Linux kernel vulnerabilities

A vulnerability has been identified in the Linux kernel related to improper access to an uninitialized value in the nci_rx_work() function. The issue stems from a lack of validation for header size, payload size, and total packet size before processing the packet.

In the Linux kernel's amd-xgbe network driver, a vulnerability causes skb data length underflow, triggering BUG_ON() in include/linux/skbuff.h and leading to intermittent kernel panic. The fix drops the packet when such underflows are seen due to inconsistencies in hardware descriptors.

In the Linux kernel, the ASoC codecs wcd938x has incorrect use of port ID. Mixer controls have the channel ID in mixer->reg, which is not the same as the port ID. The fix derives the port ID from the chan_info array to avoid out-of-bounds access to the port_map array.

In the Linux kernel, the Bluetooth subsystem refactored the malicious advertisement data check. Previously, the out-of-bounds read check was performed at the end of the loop, causing false positives in the journal. The check is now moved to the beginning of the loop to avoid checking after the pointer has been advanced.

In the Linux kernel, HCI_AMP support has been removed because BT_HS has been removed and AMP controllers are no longer useful. The capability to create AMP controllers and the hdev->dev_type field have also been removed.

In the Linux kernel, the mac80211 subsystem does not verify the presence of the extended element ID before parsing an extended element, which may lead to improper frame processing.

In the Linux kernel, the MSM driver (for Qualcomm SoCs) has a null pointer dereference in msm_ioctl_gem_submit, potentially leading to a kernel panic.

A vulnerability has been identified in the Linux kernel related to an incorrect error path in the seg6_init() function when CONFIG_IPV6_SEG6_LWTUNNEL is not defined. In this case, if seg6_hmac_init() fails, the genl_unregister_family() function is not called.

In the Linux kernel, the ALSA core has a bug in the assignment of the module pointer during sound card initialization. When the sound core is built-in (CONFIG_SND=y) and the driver is a module (e.g., CONFIG_SND_USB_AUDIO=m), the module pointer is ignored, leading to missing module references and potential race conditions during module removal.

In the Linux kernel, the speakup module has a bug where sizeof() is used instead of ARRAY_SIZE() for the buf pointer, which is an array of u16 values. This can lead to out-of-bounds access, potentially causing malfunction or security issues.

In the Linux kernel, a potential index out of bounds issue was found in the color transformation function of the AMD Display driver. The issue occurs when index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS), potentially leading to buffer overflow. A bounds check was added to log an error and return false in such cases.

In the Linux kernel, a vulnerability in of_modalias() was fixed. If the buffer is too small even for the first snprintf() call, the len parameter becomes negative and the str parameter (if not NULL initially) points beyond the buffer's end. A buffer overflow check was added after the first snprintf() call and the check after strlen() was fixed (accounting for the terminating NUL char).

A vulnerability has been identified and resolved in the Linux kernel. The issue concerns the multiq_tune() function, where an out-of-bounds write (OOB) may occur due to improper use of the q->bands variable after memory allocation.

In the Linux kernel, the vmwgfx graphics driver has a vulnerability of invalid reads in fence signaled events. The length of the drm_event is set to the size of the parent structure instead of the actual drm_vmw_event_fence structure, leading to out-of-bounds reads when copying the event to user space.

A vulnerability has been identified in the Linux kernel related to incorrect memory freeing in the pinctrl_enable() function. The 'pctldev' struct is allocated in devm_pinctrl_register_and_init() and is managed by devm_, leading to a double free.

In the Linux kernel's networking core, skb_copy and skb_copy_expand do not reject fraglist GSO skbs, which must not be linearized, potentially causing a crash later.

In the Linux kernel, an uninit-value access vulnerability was found in __ip_make_skb(). The issue is caused by a race condition when checking the HDRINCL flag and missing initialization of fl4_icmp_type and fl4_icmp_code fields in the flowi4 structure.

In the Linux kernel, a vulnerability was found in the __ip6_make_skb() function for IPv6, involving potential uninitialized value access. The issue arises from incorrect checking of the HDRINCL flag on the socket, which can lead to a race condition and reading uninitialized data.

In the Linux kernel, an out-of-bounds access vulnerability was found in the ops_init function. The issue arises from reading max_gen_ptrs twice without proper locking, potentially leading to a smaller allocated array than later used.

In the Linux kernel's tty n_gsm driver, there is an out-of-bounds write vulnerability in gsm0_receive() when switching modes and sending data exceeding gsm->len, potentially causing memory corruption.

In the Linux kernel, the net/smc module has a NULL pointer dereference vulnerability in smc_vlan_by_tcpsk(). Coverity found that netdev_lower_get_next can return NULL, and this pointer is then used without a check in is_vlan_dev(). The fix replaces the manual iteration with netdev_walk_all_lower_dev().

In the Linux kernel, the AMD KFD driver has a vulnerability causing kernel panic when reset fails and is triggered again. In SRIOV configuration, if reset fails to bring the ASIC back to normal but stop_cpsch has already been called, a subsequent reset may cause the driver to perform uninitialization again.

In the Linux kernel, a use-after-free bug was found in the mlx4_en driver in function mlx4_en_try_alloc_resources(). After calling mlx4_en_copy_priv() and on error, tmp->tx_cq is freed, and then in mlx4_en_alloc_resources() there is a dereference of &tmp->tx_cq[t][i], leading to use-after-free. A check of mlx4_en_copy_priv() was added to fix this.

In the Linux kernel, the pch_can driver for CAN bus has a use-after-free vulnerability in the pch_can_rx_normal function. After calling netif_receive_skb(skb), dereferencing skb is unsafe, and the can_frame structure is still used.

In the Linux kernel's seg6 (IPv6 Segment Routing), during encapsulation of an IPv4 packet into an IPv6+SRH header, the seg6_do_srh_encap function clears the IPv6 control block, losing the receiving interface index. This can lead to a NULL pointer dereference when forwarding stats are enabled.

In the Linux kernel, a slab-use-after-free vulnerability was found in the Bluetooth L2CAP subsystem's l2cap_connect() function. The issue arises from an insufficiently extended critical section, allowing premature freeing of the chan structure before use. The patch extends the critical section and changes the return type to void to prevent pointer leaks.

In the Linux kernel, a flaw in the abort logic of btrfs_replace_file_extents can lead to a corrupt file system with a missing extent in the middle of a file. The incorrect condition may cause an abort when it should not, especially in prealloc code paths.

In the Linux kernel, the HSR subsystem has a use-after-free vulnerability in prp_create_tagged_frame(). The prp_fill_rct() function can fail, freeing the skb and returning NULL, but the original skb is returned on the success path, leading to use of freed memory.

In the Linux kernel's atl1c driver, a vulnerability related to DMA RX overflow is addressed by checking the allocated skb address and using skb_reserve() to avoid the problematic 0x...fc0 address. Tested on AR8131 on Acer 4540.

In the Linux kernel, the iommufd subsystem has a vulnerability due to missing update of the domains_itree after splitting an iopt_area. If the original area was linked to a domain, pages are not properly reinserted, leading to tree corruption and use-after-free (UAF).

In the Linux kernel, the ath11k wifi driver lacks RCU read-side critical section marking during DFS radar event handling. The code calling ath11k_mac_get_ar_by_pdev_id() was not marked as an RCU read-side critical section, which can lead to use-after-free issues.

In the Linux kernel, in the ath12k Wi-Fi driver, an RCU locking issue was found in the handling of DFS-radar and temperature events. The code was not marked as an RCU read-side critical section, which may lead to use-after-free issues.

In the Linux kernel, the ath12k WiFi driver has a locking issue in the htt mlo-offset event handling. The code was not marked as an RCU read-side critical section, which could lead to use-after-free issues.

In the Linux kernel, the AMDGPU driver has a pin_count leak for the gart.bo object. The GART disable function is not called in SRIOV scenarios, leading to a leak when the driver is unloaded.

In the Linux kernel, the AMDKFD driver's svm_migrate_fini function performs redundant resource release operations, causing warnings and potential issues during driver disconnect.

In the Linux kernel, the SCTP function sctp_rcv_ootb does not check if skb_header_pointer returns NULL before using it, which could lead to a NULL pointer dereference. The fix adds a check and breaks out if the return is NULL.

In the Linux kernel, the mac80211 subsystem has a use-after-free vulnerability during CCMP/GCMP RX. Under certain conditions, the 'hdr' variable may be invalid, leading to use of freed memory.

In the Linux kernel, the dma-debug module can generate an error message millions of times per second, causing printk buffer spam and CPU usage up to 100%. This affects drivers using the DMA API.

In the Linux kernel's enetc driver, there is an illegal memory access when reading the affinity_hint file in procfs. irq_set_affinity_hit() stores a reference to a temporary stack variable, leading to a page fault on later access. The issue is fixed by the get_cpu_mask() helper, which provides permanent storage.

In the Linux kernel's drm/sched (GPU scheduler), before killing a job, all its dependencies must complete to avoid data corruption.

In the Linux kernel, the wl1251 driver's wl1251_cmd_scan function calls memcpy without checking the length, which could lead to a buffer overflow. The fix adds a check to ensure the length is within the maximum allowed size.

In the Linux kernel, a vulnerability in the f2fs filesystem was fixed where multiple filesystem instances could race on accessing the global fsync_entry_slab pointer, leading to a use-after-free issue during recovery. The fix initializes and destroys this slab cache only once during module init/destroy to avoid the issue.

In the Linux kernel, a NULL dereference in nfs3svc_encode_getaclres in nfsd was fixed, occurring in error cases when dentry may be NULL.

In the Linux kernel, a vulnerability in scsi/libfc was fixed, addressing an array index out of bound exception in fc_rport_prli_resp().

In the Linux kernel CIFS module, there is a NULL pointer dereference vulnerability in cifs_compose_mount_options(). The optional @ref parameter may contain a NULL node_name, leading to a NULL pointer dereference.

In the Linux kernel, the SCSI target subsystem has a NULL pointer dereference when completing XCOPY operations. The function target_complete_cmd() uses the se_tpg_wwn pointer, which is NULL for the global tpg used by XCOPY, leading to a panic. The fix checks if se_tpg_wwn is NULL and then uses se_cmd->cpuid.

In the Linux kernel's NFS, a use-after-free occurs in nfs4_init_client() when attempting to mount two different exports through two different NICs belonging to the same server. KASAN reported the issue.

In the Linux kernel, the AMD Display Manager (DMUB) driver has a memory leak during system suspend/resume operations. The initialization function allocates memory on every resume, leading to a growing leak.

In the Linux kernel, the TCP option parser in synproxy (synproxy_parse_options) could read one byte out of bounds. When the length is 1, the execution flow enters the loop, reads one byte of the opcode, and if the opcode is neither TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, exceeding the length of 1. The fix adds an early return when length < 0.

In the Linux kernel's mptcp (Multipath TCP), the TCP option parser (mptcp_get_options) can read one byte out of bounds when the option length is 1. The fix is inspired by a similar fix for IPv4 TCP.