Linux kernel vulnerabilities

A vulnerability in the Linux kernel's TLS implementation creates an invalid scatterlist chain when end=0 (start!=0), resulting in a chain-after-chain scenario. This passes illegal input to the crypto layer, potentially causing errors or security breaches.

In the Linux kernel's iwlwifi (MLD) driver, disabling AMSDU aggregation for a TID sets max_tid_amsdu_len to 1. The TSO segmentation path lacks a check for this sentinel value, resulting in zero gso_size, which generates over 32000 tiny frames from a single GSO skb. This floods the TX ring, causes massive TX completion events, memory corruption, and a use-after-free in TCP's retransmit queue.

In the Linux kernel, a vulnerability in the igc driver was found where the tx buffer type for SMD (Sashiko Mode Data) frames is not set. The igc_fpe_init_smd_frame() function initializes igc_tx_buffer fields but does not set the buffer type, which can cause TX completion to use the wrong cleanup path when buffers are reused, potentially affecting XDP or XSK transmissions.

In the Linux kernel's MANA driver, a TOCTOU (time-of-check time-of-use) vulnerability was found due to a double-fetch of the hwc_msg_id field from a DMA buffer. The first read is used for bounds checking, and the second for further processing, allowing a malicious device to alter the value between reads and bypass the validation.

In the Linux kernel RDMA/rtrs component, a use-after-free vulnerability was found in the error handling path of rtrs_srv_create_path_files(). Calling kobject_put() before destroying sysfs root folders can free memory that is later accessed, leading to a use-after-free condition.

In the Linux kernel, a vulnerability in the BPF skmsg mechanism was found where sk_psock_verdict_data_ready() does not check for a TLS RX context, causing a race condition with ktls reception. This can lead to a use-after-free condition during data processing.

A vulnerability in the Linux kernel's TCP implementation allows ISN (Initial Sequence Number) prediction for TIME_WAIT connections. The issue stems from storing the ISN in a per-CPU variable that is not cleared when a packet is dropped on various paths (e.g., min_ttl check, xfrm policy, MD5/AO mismatch, eBPF filter). The next SYN processed on the same CPU may receive a predictable ISN.

In the Linux kernel's MANA network driver, the rx_req_idx is not validated before being used to index the reqs[] array. In confidential VMs (SEV-SNP/TDX), DMA memory can be modified by hardware, allowing out-of-bounds array access.

In the Linux kernel's ksmbd filesystem, a vulnerability was found in the error path of durable reconnect handling. After a successful reconnect, a cleanup function may free the file object without removing it from the session ID table, leading to a use-after-free condition.

In the Linux kernel, a vulnerability was found in the netfilter synproxy module where synproxy_tstamp_adjust() uses a stale TCP header pointer after skb_ensure_writable(). This can cause writes to freed memory or sending packets with incorrect checksums.

In the Linux kernel, a vulnerability in the HSR (High-availability Seamless Redundancy) module allows out-of-bounds (OOB) access during supervision frame handling. The issue is due to insufficient length checking of the TLV header before use.

In the Linux kernel, a vulnerability was found in iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() functions, where network header pointers (ip_hdr, ipv6_hdr) were cached before a skb_cow() call that can reallocate skb->head. This can lead to a use-after-free (UAF) condition.

In the Linux kernel VXLAN driver, a vulnerability was found where a cached ip_hdr() pointer is reused after calling skb_tunnel_check_pmtu(), which can change skb->head. This leads to a Use-After-Free condition that can be exploited to compromise system security.

A vulnerability was found in the Linux kernel's iptunnel_pmtud_check_icmp() function, which can be called when the transport header in the socket buffer (skb) is not set. This causes an out-of-bounds memory access because the default value (65535) is used as an offset. The fix accesses the ICMP header based on the IPv4 network header.

A vulnerability was found in the Linux kernel's ipv6_rpl_srh_decompress() function for the IPv6 RPL protocol. The hdrlen calculation can overflow an unsigned 8-bit integer, leading to buffer overwrite and potential corruption of the routing header.

In the Linux kernel, a vulnerability in the net/handshake mechanism allows a race condition where handshake_req_next() removes a request before the accept side reads the socket file. A concurrent consumer can cancel the request and free the socket structure, leading to NULL pointer dereference or use-after-free.

A vulnerability was found in the Linux kernel's handshake networking mechanism. During net namespace exit, the list of pending handshake requests is not properly drained due to reversed arguments in list_splice_init(). Additionally, a race condition between the drain process and request cancellation can cause list corruption and memory leaks.

A vulnerability in the Linux kernel's KVM SEV implementation has been fixed, where Port I/O requests with a length of '0' were not properly ignored. This could cause an underflow when configuring the scratch area, potentially leading to incorrect behavior or system crashes.

In the Linux kernel KVM SEV module, a vulnerability was found due to incorrect calculation of the maximum scratch area length in GHCB. This bug can cause a buffer overflow when processing PSC requests if the minimum length is passed instead of the full size.

A vulnerability was found in the Linux kernel's KVM component for AMD SEV. When processing Page State Change (PSC) requests, the PSC buffer indices were not validated against the actual scratch area size, potentially leading to an out-of-bounds read.

In the Linux kernel, a vulnerability was found in IPv6 extension header handling. The ipv6_hop_jumbo() function can alter skb pointers, requiring the nh pointer to be recomputed to prevent errors.

In the Linux kernel, a vulnerability was found in ip6_parse_tlv() for IPv6, where the cached nh pointer may be invalidated by pskb_expand_head() in ipv6_dest_hao(). After handling the HAO option, the pointer is not refreshed, causing parsing of stale header data.

In the Linux kernel's ESP (Encapsulating Security Payload) IPsec subsystem, a vulnerability was found in the fast path packet processing due to incorrect fragment length checking. When the combined aligned length exceeds a page size, the destination buffer may be allocated as a single page while the scatter-gather list expects a larger area, leading to a potential buffer overflow.

Two vulnerabilities were found in the Linux kernel's iscsi-target module: a CRC buffer overread (4 bytes beyond allocated memory) and a double-free in iscsit_handle_text_cmd(). Both bugs have been present since the original LIO integration (commit e48354ce078c).

In the Linux kernel's SCSI target iSCSI subsystem, a heap buffer overflow vulnerability was found. The iscsi_encode_text_output() function fails to check remaining space in the 8 KB rsp_buf, allowing up to 32 KB of "NotUnderstood" responses for unknown keys, causing an approximately 24 KB overrun.

In the Linux kernel's iSCSI target subsystem, a buffer overflow vulnerability exists in chap_server_compute_hash() due to missing input length validation before BASE64 decoding. This allows writing beyond allocated memory, potentially leading to data corruption or code execution.

In the Linux kernel's Airoha network driver, a vulnerability was found where the transmit loop in airoha_dev_xmit() reads uninitialized fragment address and length during its final iteration. This occurs when the loop index equals skb_shinfo(skb)->nr_frags, leading to access of uninitialized memory and potential page fault. The fix avoids reading fragment data on the last iteration and moves the skb pointer to the last descriptor to defer freeing until final descriptor processing.

In the Linux kernel, a vulnerability in the sk_msg mechanism where the sg.copy bit is not properly synchronized during scatterlist transforms. This can expose file page-cache pages as writable by BPF, allowing modification of the original page cache.

In the Linux kernel, a vulnerability in the GCOV mechanism occurs when GCC optimization merges global branch counters with loop induction variables. Concurrent execution on multiple CPUs causes inconsistent counter values and out-of-bounds memory writes, manifesting as a page fault during IPComp processing.

In the Linux kernel, a use-after-free vulnerability was found in the exfat filesystem's exfat_find_dir_entry() function. A buffer_head is released before reading data from it in the TYPE_EXTEND branch, potentially leading to access of freed memory.

A use-after-free vulnerability was found in the Linux kernel's pnfs_update_layout() function in the pNFS implementation. The issue occurs when the NFS_LAYOUT_RETURN branch calls pnfs_put_layout_hdr(lo) before the tracepoint trace_pnfs_update_layout(), which still references the freed 'lo' structure.

In the Linux kernel's 9p filesystem, a vulnerability was found in p9_client_walk() due to improper reference counting. When a non-cloning walk fails, the error path incorrectly drops a reference to oldfid, potentially causing a use-after-free or refcount underflow.

In the Linux kernel's NFSD subsystem, a use-after-free vulnerability exists in layout stateid allocation. When nfsd4_layout_setlease() fails, the stateid is freed without removing it from the IDR registry, leaving a dangling pointer. Subsequent IDR walkers (states_show, client teardown) may dereference freed memory.

A vulnerability was found in the Linux kernel's NFSD server in the SECINFO_NO_NAME decode function. Improper initialization of the sin_exp structure before decoding may lead to using stale data from previous operations, causing an incorrect exp_put() call on an uninitialized pointer.

In the Linux kernel, the 8250_dw driver has a vulnerability where if clk_notifier_register() fails, the 8250 port remains registered while driver data is freed, leading to a use-after-free hazard on subsequent port access before rebind.

In the Linux kernel xfrm iptfs module, iptfs_consume_frags() fails to propagate the SKBFL_SHARED_FRAG flag when transferring fragments between socket buffers. This can lead to incorrect in-place encryption by ESP. A similar bug was fixed in CVE-2026-46300 for skb_try_coalesce().

Vulnerability in the Linux kernel in the RDS IB driver. During failed connection setup (rds_ib_setup_qp), the i_sends pointer is not cleared after memory free, potentially leading to use-after-free on subsequent shutdown.

In the Linux kernel, an off-by-one vulnerability was found in the OCFS2 filesystem's dlm_match_regions() function. The local-vs-remote region comparison loop uses '<=' instead of '<', causing it to read one entry past the valid range of the qr_regions array. Other loops in the same function correctly use '<'.

A vulnerability was found in the Linux kernel's TCP stack in reqsk_queue_hash_req(). Preemption between mod_timer() and refcount_set() can cause premature timer expiration and a refcount underflow, leading to use-after-free.

In the Linux kernel's mtk_eth_soc network driver, a use-after-free vulnerability was found. The mtk_free_dev() function calls metadata_dst_free() which immediately frees the metadata_dst memory, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer, which can lead to accessing freed memory if any skb still holds that pointer during driver teardown.

In the Linux kernel SCTP stack, the length of a cached INIT chunk in COOKIE_ECHO processing was not validated. Missing validation can lead to out-of-bounds reads and potential memory corruption.

In the Linux kernel, a vulnerability in the SIT (Simple Internet Transition) IPv6 module uses a stale inner IPv6 header pointer after GSO offloads. The ipip6_tunnel_xmit() function caches the pointer at entry, but iptunnel_handle_offloads() may relocate the skb buffer, causing reads from freed memory.

A vulnerability was found in the Linux kernel's SCTP stack in the __sctp_rcv_asconf_lookup() function. An unauthenticated peer can send a truncated ASCONF chunk that declares an IPv6 address but ends after the parameter header, causing uninitialized memory to be read.

In the Linux kernel, sctp_unpack_cookie() lacked validation of the embedded INIT chunk length and address list length in SCTP cookies. A truncated INIT or oversized address list can cause out-of-bounds reads.

In the Linux kernel, a bug was found in the vti6_tnl_lookup() function causing incorrect tunnel matching for IP6_VTI. During wildcard tunnel fallback search, missing checks allowed hash collisions to match tunnels without actual wildcard addresses.

In the Linux kernel, the mvpp2 driver incorrectly initializes the XDP frame size (frame_sz) to PAGE_SIZE instead of the actual RX buffer size from the BM pool. This allows bpf_xdp_adjust_tail() to grow a packet beyond the allocated buffer, causing memory corruption.

In the Linux kernel, a vulnerability in the mvpp2 driver allows an RX buffer to be returned to the BM pool after being handed to XDP or skb, causing use-after-free. The fix reorders operations to refill the BM pool before handing the buffer to XDP or skb.

In the Linux kernel, the RDMA/SRP driver lacks validation of the sense data length copied from SRP_RSP responses. A malicious or compromised SRP target on InfiniBand/RoCE can set a large resp_data_len, causing an out-of-bounds read beyond the received buffer and potentially a page fault.

In the Linux kernel's IB/isert driver, a missing lower bound check on iSER login PDU length allows a remote initiator to send a packet shorter than ISER_HEADERS_LEN (76 bytes). This causes an underflow in payload length calculation, leading to a buffer overflow during memcpy and a crash of the target node. No authentication is required to exploit this vulnerability.