Linux kernel vulnerabilities

A vulnerability has been identified in the Linux kernel related to integer overflow when accessing stack size. The patch reintroduces protection against negative access size to stack memory, which could lead to out-of-bounds array accesses.

The Linux kernel has a use-after-free bug in AX.25 handling triggered by ax25_ds_del_timer during device detach. A race between the detach thread and the timer handler leads to use of freed memory.

In the Linux kernel's io_uring/kbuf subsystem, a vulnerability exists where the io_buffer_list reference is not held over mmap, potentially allowing the buffer to be unregistered before use. The fix holds a reference to the buffer list under RCU to prevent unregistration.

In the Linux kernel, the icmp_build_probe() function has potential NULL dereferences. A double call to __in_dev_get_rcu() can return NULL, and reading dev->ip6_ptr lacks a NULL check. The fix uses the correct RCU API.

In the Linux kernel BPF verifier, an arithmetic flaw allows 32-bit integer overflow during stack bounds checking. Some code paths do not consistently validate register and offset values, potentially causing overflow.

In the Linux kernel, in the mlx5e network driver, a double-free vulnerability was found in the arfs_create_groups function. When memory allocation fails, the function frees ft->g, and then a call to mlx5e_destroy_flow_table frees it again.

In the Linux kernel's cachestat for shmem, two bugs exist due to races with swapping and invalidation. The first can cause out-of-bounds access to swapper_spaces[] on a poisoned swap entry. The second can cause false results in workingset_test_recent() when the shadow entry is missing. The fix validates the entry and handles the missing shadow case.

In the Linux kernel s390 AES crypto module, there is a buffer overread vulnerability in CTR mode. When processing the last block, the code always reads a full block even if less data remains, causing an out-of-bounds read.

In the Linux kernel's atlantic network driver, there is a double free in error handling logic where aq_ring_free can be called multiple times on the same ring under memory pressure.

In the Linux kernel's NTFS3 filesystem, a fixed overflow check in mi_enum_attr() addresses a potential overflow issue.

In the Linux kernel, in the firewire nosy driver, an issue was found where packet_buffer_get did not take user_length into account. If the head packet length exceeds user_length, the function now returns 0 to indicate that no data was read and a larger buffer is needed. This helps prevent user space overflows.

A vulnerability related to Use-After-Free has been identified in the Linux kernel within the gtp_dellink function. The issue arises from improper management of the RCU critical section, which may lead to the key being freed during traversal.

In the Linux kernel, dead code related to SCM_RIGHTS was removed from io_uring. After dropping support for passing io_uring fds over SCM_RIGHTS, the code was removed.

In the Linux kernel, a vulnerability related to sending io_uring files over AF_UNIX sockets was found. File reference cycles caused problems and races, so the decision was made to completely disallow sending io_uring files via sockets using SCM_RIGHTS.

In the Linux kernel, the PECI subsystem has a use-after-free vulnerability in the adev_release() function. When auxiliary_device_add() returns an error, auxiliary_device_uninit() is called, which decrements the device refcount and triggers the .release callback. Re-calling auxiliary_device_uninit() in adev_release() leads to use-after-free.

In the Linux kernel, an unnecessary synchronize_net() call was removed from the ipv6_mc_down() function. This call caused delays from 200 microseconds to 5 milliseconds under load.

In the Linux kernel, in the ttpci media driver, two memory leaks were found in budget_av_attach. When saa7146_register_device and saa7146_vv_init fail, resources are not freed. The fix adds proper resource deallocation.

In the Linux kernel, the tmpfs filesystem has a race condition when handling the dquot rbtree. Fetching the root node is not protected by the dqio_sem semaphore, which can lead to errors and warnings.

In the Linux kernel, the iwlwifi (mvm subsystem) driver has a vulnerability where the TX queue for the offloading TID is not guaranteed to exist during resume. In the rare case that no packets were sent on TID 0, the queue is not allocated, causing a system crash.

In the Linux kernel, in the AMD Display driver, a potential buffer overflow was found in function dp_dsc_clock_en_read(). The snprintf() function was writing up to 30 bytes into a 10-byte buffer. The fix limits the write to at most 10 bytes.

In the Linux kernel, the DVB subsystem has a use-after-free vulnerability. In dvb_register_device, *pdvbdev is set to dvbdev, which is freed in error paths, but not set to NULL, leading to use of freed memory in later calls such as dvb_unregister_device.

In the Linux kernel, in the amdgpu graphics driver, an out-of-bounds access was found in the mmhub client ID. The fix adds proper handling for cid 0x140.

In the Linux kernel, the netfilter module (nft_set_pipapo) has an issue with walking over the current view during netlink dump. The generation mask can be updated during the dump, so the iterator cannot rely on it. A notation was added to specify if the user wants to read/update the set.

In the Linux kernel, a vulnerability in the netfilter nf_tables subsystem causes memory leaks when a set deletion operation fails, due to incorrect element iteration logic in the abort path that skips active instead of inactive elements.

A deadlock exists in the Linux kernel net/sched subsystem. When the mirred action is used on a classful egress qdisc and a packet is mirrored or redirected to self, the same qdisc lock is acquired recursively on the same CPU. The fix adds an owner field (CPU id) to struct Qdisc and drops the packet when re-entered from the same CPU.

In the Linux kernel, the speakup module has a crash risk on very long words. If a console is very large and contains a word longer than 256 characters, it must stop before exceeding the word buffer length.

In the Linux kernel, in the ksmbd subsystem, a potential out-of-bounds read was found when the buffer offset field in some requests is invalid. The fix sets the minimum value of the buffer offset field to the buffer offset to validate buffer length.

In the Linux kernel, the SLUB subsystem fixed flush_cpu_slab() and __free_slab() invocations in task context. The issue occurred when flush_all_cpu_locked() called from task context could cause a dependency issue when a workqueue with WQ_MEM_RECLAIM bit set flushed the global workqueue.

In the Linux kernel, the SCSI qla2xxx driver has a memory leak in __qlt_24xx_handle_abts(). A previous fix added an early return when a command was not found but failed to free the allocated memory for the management command.

In the Linux kernel, the gma500 graphics driver (drm/gma500) has a bug where a destroyed mutex object is used during psb_gem_unpin(). This triggers a WARN_ON(lock->magic != lock) warning and may lead to system instability. The fix moves the drm_gem_object_release() call after the unpin operation.

In the Linux kernel, the binder driver lacks an offset alignment check in the binder_get_object() function. A previous fix removed this check, which may lead to issues when unwinding objects.

In the Linux kernel, a vulnerability in the netfilter module (nft_set_pipapo) can lead to a system crash during large batch add/remove operations. The issue arises from incorrect element removal when multiple elements share the same key, potentially unmapping the wrong element and leaving a stale pointer in the data structure.

In the Linux kernel, a vulnerability in the amdgpu driver was fixed, involving insufficient validation of buffer mapping operation parameters. Lack of proper verification could lead to incorrect behavior or potential security issues.

In the Linux kernel, a use-after-free vulnerability was found in the AoE driver in aoecmd_cfg_pkts(). The fix addresses the issue from CVE-2023-6270, where improper refcnt updates on net_device could lead to use-after-free. The dev_put() call was removed from the success path and added after skb transmission.

A vulnerability has been identified in the Linux kernel related to incorrect overflow checking in the devmap code. The issue occurs on 32-bit architectures where overflow may happen during the rounding of the number of hash buckets.

A vulnerability related to stack overflow in 32-bit architectures has been fixed in the Linux kernel, which could lead to unpredictable behavior.

A vulnerability in the Linux kernel's ip_tunnel_rcv() function for IP tunnels was found. The lack of proper inner header pulling can lead to reading uninitialized memory, as reported by syzbot as a KMSAN bug. The issue affects GRE packet processing in the ip_tunnel_rcv path.

A vulnerability has been identified in the Linux kernel that has been resolved. The issue concerns the registration of an event handler before the srpt device is fully set up, which may lead to a use-after-free Write error in the srpt_refresh_port() function.

In the Linux kernel, the USB Type-C driver (tipd) function tps6598x_block_read triggers a WARN_ON when given an excessive length, potentially causing a system panic if panic-on-warn is enabled.

In the Linux kernel, the lpfc (SCSI) driver has a list corruption vulnerability in lpfc_drain_txq(). An error handling bug causes jobs to be added to the completions list even without an error, leading to list corruption.

In the Linux kernel, the lpfc SCSI driver has a NULL pointer dereference vulnerability during link down processing. Under certain conditions, it may reference an invalid structure, leading to a crash.

In the Linux kernel, the netfilter module (nft_set_pipapo) has an issue with double destruction of elements. The clone always provides a current view of the lookup table; it should be used to destroy the set, otherwise elements may be destroyed twice.

A vulnerability in the Linux kernel's IP tunnel infrastructure causes perpetual growth of the needed_headroom value, leading to a 16-bit network_header wrap-around and a use-after-free condition during packet processing. This can result in a kernel crash.

In the Linux kernel, the Bluetooth subsystem has a potential use-after-free in hci_error_reset. While handling the HCI_EV_HARDWARE_ERROR event, if the BT controller is not responding, the GPIO reset mechanism can free hci_dev and lead to use-after-free.

In the Linux kernel, a bug was found in wakeup_kswapd() called with an invalid zone index (-1) on NUMA systems without local memory on a node, causing a page fault and system crash.

In the Linux kernel, a vulnerability in the ext4 filesystem was fixed, which could lead to allocating blocks from a group with a corrupted block bitmap. The issue occurred in ext4_mb_try_best_found() during concurrent access, potentially worsening the state of the corrupted filesystem.

In the Linux kernel, the dm-crypt module has an issue with modifying data when using authenticated encryption. To prevent invalid tag generation, data is first copied into a clone bio and then encrypted inside the clone.

In the Linux kernel, the net/sched module (act_mirred) has an issue with overriding the return value if the skb is already lost. If redirecting the skb and tcf_mirred_forward() has not been called, the retcode should be set to SHOT to drop the skb. If tcf_mirred_forward() has been called, the skb is out of control and returning SHOT leads to use-after-free.

In the Linux kernel, the nct6775 hwmon driver has an issue with accessing temperature configuration registers. The number of temperature configuration registers does not always match the total number of temperature registers, which can lead to access errors reported by KASAN (global-out-of-bounds).

In the Linux kernel, the stmmac Ethernet driver has a vulnerability due to lack of mutual exclusion when updating 64-bit statistics counters. On 32-bit platforms, this can lead to lost seqcount updates and permanent blocking of readers, causing system lockups.