Linux kernel vulnerabilities

In the Linux kernel, the test_run function was removed from lwt_seg6local_prog_ops because lwt_seg6 related BPF ops could be invoked via bpf_test_run() without entering input_action_end_bpf() first. Self tests for BPF_PROG_TYPE_LWT_SEG6LOCAL probably didn't work because the per-CPU variable seg6_bpf_srh_states::srh was never assigned in the test case.

In the Linux kernel, the misc: fastrpc driver has a double free of 'buf' in the error path of fastrpc_req_mmap(). The buffer is freed in fastrpc_req_munmap_impl() if unmap is successful, but at the end there is an unconditional call to fastrpc_buf_free(), causing a double free.

In the Linux kernel, the nvmet-tcp module has a bug causing kernel crash when command allocation fails. When allocation fails, NULL pointer dereference in nvmet_tcp_release_queue_work causes a crash.

In the Linux kernel, an issue was found in the perf/aux subsystem regarding AUX buffer serialization. The mmap_mutex is insufficient to fully serialize, potentially leading to races and data inconsistencies.

In the USB dwc3 driver for ST platforms in the Linux kernel, a reference count issue was found in the probe error path. The probe function never allocates platform devices, so the 'undo_platform_dev_alloc' error path is bogus and decrements the reference count of the probed device. This can lead to unbalanced reference counts and premature release of resources, potentially causing use-after-free.

In the Linux kernel, in the aacraid SCSI driver, a double-free vulnerability was found on probe failure. aac_probe_one() calls hardware-specific init functions that eventually call aac_init_adapter(). If aac_init_adapter() fails after allocating memory for aac_dev::queues, it frees the memory but does not clear that member, leading to a double-free in the error path.

In the Linux kernel's nfsd subsystem, a vulnerability exists in handling cached open files in the nfsd4_open codepath. The issue involves a race where a newly-created nfsd_file can have its PENDING bit cleared while nf_file is still NULL, leading to a crash. Additionally, a memory leak can occur when an existing entry has a valid nf_file. The fix introduces a new nfsd_file_acquirei_opened variant that takes an optional file pointer.

In the Linux kernel, the dmam_free_coherent function has a call order issue that can lead to use-after-free. It frees the DMA allocation first, then removes the devres entry, which in concurrent scenarios may free the wrong entry and trigger a WARN_ON.

In the Linux kernel, the ath12k driver has an invalid memory access while processing fragmented packets. The monitor ring and the reo reinject ring share the same ring mask index, leading to invalid access when the reinject ring is processed. The fix removes the monitor ring mask since monitor support is not yet enabled.

A vulnerability has been identified in the Linux kernel related to improper removal of sysfs attributes before calling the deactivate function. This may lead to a situation where functions operating on trigger-data can be called after it has been freed.

In the Linux kernel, in the Landlock module, a vulnerability was found that loses track of restrictions on cred_transfer. When a process' cred struct is replaced, it almost always invokes the cred_prepare LSM hook, but in one special case (KEYCTL_SESSION_TO_PARENT) the cred_transfer hook is used instead. Landlock only implements cred_prepare, so KEYCTL_SESSION_TO_PARENT causes all Landlock restriction information to be lost. The fix adds a cred_transfer hook that does the same as cred_prepare.

In the Linux kernel's cifs module, during subrequest retry, smb2_async_writev() re-picks the server, causing in_flight counter mismatch and warnings. The fix removes the server re-pick in this function.

In the Linux kernel, the mt76 WiFi driver uses skb_put instead of skb_put_zero, potentially reusing uninitialized data.

In the Linux kernel, a vulnerability in the Bluetooth stack allows too large handle values in BIG to cause erroneous release of an IDA identifier in hci_conn_cleanup.

In the Linux kernel, a bug in the Bluetooth HCI stack allowed setting a handle larger than HCI_CONN_HANDLE_MAX, causing a warning when freeing an incorrectly allocated handle, potentially destabilizing the system.

In the Linux kernel, in the ASoC driver for Mediatek MT8195, removing the codec entry for the ETDM1_OUT_BE dai link left the platforms array empty, causing an out-of-bounds read (KASAN) during initialization.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the GFS2 filesystem's gfs2_log_flush function. The issue occurs when glock operations race with an unmount, causing access to a freed sd_jdesc object.

In the Linux kernel, the CAN J1939 subsystem improved error handling for tightly received RTS messages in xtp_rx_rts_session_new. The less informative WARN_ON_ONCE backtraces were replaced with a new error handling method that provides clearer error messages and allows early termination of problematic sessions.

In the Linux kernel Bluetooth L2CAP layer, a race exists between socket close (sock_close) and hci_rx_work, which accesses the released socket without lock protection. This leads to a use-after-free bug.

In the Linux kernel, a double free vulnerability was found in the lantiq_etop driver in the detach function. The number of currently released descriptors is never incremented, resulting in the same skb being released multiple times.

In the Linux kernel, a kernel bug was found in the nilfs2 filesystem during rename operation on a broken directory. The nilfs_dotdot() function may return a location exceeding the page size, leading to a BUG_ON in __block_write_begin_int().

In the Linux kernel, the vmalloc memory manager has an issue with hash indexing when cpu_possible_mask has gaps (e.g., on SPARC). The addr_to_vb_xa() function can return an index that accesses a non-existent CPU area, causing an oops.

In the Linux kernel, the toshiba_acpi driver lacks a terminator in the toshiba_dmi_quirks[] array, causing an out-of-bounds access when processing the quirk list. Added an empty terminating entry to fix this.

In the Linux kernel, a race condition was found in the CAN subsystem's ISO-TP protocol in the isotp_rcv() function. Concurrent processes can change data state, leading to skb_over_panic due to buffer overflow.

In the Linux kernel, the behavior of READ near OFFSET_MAX in NFSD was fixed, which caused loff_t overflow and returned EINVAL, leading to infinite client retries.

In the Linux kernel, the qedf driver for Fibre Channel adapters did not initialize delayed work (stag work) for all virtual ports (vports). This caused a warning in the workqueue system and issues with only 32 out of 64 NPIV ports appearing online. The fix initializes this work for all vports.

In the Linux kernel, a reference count issue was found in the qedf (QLogic Fibre Channel) driver when a LOGO request is received during a Task Management Function (TMF). This leads to hung I/O operations and a hung task warning. The fix addresses the reference count problem.

In the IIO subsystem in the Linux kernel, an error handling issue was found in IIO_BUFFER_GET_FD_IOCTL. If copying the file descriptor to userland fails, the cleanup code incorrectly uses put_unused_fd(), which is wrong because the fd was already published by fd_install(). This leaves a partially cleaned up file descriptor table and a partially destructed 'file' object, allowing use-after-free tricks on 'file->private_data'.

In the Linux kernel's IPv6 multicast subsystem, a vulnerability was found due to using an RCU-unsafe version of ipv6_get_lladdr(). After external locks were removed from MLD code, this function can be called without proper synchronization, leading to use-after-free and system crash.

In the Linux kernel MCTP subsystem, there is a use-after-free in route.c. When mctp_key_add() fails, the key is freed but later used in trace_mctp_key_acquire(). Added an else statement to use the key only on success.

In the Linux kernel KVM for ARM64, during teardown of a redistributor region, the pointer to that region was not removed from vcpus, potentially leading to a dangling pointer. The fix ensures vcpus do not hold pointers to removed regions.

In the Linux kernel, ACPICA reverted a previous fix regarding mapping multiple BARs. The previous change caused mapping to stop at page boundaries but read/write attempts covered the full length, leading to a NULL pointer dereference. Now the entire length is mapped.

In the Linux kernel for powerpc/pseries, plpar_hcall() and related functions did not enforce proper result buffer sizes, potentially leading to stack corruption. The fix changes declarations to explicitly-sized arrays, enabling compiler detection of such errors.

In the Linux kernel, the mtk-vcodec driver has a potential NULL pointer dereference in SCP. The return value of devm_kzalloc() needs to be checked to avoid this issue. Similar to CVE-2022-3113.

In the Linux kernel f2fs filesystem, during remount the SB_INLINECRYPT flag is cleared and re-set, causing a window where new files may not use inlinecrypt, potentially leading to data corruption if wrappedkey_v0 is enabled. The fix removes the clearing of this flag in default_options.

In the Linux kernel, the dw-axi-dmac driver has a vulnerability that overruns the hw_desc array when the number of descriptors exceeds allocated memory, potentially causing a kernel panic. The fix adds a new field to track allocated descriptors and removes an unnecessary call.

In the Linux kernel, the blk-flush subsystem has a bug in the use of the request.queuelist, which can lead to a kernel crash. The fix changes the list usage to list_add_tail and adds list initialization in the flush callback.

In the i915 graphics driver in the Linux kernel, an issue was found where the DPT object can be shrunk in some scenarios while the actual framebuffer is not, leaving it on the DPT's bound_list. This leads to an attempt to rewrite PTEs via a stale CPU mapping, causing a panic.

In the Linux kernel, the br_mst_set_state function of the network bridge has suspicious RCU usage that may lead to warnings and potential errors. The fix changes the VLAN group dereference to the appropriate RCU helper.

In the Linux kernel's BPF subsystem, there is a potential use-after-free in bpf_link_free() where the link can be freed by dealloc_deferred but the code still uses dealloc afterward.

In the Linux kernel SCSI driver mpt3sas, there is a potential out-of-bounds access when using test_bit() and set_bit() on a single word. The fix increases the allocation to at least sizeof(unsigned long) to provide sufficient space.

In the Linux kernel, the cachefiles module has a use-after-free vulnerability because requests are not removed from the xarray during flushing. This can lead to use of freed memory. The fix removes requests from the xarray when flushing.

In the Linux kernel's hns3 network driver, a concurrent scenario can cause a kernel crash when link status changes and the roce driver is uninitialized.

In the Linux kernel, the btrfs filesystem has a use-after-free vulnerability caused by a race during device replace. While loading zone info, a device is extracted from the chunk map without proper synchronization, which can lead to use of freed memory after the replace operation completes.

In the Linux kernel, a use-after-free vulnerability was found in the IMA module related to the dname.name field of a dentry. The name can change on rename and the earlier value can be freed, leading to unsafe dereference.

In the Linux kernel, the crypto starfive module has a vulnerability where kfree is called on a stack-allocated buffer. RSA text data uses a variable-length buffer allocated on the software stack, and freeing it causes undefined behavior in subsequent operations.

A vulnerability in the Linux kernel related to the {reserve,release}_compress_blocks() functions with cp_rwsem lock has been fixed. Failure to properly secure this can lead to racing with the checkpoint, resulting in filesystem metadata corruption.

A vulnerability has been identified in the Linux kernel within the enic_set_vf_port function, which incorrectly assumes the length of nl attributes. The length validation of attributes is not precise, potentially leading to unauthorized memory access.

A vulnerability has been identified in the Linux kernel related to an incorrect PDI offset in the SoundWire code, leading to out-of-bounds access. This issue has been resolved by removing the unnecessary offset.

In the Linux kernel, the NTFS3 filesystem used a fixed-size array instead of a variable-length array, causing a smatch warning about the buffer being too small when copying the name. The fix changes to a variable-length array.