iterates list->count times without bounds, potentially reading past the buffer and sending kernel stack memory to the device.

In the Linux kernel, the scsi: qla2xxx driver's qla2x00_fw_state_show() re-issued the qla2x00_get_firmware_state() mailbox command outside optrom_mutex even when the chip was down or EEH was busy. This could hang the adapter during ISP reset or PCI error recovery.

In the Linux kernel, the scsi: qla2xxx driver's qla2x00_status_entry() allowed non-SCSI SRB entries into the SCSI fast path, where sp->u.scmd.cmd was dereferenced. An unexpected STATUS_TYPE IOCB for a non-SCSI handle could yield a garbage pointer and a wild pointer dereference.

In the Linux kernel, the scsi: qla2xxx driver's qla2xxx_delete_qpair() deleted the request queue before the response queue, leaving a window where the response MSI-X interrupt could dereference the freed rsp->req. This results in a use-after-free.

In the Linux kernel, the scsi: qla2xxx driver's qla2x00_error_entry() read ha->req_q_map[que] twice, so a concurrent NULL store by qla25xx_free_req_que() could result in a NULL pointer dereference.

In the Linux kernel, the scsi: qla2xxx driver's qla24xx_report_id_acquisition() format-1 path called qla_update_host_map() without holding vport_slock, allowing races with concurrent host_map updates and btree corruption.

In the Linux kernel, the scsi: qla2xxx driver's bsg handlers staged requests/replies in an uninitialized 256-byte stack buffer and copied the full structure back, leaking stale stack data. This affected qla2x00_read_fru_status() and qla2x00_read_i2c() among others.

In the Linux kernel, the scsi: qla2xxx driver's qla_nvme_xmt_ls_rsp() unconditionally called qla_nvme_ls_reject_iocb() even when firmware was not started, ringing the doorbell and queuing an IOCB that stopped firmware could not consume, and touching MMIO during the reset/EEH window.

In the Linux kernel, the f2fs filesystem's redirty_blocks() could run an extra cleanup loop iteration when read_cache_folio() failed before pinning any folios, causing folio_put_refs(folio, 2) to drop one reference too many. This led to "BUG: Bad page state" on later drop_caches or reclaim.

In the Linux kernel, f2fs f2fs_xattr_advise_set() calls inode_owner_or_capable() with &nop_mnt_idmap instead of the idmap the VFS passes to the ->set() handler. On idmapped mounts this checks the caller's fsuid against the unmapped on-disk owner rather than the mapped owner.

In the Linux kernel, a race condition exists in the f2fs file system's f2fs_get_read_data_folio() function, which calls f2fs_folio_put() before folio_nr_pages() when invalidating a large folio from the page cache. This allows a concurrent truncate or folio split to shrink or free the folio before the invalidate range is computed, leading to stale xarray entries and bad page state.

In the Linux kernel, f2fs checkpoint_merge can be enabled even when no checkpoint merge thread is running, e.g. on a read-only mount. The ckpt_thread_ioprio sysfs store path calls set_task_ioprio() for the checkpoint thread, dereferencing a NULL task pointer when cprc->f2fs_issue_ckpt is NULL.

In the Linux kernel, f2fs free_segment_range() curseg evacuation loop only iterates up to NR_CURSEG_PERSIST_TYPE (0..5), missing non-persistent in-memory curseg types such as CURSEG_COLD_DATA_PINNED and CURSEG_ALL_DATA_ATGC. An active in-memory curseg within the truncated segment range will not be evacuated.

In the Linux kernel, f2fs has a potential deadloop in a race condition between f2fs_fsync_node_pages() and f2fs_setattr(). Thread A gets a folio via folio_get() while Thread B invalidates the folio mapping, causing is_node_folio to always return false and the retry loop to never terminate.

In the Linux kernel, f2fs the sysfs store path for critical_task_priority updates checkpoint or GC kthread scheduling state but is not protected by s_umount, unlike other control entries. This can race with remount or teardown paths that are stopping those threads.

In the Linux kernel DRM/AMD Display subsystem, a dc_lock leak was found on GPU reset error paths. dm_suspend() acquires the lock, but if helper operations fail, it returns without releasing it, causing deadlock on subsequent lock attempts.

In the Linux kernel DRM/AMD Display subsystem, the per-plane degamma LUT size is not validated, potentially leading to divide-by-zero or out-of-bounds read. The issue affects the AMD_PLANE_DEGAMMA_LUT property, only available when built with AMD_PRIVATE_COLOR.

In the Linux kernel DRM/AMDGPU VCN subsystem, an integer overflow was found in the buffer count check of the dec_msg message. A crafted value can bypass the bounds check and cause an out-of-bounds read.

In the Linux kernel DRM/GUD subsystem, TV mode names read from the USB device are not guaranteed to be NUL-terminated. strlen() can read past the allocated buffer, leading to an out-of-bounds read.

In the Linux kernel DRM subsystem, a memory leak of drm_crtc_commit was found when PAGE_FLIP_EVENT is used. The issue occurs when the event is allocated in prepare_signaling() and set to NULL in complete_signaling(), preventing the object from being freed.

In the Linux kernel DRM/AMDGPU subsystem, an out-of-bounds access to the adev->isolation[] array was found for rings not assigned to a partition. The index AMDGPU_XCP_NO_PARTITION (value ~0) causes access beyond the array, triggering UBSAN warnings.

In the Linux kernel DRM/AMDKFD subsystem, a TLB flush is missing after MES queue eviction/suspension, potentially leading to a race condition and page faults during SVM memory migration.