Linux kernel vulnerabilities

In the Linux kernel, a memory leak in ceph_readdir was fixed when note_last_dentry returns an error. last_readdir is reset and a comment was added.

In the Linux kernel, an error handling issue in wfx_init_common() in the staging wfx driver was fixed. One error handler did not call ieee80211_free_hw(hw), potentially causing a memory leak.

In the Linux kernel, an issue in the staging vchiq_core driver was fixed where find_service_by_handle could return NULL for an invalid handle, leading to a NULL pointer dereference.

In the Linux kernel, a possible memory leak in MMU DR fini in the habanalabs driver was fixed. A copy-paste error caused a leak when host-resident shadow is NULL.

In the Linux kernel's qede driver, a vulnerability exists where skb allocation is not confirmed before use. qede_build_skb() assumes build_skb() always works, but it can fail under memory pressure, causing a kernel panic. The fix adds a check for NULL return from build_skb().

A vulnerability in the Linux kernel's AMD GPU driver (amdgpu/drm) affects the dcn30_internal_validate_bw function. Missing FPU protection during swath width calculations (CalculateSwathWidth) can lead to a general protection fault, causing system crashes during prolonged WebGL Aquarium usage, especially with DRM debug logs enabled.

In the Linux kernel, a NULL dereference crash in the svc_deferred_event trace class in SUNRPC was fixed, occurring when an svc_rqst is deferred while sunrpc tracing is enabled.

In the Linux kernel, in Hyper-V drivers (vmbus), sysctl_record_panic_msg is now deactivated by default in isolated guests. The panic page may contain guest-sensitive information, so it is no longer dumped to Hyper-V by default. Comments in hyperv_panic_event and hyperv_die_event were also updated.

In the Linux kernel, the aqc111 USB driver has out-of-bounds access vulnerabilities in the aqc111_rx_fixup() function. A malicious or defective USB device can trigger out-of-bounds reads of the metadata array, corruption of data in cloned SKBs, and construction of a packet with a tail beyond the buffer end. The fix is not described in this description.

In the Linux kernel IPv6 module, there is a kernel panic vulnerability when forwarding a packet if the input interface has no associated in6 dev. This can be triggered using tc commands with netem corrupt.

In the Linux kernel, the dm-integrity module has a memory corruption vulnerability when the tag_size parameter is smaller than the actual digest size. This can cause writes beyond the end of the ic->recalc_tags array, leading to memory corruption. The issue is fixed by increasing the tags array with sufficient padding.

In the Linux kernel, a vulnerability related to the BFQ scheduler was fixed, which could lead to use-after-free (UAF). The commit regarding honoring already-setup queue merges was restored after being reverted, as the bug was fixed in another commit.

In the Linux kernel, a vulnerability in the zoran driver (media: staging: media: zoran) was fixed where the buffer number was miscalculated in zoran_reap_stat_com when tmp_dcim=1. This led to a NULL pointer dereference later. The fix corrects the calculation and adds a check to prevent recurrence.

In the Linux kernel, a vulnerability in the zoran driver (media: staging: media: zoran) was fixed by moving the videodev allocation. Code was moved out of zr36057_init() into new functions handling zr->video_dev, which eases code reading and fixes a zr->video_dev memory leak.

A vulnerability in the Linux kernel's pfifo_tail_enqueue function allows incrementing the qlen counter without dropping packets when sch->limit is set to 0. This causes a mismatch between parent and child qlen values, potentially enabling user-to-kernel privilege escalation.

A race condition was found in the Linux kernel between device unregistration and ethtool operations (e.g., changing channel count). During unregistration, a mutex is destroyed, causing a DEBUG_LOCKS_WARN_ON warning and potential deadlock. The fix adds a broader check to deny ethtool operations on devices being dismantled.

In the GFS2 filesystem in the Linux kernel, the address space of an inode is not truncated when flipping the GFS2_DIF_JDATA flag. This can lead to mixing pages using buffer heads and iomap_folio_state, which is not allowed.

In the Linux kernel, the v3d graphics driver failed to set the job pointer to NULL after job completion. This caused a false warning when unloading the driver, indicating the job was still active.

In the Linux kernel's vfio/platform driver, lack of bounds checking for count and offset arguments from userspace in read/write syscalls. Limiting offset to 40 bits does not prevent out-of-bounds device access.

In the Linux kernel, the bnxt_en driver fails to recalculate network features after XDP detachment, causing HW-GRO not to re-enable automatically. This can lead to a NULL pointer dereference and system crash during subsequent reconfiguration.

A vulnerability in the Linux kernel's GTP driver causes the gtp network device to remain active after removing the network namespace (netns) where the UDP socket was created. This leads to a ref_tracker warning and potential reference leak.

In the Linux kernel, a vulnerability in the PFCP driver caused the network device (e.g., pfcp0) to be linked to the device's network namespace instead of the UDP socket's namespace. This led to a reference leak and a kernel splat when the namespace containing the UDP socket was removed.

In the Linux kernel's FEC (Fast Ethernet Controller) driver, a vulnerability was found where the error return from page_pool_dev_alloc_pages is not handled. When memory allocation fails, the driver uses a NULL pointer, causing a system crash. This occurs under memory pressure, e.g., during SMB writes to a SATA HDD on i.MX6Q.

In the Linux kernel, the vsock/virtio mechanism did not discard packets after a transport change. This can lead to a NULL pointer dereference of vsk->transport when the socket is reassigned or detached.

In the Linux kernel's dm-thin module, a vulnerability was found in the get_first_thin function, which used an unsafe list_empty() + list_first() sequence in RCU-protected code. This can lead to a race condition where one thread removes a list entry while another reads it, causing a pointer dereference to the pool structure and a system crash.

In the Linux kernel, a vulnerability in the gpio-virtuser module was found due to missing cleanup of the lookup table after a failed virtual GPIO device probe. This leads to inability to retry the device and memory leaks.

In the Linux kernel, a vulnerability in the netdev module was found where NAPI IDs were not fully namespaced. The netlink interface must ensure that a NAPI instance belongs to the same network namespace as the genl socket owner.

In the Linux kernel's io_uring/eventfd subsystem, a vulnerability was found where io_eventfd_do_signal() called from an RCU callback may directly free the io_ev_fd structure instead of deferring it to another RCU grace period. This could lead to use-after-free or other memory errors.

In the Linux kernel, a vulnerability was found due to overly strict assertions (WARN_ON) when file handle encoding fails. These assertions are incorrect because encoding can fail for various reasons, and main users (nfsd, name_to_handle_at) are already prepared to handle errors.

A race condition was discovered in the Linux kernel when printing the CPU map (cpumap). Modifying the CPU mask during the print operation causes a mismatch in formatted string length, leading to a warning and potential error in kvasprintf. The fix caches the cpumask into a temporary variable before printing.

In the Linux kernel, in the HNS3 network driver, there is an issue with auto-enabling the misc interrupt vector. There is a time window between enabling interrupts and initializing the service task, during which an interrupt can trigger a warning and potentially incorrect behavior.

In the Linux kernel HNS3 network driver (hclge), hclge_fetch_pf_reg() does not account for the TQP BAR space split into two segments (TQPs 0-1023 and 1024-1279), leading to out-of-bounds BAR memory access when the number of TQPs exceeds 1024.

A vulnerability in the hns3 network driver for HIP08 devices causes a kernel crash. HIP08 devices do not register PTP devices, so the hdev->ptp pointer is NULL, but the transmit path still attempts to set hardware timestamp info with the SKBTX_HW_TSTAMP flag, leading to a NULL pointer dereference and kernel panic.

In the Linux kernel, a vulnerability in the netfilter conntrack module allows the hashtable size to exceed INT_MAX during resize, triggering a WARN_ON_ONCE in __kvmalloc_node_noprof() due to missing __GFP_NOWARN flag. This issue is limited to the init_netns namespace.

In the Linux kernel, a vulnerability was found in the sch_cake network scheduler due to an underflow of per-host bulk flow counters, leading to out-of-bounds memory access. Bounds-checking helper functions were added to prevent such issues.

In the Linux kernel's AFS filesystem (kafs), the maximum allowed cell name length (256 bytes) exceeds the procfs filename limit of 255 characters, causing a warning and failure when creating a directory under /proc/net/afs/. The fix limits the maximum cell name length to 253 characters, also ensuring safe creation of the /afs/.<cell>/ mount point.

A vulnerability in the Linux kernel's AMD PMC driver (platform/x86/amd/pmc) causes an unbalanced IRQ1 wake disable when i8042 did not enable the wakeup, leading to a WARN() warning and potential wake_depth underflow.

In the Linux kernel's SCTP subsystem, sysctl cookie_hmac_alg uses current->nsproxy to obtain the net structure, which can lead to null-ptr-deref during process exit, causing system crash.

In the Linux kernel's SCTP subsystem, sysctl auth_enable uses current->nsproxy to obtain the net structure, which can lead to null-ptr-deref during process exit, causing system crash.

In the Linux kernel, in the SCTP subsystem, a vulnerability was found in the sysctl handler for UDP port, which uses the 'current->nsproxy' structure. This can lead to a null-pointer dereference (Oops) when the current process is exiting, potentially exploited by an attacker to cause a system crash.

A bug in the Linux kernel disabled hardware checksum offload for BIG TCP IPv6 packets with extension headers. The issue specifically affected the IPV6_TLV_JUMBO header, which is only used for packet capture (e.g., tcpdump) and not transmitted by physical devices. The fix restores offload support for this specific case.

In the Linux kernel's net/smc module, during CLC message reception, the length field in the header can exceed the buffer size, leading to a deadloop when draining data. The patch checks the return value of sock_recvmsg to prevent infinite looping.

In the Linux kernel's DLM (Distributed Lock Manager), a vulnerability was found causing a possible null pointer dereference in a logging function when called from request_lock(), as lkb->lkb_resource is not yet assigned. Additionally, a resource name could be a non-printable byte array, leading to incorrect ASCII assumption.

A vulnerability in the Linux kernel causes soft lockups in fib6_select_path under high IPv6 next hop churn. The issue occurs when traversing a multipath circular linked list while nodes are concurrently deleted on another core, leading to an infinite loop and system panic. The fix applies RCU primitives to protect list access.

In the Linux kernel, the ACPI NFIT module has a vulnerability involving an out-of-bounds read (vmalloc-out-of-bounds) in the acpi_nfit_ctl function. The issue arises from lack of buffer size validation before accessing the nd_cmd_pkg structure, which could lead to undefined behavior.

In the Linux kernel, the HSR (High-availability Seamless Redundancy) module's hsr_init_skb() failed to allocate enough space in the skb buffer for the RedBox case. As a result, send_hsr_supervision_frame() attempts to add extra structures (hsr_sup_tlv and hsr_sup_payload), causing a buffer overflow and kernel panic (skb_over_panic).

A use-after-free vulnerability was found in the sg_release() function of the Linux kernel's SCSI sg driver. The issue occurs because kref_put() is called before releasing the open_rel_lock mutex, potentially causing premature memory deallocation and access to freed memory.

In the Linux kernel, a bug in ksmbd (SMB server) regarding out-of-bounds read in ksmbd_vfs_stream_read was fixed. An offset from client could be a negative value, which could lead to an out-of-bounds read from the stream_buf. This issue occurs when setting 'vfs objects = streams_xattr parameter' in ksmbd.conf.

In the Linux kernel, a vulnerability was found in ksmbd that allows an out-of-bounds write in ksmbd_vfs_stream_write. The issue occurs when a client sends a negative offset value, potentially allowing data to be written outside the allocated buffer. This is triggered when 'vfs objects = streams_xattr' is set in ksmbd.conf.

In the Linux kernel, a vulnerability exists in the Hyper-V HID driver (hid_hyperv) where unloading the module triggers a devres warning due to an unallocated devres group. The driver overrides hid_dev->driver and reimplements the probe function without calling devres_open_group(), causing an error during driver removal. The fix involves dropping the driver override and using standard registration functions.