Linux kernel vulnerabilities

In the Linux kernel, the mt76 driver had a race condition leading to use-after-free on station removal. In a small race window, ongoing tx activity can cause an skb to be added to the status tracking idr after it has been cleaned up, keeping the wcid linked in the status poll list.

In the rtw89 driver (for WiFi cards), the rtw89_phy_cfo_parse() function did not validate mac_id before accessing an array, leading to an out-of-bounds read. The fix adds an index check before array access.

In the ti_sci_pm_domains driver in the Linux kernel, a check for the return value of devm_kcalloc was added. If memory allocation fails, the function returns -ENOMEM to avoid a later NULL pointer dereference.

In the Linux kernel, the arm_scmi firmware subsystem has a vulnerability due to improper validation of the number of protocols during protocol list enumeration. The check uses a sum of unsigned integers that can overflow and bypass the validation. The fix avoids the addition in the validation.

In the f2fs filesystem in the Linux kernel, a vulnerability was found involving dereferencing a stale list iterator after the loop body. If no break is hit, the iterator becomes a bogus pointer, and dereferencing it (e.g., cur->page) could load out-of-bounds/undefined values, which may be exploited by an attacker.

In the Linux kernel's mac80211 module, a use-after-free was found in channel context (chanctx) code. After freeing the old context in ieee80211_vif_use_reserved_reassign(), further referencing it leads to UAF.

In the staging r8188eu WiFi driver in the Linux kernel, a vulnerability was found due to missing check before writing to the ->Ssid array in the rtw_wx_set_scan() function. There is a check to prevent read overflow, but no check to prevent writing beyond the end of the array, which can lead to buffer overflow.

In the F2FS filesystem in the Linux kernel, a bug in dec_valid_node_count() that caused BUG_ON was fixed. When total_valid_block_count or total_valid_node_count were corrupted to zero, the function panicked. The fix prints a warning and sets SBI_NEED_FSCK instead of panicking.

In the F2FS filesystem in the Linux kernel, a problem with not clearing dirty inode in f2fs_evict_inode() was fixed. When inode node and dnode node share the same nid, dnode truncation invalidates its NAT entry, causing failure when truncating inode node and leaving it dirty. The fix clears dirty for inode and sets SBI_NEED_FSCK flag.

In the f2fs filesystem in the Linux kernel, a vulnerability was found due to missing sanity check on block address in the f2fs_do_zero_range() function. After fuzzing the filesystem image, block mapping info in the inode can be inconsistent with the SIT table, leading to kernel panic when updating SIT with an invalid block address.

In the F2FS filesystem in the Linux kernel, additional sanity checks for inline data inodes were added. The issue occurred when an inode had both inline_data and encrypted flags, leading to inline data conversion and page cache pollution, then panic in clear_inode(). The fix adds sanity checks in sanity_check_inode().

In the Linux kernel, the f2fs filesystem had an inconsistency between the checkpoint's valid block count and the SIT table, which could trigger a kernel panic during garbage collection. The fix adds consistency validation.

In the Linux kernel, a vulnerability was found in the ext4 filesystem that allows cycles in the h-tree stored inside a directory. A maliciously corrupted filesystem can lead to kernel corruption of tree nodes and access to unallocated memory. The issue is fixed by verifying that traversed block numbers are unique.

In the Linux kernel, in ip_gre, the check was revised to test csum_start instead of the transport header. This prevents overflow in lco_csum when GRE packets with TUNNEL_CSUM are processed.

In the Linux kernel, in the drm/etnaviv driver, a check was added for reaped mappings in etnaviv_iommu_unmap_gem. If the mapping is already reaped, the unmap is a no-op to avoid double removal and data structure corruption.

In the Linux kernel, a fix was made for accessing tp->snd_cwnd in TCP, which could be set to an illegal value, leading to warnings and potential bugs.

In the Linux kernel, in the xprtrdma module, when an RDMA server returns a fault format reply, the NFSv3 client may treat it as a callback (bcall) when the bc service does not exist. This leads to a NULL pointer dereference in rpcrdma_bc_receive_call. The fix treats all calls as not a bcall when bc_serv is NULL.

In the Linux kernel, the f2fs filesystem functions f2fs_is_valid_blkaddr and __is_bitmap_valid triggered WARN_ON warnings that could be exploited with malicious data. The fix replaces WARN_ON with dump_stack to avoid unnecessary warnings.

In the Linux kernel, the f2fs filesystem has a vulnerability causing an infinite loop when flushing node pages. The issue occurs when I/O operations return EIO errors, leading to a system hang.

In the Linux kernel, a deadlock in rtw_surveydone_event_callback() in the staging rtl8723bs driver was fixed. The deadlock occurred due to holding a lock while calling del_timer_sync().

A vulnerability in the Linux kernel's Ceph filesystem can cause a deadlock when a client holds Fwb caps and waits for a getattr(Fsr) response while the MDS server tries to revoke caps. This blocks write operations.

In the Linux kernel, in the AMD Display driver, there is a vulnerability involving division by zero. If a read modulo value is 0, it can cause a kernel panic.

In the Linux kernel, in ALSA OSS, the PCM OSS buffer allocation overflow was fixed. A 1MB limit for period size was added and array_size() and array3_size() are used for multiplications to prevent integer overflow.

In the Linux kernel, a vulnerability was found in the access_ok() function on three architectures, where checking the end of a user access against the address limit does not account for possible integer overflow. Passing a negative length or another overflow returns success when it should not.

In the Linux kernel, an issue in tpm2_del_space() in the TPM module was fixed, where missing use of try_get_ops() could lead to a NULL pointer dereference in a tiny race window.

In the Linux kernel, there is a vulnerability involving integer overflow on 32-bit systems in the operation 'len * sizeof(*p)' in the NFSD module. This could lead to incorrect behavior or potential exploitation.

In the Linux kernel, a bug in the OCFS2 filesystem caused a crash when mounting with quota enabled. The issue occurred during initialization of dqi_gqlock when the corresponding dqi_type and dqi_sb were not properly initialized. The bug was introduced by commit 6c85c2c72819, which aimed to avoid accessing uninitialized variables in error cases. The fix properly initializes global quota info.

In the Linux kernel, a use-after-free (UAF) vulnerability was found in the BFQ scheduler. The issue involves moving the oom_bfqq queue, which can lead to a write to freed memory during module removal.

In the Linux kernel, a bug in the memstick/mspro_block driver regarding read-only devices was fixed. Instead of checking for read-only state in ->open and leaking a reference in case of a read-only device, set_disk_ro is used to propagate the read-only state to the block layer.

A use-after-free vulnerability was found in the bfq_dispatch_request function of the BFQ scheduler in the Linux kernel. The issue occurs during normal SCSI-MQ testing and can lead to memory corruption.

In the Linux kernel for the parisc architecture, a vulnerability was found involving non-access data TLB cache flush faults. The fdc and fic instructions in flush_user_dcache_range_asm and flush_user_icache_range_asm cause faults that do not invalidate the cache line, potentially leading to memory corruption. The problem was hidden by nullification of the flush instructions.

In the Linux kernel, the F2FS filesystem lacked validation of the curseg->alloc_type value, which could lead to an out-of-bounds access to the sbi->block_count[] array when mounting a corrupted image, triggering a UBSAN error. The issue was reported by Wenqing Liu and affected kernel versions 5.17-rc4 and 5.17-rc6.

In the Linux kernel, a vulnerability in the f2fs filesystem causes a hang during statistics read and unmount operations. The issue is due to using a mutex instead of a spin_lock, leading to thread deadlock.

In the Linux kernel, the btrfs filesystem has a double bio completion issue during errors in compressed reads. The function btrfs_submit_compressed_read() may call bio_endio() on the bio, and then btrfs_submit_data_bio() does it again, leading to incorrect behavior.

In the Linux kernel, the imx-jpeg media driver has an out-of-bounds array access bug. During a JPEG parsing error, the slot is not yet acquired and may have the default value MXC_MAX_SLOTS, leading to out-of-bounds read and modification of adjacent data.

In the Linux kernel, a bug in the sm712fb driver (video: fbdev) caused a crash when writing three bytes to the framebuffer. The issue occurred in the smtcfb_write() function and was caused by an error in the endianness conversion code. The fix removes the open-coded endianness fixup-code.

In the Linux kernel, the SCSI qla2xxx driver incorrectly freed a pre-allocated structure during purex packet handling, causing a system crash during module load/unload tests. The fix skips that entry.

In the Linux kernel, the qla2xxx SCSI driver has a race condition between the timeout handler and the async completion function, leading to use-after-free and a NULL pointer dereference. The fix introduces a reference counter for the SRB structure to synchronize access.

In the Linux kernel, the Bluetooth subsystem (hci_event) ignores multiple connection complete events for the same handle. Previously, this led to multiple device registration and memory corruption.

In the Linux kernel, in the AMDGPU driver, there is a reference count leak of a dma_fence object in the error path of amdgpu_cs_fence_to_handle_ioctl(). When info->in.what falls into the default case, the function returns -EINVAL without decrementing the reference count, leading to memory leaks.

In the Linux kernel, in the AMDKFD driver, there is a deadlock during SVM range restore work when a process exits. kfd_process_notifier_release flushes svm_range_restore_work, which can deadlock with deferred_list work when mmput releases the last user and calls exit_mmap.

A vulnerability in the Linux kernel's ath11k PCI driver causes a system crash during suspend when the board file is not found. The issue arises from asynchronous driver initialization not completing before the suspend handler runs. The fix adds a check for the ATH11K_FLAG_QMI_FAIL flag during both suspend and resume.

In the Linux kernel, the mt76/mt7921 driver has a crash vulnerability when the network interface fails to start. If startup fails, the scheduled reset_work may execute after memory cleanup, leading to a use-after-free. The fix cancels the work item before cleanup.

In the Linux kernel, a memory leak in the mpi3mr SCSI driver was fixed. Memory segments of the operational reply queue were not freed when unloading the driver.

A vulnerability in the Linux kernel's ath11k driver causes a deadlock when flushing the management transmit queue. This prevents management frames from being sent within 5 seconds, leading to errors and frame drops.

In the Linux kernel, in the HISI SAS driver for v3 hardware, there is an issue with the order of freeing IRQ vectors. If the driver fails to request the channel IRQ or fatal IRQ during probe, it frees the IRQ vectors before freeing the IRQs, leading to a kernel BUG.

In the Linux kernel's SCSI libfc driver, there is a use-after-free vulnerability in fc_exch_abts_resp(). fc_exch_release(ep) decreases the reference count, and when it reaches zero, the object is freed, but it is still used in subsequent code, leading to use-after-free.

In the Linux kernel, a crash in monitor mode with the mt76 SDIO driver was fixed. The RXD size was increased from 128 to 256 to avoid nonlinear buffer issues.

In the Linux kernel, the netfilter conntrack module has an issue with garbage collection autotuning. The change in gc behavior causes netlink event overflows when the hash table is large. The fix adjusts the gc schedule to avoid overflows.

In the Linux kernel, an inode reference leak in ceph_get_snapdir() was fixed. The reference was not released in error handling cases.