Linux kernel vulnerabilities

A NULL pointer dereference vulnerability exists in the Linux kernel's drm/amdkfd driver within the pqm_debugfs_mqds function. Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue causes dereference of an uninitialized mqd_mgr pointer, because the loop calling mqd_mgr->debugfs_show_mqd() is placed outside the if (pqn->q) block. This leads to a kernel crash (oops) and denial of service.

A bug was fixed in the Linux kernel's drm/pagemap module in the drm_pagemap_migrate_populate_ram_pfn() function. Higher-order folio allocations lacked the __GFP_NOWARN flag and a fallback path, and in the free_pages error path the folio order was computed after put_page() had already dropped the reference, leading to a use-after-free. The source page array construction was also corrected to ensure full copying after demotion to order-0 folios.

In the Linux kernel, the drm/nouveau/uvmm driver fails to clear the dirty flag when unwinding an OP_UNMAP_SPARSE operation. If a later op in the job fails, the region remains in the tree with dirty set and its completion is never signalled. Subsequent binds over that range then fail permanently with -ENOENT, -EINVAL, or an unkillable wait_for_completion() in bind_validate_region().

In the Linux kernel, ksmbd compound response handling extends the last response iov to an eight-byte boundary. smb2_read_pipe() allocates only the payload size, so the alignment padding can expose up to seven bytes of uninitialized kernel heap memory. The fix allocates the aligned size and clears the unused tail before pinning the response buffer.

In the Linux kernel, in the xhci: dbgtty driver, if tty_register_driver() fails, it drops the reference but fails to set the global dbc_tty_driver to NULL, causing the unregister to be called again when the module exits. This leads to a use-after-free condition.

In the Linux kernel, in the crypto: qcom-rng module, the random number generator does not allow zero as an output, making its output distinguishable from truly random. Zero is a valid random number and should be allowed.

In the Linux kernel, in io_uring, eventfd signaling is done inline when adding the first entry to the work list, which can cause issues when the addition is done from a wakeup handler context. The fix adds the IOU_F_TWQ_IN_WAKE flag to force deferral of signaling via call_rcu_hurry() instead of inline signaling.

In the Linux kernel, a vulnerability was found in the amdgpu driver where amdgpu_devcoredump_format() recursively acquires a ww_mutex lock. This can lead to a deadlock when dumping IB contents from a hung job. The fix moves the operation to a separate helper using a single drm_exec context.

In the Linux kernel, in HID: core, there is a number/pointer type confusion on long items. When fetch_item() is called by hid_scan_report() on an item with HID_ITEM_TAG_LONG, it stores a pointer to the item data in item->data.longdata instead of storing a value directly. Functions item_udata() and item_sdata() incorrectly assume short format, leading to the lower part of a kernel pointer being printed as a number in dmesg.

A vulnerability in the Linux kernel causes a NULL pointer dereference in the PCI host-generic driver on 32-bit systems using CAM mode. During PCI bus enumeration, the first config read uses an uninitialized mapping, leading to a kernel panic. The issue stems from missing add_bus/remove_bus callbacks in the CAM operations, which are necessary for proper mapping of the config space.

A vulnerability in the Linux kernel's KCOV mechanism causes data corruption and race conditions on PREEMPT_RT systems. The issue stems from storing temporary KCOV state in per-CPU areas, which can be overwritten by nested softirq preemption. Additionally, under certain initialization conditions, it may lead to kernel panic or memory leaks.

In the Linux kernel, the drm/xe driver's DPT allocation paths were fixed. The fallback from VRAM to system memory was removed as it did not work and caused black screen with pipe faults. Also, stolen memory usage is avoided due to latency and risk of random system hangs under load.

In the Linux kernel, a vulnerability in the msm serial driver was fixed by disabling DMA for the console UART. Concurrent writes from userspace and the kernel can trigger a race condition resulting in an infinite loop of the same messages. The fix disables DMA for the console UART to ensure a reliable output path.

In the Linux kernel, a fix was made for an uncancelled rxrpc OOB message handler in AFS. The fix cancels OOB message processing (typically to respond to security challenges) and moves it to afs_wq so it is also waited for. The OOB handler now returns if the net namespace is no longer live.

In the Linux kernel, a fix was made in the Tegra crypto driver to return ENOMEM when input buffer allocation fails for ccm. The fix ensures the ENOMEM error value is set when the allocation fails in tegra_ccm_do_one_req.

In the Linux kernel, a fix was made in the OCFS2 filesystem regarding buffer head management in ocfs2_read_blocks(). The fix clarifies that the caller should not assume that the buffer head returned by sb_getblk() is exclusively owned and that put_bh() always drops b_count from 1 to 0. To avoid a scenario where a buffer head remains on hold and may be returned with BH_Uptodate set despite previous validation failure, BH_Uptodate is now cleared immediately after the validate() callback detects data inconsistency.

In the Linux kernel, the IB/mlx5 driver has a vulnerability related to implicit ODP and rereg_mr operation. Due to child mkeys in the implicit ODP configuration, nothing can be changed in place for the parent mkey, so the whole structure must be rebuilt. Additionally, a race condition involving access to mr->pd by child keys was removed.

A circular locking dependency was found in the Linux kernel's OCFS2 filesystem during direct I/O write completion. The ocfs2_dio_end_io_write function could deadlock due to improper lock ordering involving system inodes (INODE_ALLOC, EXTENT_ALLOC, ORPHAN_DIR). The fix releases allocation contexts before acquiring the ORPHAN_DIR lock.

In the Linux kernel, the AFS filesystem has a memory leak related to the vllist in afs_update_cell(). When the new list is empty (nr_servers == 0), the old list is not replaced, leading to a leak of the new list.

A vulnerability was found in the Linux kernel's ring buffer mechanism used by ftrace. When RB_FORCE_8BYTE_ALIGNMENT is enabled (e.g., on riscv64 with CONFIG_HAVE_64BIT_ALIGNED_ACCESS), ring_buffer_event_length() incorrectly calculates the length of small events, reporting a data length 4 bytes larger than expected. This causes inconsistent results in ftrace tests (trace_marker_raw).

In the Linux kernel, the IPVS module has a vulnerability in TCP state handling. The code reparses the packet to find the TCP header, using sizeof(struct ipv6hdr) for IPv6, while the actual transport header offset is already known from ip_vs_fill_iph_skb(). For IPv6 packets with extension headers, this leads to reading the wrong bytes.

In the Linux kernel, the DTS file for the Renesas Ironhide platform lacks descriptions of memory areas reserved for the DBSC5 DRAM controller with inline ECC. If these areas are not properly reserved, Linux may use and corrupt the memory used by the controller, leading to system instability.

In the Linux kernel, KVM for arm64 has a vulnerability where ESR_EL2 is not written when injecting nested SError exceptions. The kvm_inject_el2_exception() function writes ESR_EL2 for synchronous exceptions but not for SError, causing the L2 guest to observe a stale ESR_EL2.

In the Linux kernel, the ALSA HDA driver for TAS2781 has a vulnerability where the asynchronous firmware request is not cancelled during unbind. This can lead to a situation where the firmware callback operates on state that is being torn down, potentially causing errors or races.

In the Linux kernel, the Xilinx TRNG cryptographic driver removed the crypto_rng interface because it was not used. The removal eliminates bugs such as returning success without filling all bytes and the possibility of concurrent execution of xtrng_trng_generate() and xtrng_hwrng_trng_read(), which could interfere with each other.

In the Linux kernel's amdkfd driver, the CRIU restore flow did not properly validate user-supplied IDs before passing them to idr_alloc. IDs larger than INT_MAX can trigger a WARN in the IDR layer, potentially causing a panic or reboot if panic_on_warn is enabled.

In the Linux kernel's NTFS filesystem, the ntfs_read_inode_mount() function improperly validates attribute-list entries during mount. A short entry with attacker-controlled length can cause an out-of-bounds read when the attribute list size is a multiple of the sector size.

In the Linux kernel's NTFS3 filesystem, the allocation of inline_data used kmemdup, which did not guarantee page alignment. This caused a BUG in iomap_write_end_inline when the inline data validity check failed. The fix allocates with alloc_page to ensure page alignment.

In the Linux kernel for the Alpha architecture, pci_mmap_resource() did not check security_locked_down(LOCKDOWN_PCI_ACCESS) before allowing userspace to mmap PCI BARs. The generic version has this check to prevent DMA attacks when the kernel is locked down.

In the Linux kernel's BPF subsystem, copy_user_syms used __get_user without a prior access_ok call on the user space pointer. This missing check could lead to improper memory access. The fix adds the missing access_ok call for the whole pointer array and simplifies the error path.

In the Linux kernel, the RDMA/rxe subsystem has a use-after-free vulnerability when modifying the IB_QP_MAX_DEST_RD_ATOMIC attribute. A local unprivileged user can race the free/realloc to cause a use-after-free in rxe_receiver(), leading to a local denial of service.

In the Linux kernel, in the RDMA/rxe subsystem, a vulnerability was found involving an out-of-bounds read/write in the free_rd_atomic_resources() function. The issue arises from updating the max_dest_rd_atomic attribute before freeing the old array, causing the freeing loop to walk past the allocated area, which can lead to memory corruption (detected by KASAN).

In the Linux kernel, the nvme-tcp driver has an issue with incorrect usage of page_frag_cache in a multi-threaded environment, leading to incorrect refcounting and premature free of pages. This can cause network warnings and random system panics.

In the Linux kernel, the FUSE filesystem has an invalidate lock leak on writeback failure in fuse_do_setattr(), which can block subsequent file operations.

In the Linux kernel, the FUSE filesystem leaks a write lock (rwsem) during an open with O_TRUNC for DAX files when fuse_dax_break_layouts() fails (e.g., -ERESTARTSYS). This causes later operations on the file to stall due to the unreleased lock.

In the Linux kernel, the USB gadget f_tcm driver has an issue where the port count (tpg_port_count) is decremented before LUN teardown completes, potentially leading to a race and use-after-free during session removal. An optional fabric_post_unlink() callback is added to keep the port count until core_dev_del_lun() finishes.

In the Linux kernel KVM subsystem for AMD SEV/SEV-ES on SNP-enabled hosts, the temporary buffer used for memory encryption/decryption operations was not allocated as a full 4KiB page. On SNP platforms, the page containing the buffer must be temporarily assigned to firmware, causing access by other kernel parts to trigger an RMP #PF fault, leading to a kernel panic.

A vulnerability in the Linux kernel's TLS device offload (tls_device.c) causes an out-of-bounds write in tls_append_frag(). When a TLS record remains open with a full fragment count and subsequent splice() calls with SPLICE_F_MORE add non-coalescing pages, the frags array is overrun, corrupting memory including a function pointer in destruct_work, which can lead to arbitrary code execution.

A use-after-free vulnerability was found in the Linux kernel's tcp_ao_connect_init() function related to TCP-AO. A race between key validation and VRF membership change can lead to removal of the only key and subsequent direct freeing of tp->ao_info, while the receive path may still use the pointer. The issue was found during a static audit and confirmed by a reproducer triggering a KASAN report.

A use-after-free vulnerability was found in the Linux kernel's TCP-AO (TCP Authentication Option) module. The issue occurs during reconnection to another peer, where the current_key pointer may reference freed memory after call_rcu().

In the Linux kernel, the xfrm (ESP-in-TCP) module has a use-after-free (UAF) bug during close of espintcp sockets. espintcp_close() frees the skb without holding any socket lock, while the xfrm_trans_reinject work queue may still use the same skb. The fix adds synchronize_rcu() after resetting sk_prot.

In the Linux kernel, the xfrm (ESP-in-TCP) module has an issue with packets that have no ingress device. When the ingress device is removed, dev_get_by_index_rcu() returns NULL, leading to a NULL dereference in the XFRM input path. The fix drops such packets.

A deadlock vulnerability was found in the Linux kernel's xfrm NAT keepalive mechanism. The nat_keepalive_work() function walks the state table while holding xfrm_state_lock, then acquires x->lock in its callback, conflicting with the delete path that takes these locks in reverse order, causing an AB-BA deadlock. The fix splits the walk into two phases: first collect candidate states with references, then process them without nesting locks.

In the Linux kernel's AH6 (IPsec) subsystem, there is an out-of-bounds read vulnerability. The ipv6_rearrange_rthdr() function assumes that the segments_left field in the routing header does not exceed the number of addresses described by hdrlen. However, for raw IPv6 HDRINCL packets, a packet with hdrlen=2 (describing one address) and segments_left=255 can be sent, causing the address pointer to move 4064 bytes backwards and passing a 4064-byte length to memmove(), leading to out-of-bounds access. The fix adds validation of this invariant before modifying the header.

In the Linux kernel's xfrm_state_construct() function, there is a memory leak related to the authentication algorithm. The attach_auth_trunc() function can allocate memory for x->aalg but does not set x->props.aalgo when the selected algorithm has no sadb_alg_id (e.g., cmac(aes)). Then xfrm_state_construct() treats the zero value of x->props.aalgo as no algorithm and calls attach_auth(), which overwrites the x->aalg pointer and loses the original allocation. The fix checks whether x->aalg is already attached instead of inferring from x->props.aalgo.

A use-after-free vulnerability was found in the Linux kernel's bridge multicast code for master VLANs. During master VLAN deletion, the BR_VLFLAG_MCAST_ENABLED flag is not cleared under lock, allowing readers (bridge transmit path) to re-arm the multicast context after it has been deinitialized and freed, leading to access of freed memory.

In the Linux kernel's IPv6 Segment Routing (seg6) module, during IPIP decapsulation (End.DX4, End.DT4), the IPv4 control block (IPCB) is not cleared. This causes IPv4 to use stale IP6CB data, leading to an out-of-bounds read in __ip_options_echo() and potential memory corruption (KASAN: slab-out-of-bounds).

In the Linux kernel's batman-adv module, there is an out-of-bounds read vulnerability. The batadv_tvlv_call_handler() function sets the network_header and transport_header fields in the sk_buff structure based on a received multicast TVLV, without checking whether the end offset is representable in a 16-bit field. If the offset exceeds the range, skb_set_transport_header() truncates it, causing the transport header to precede the network header, and skb_network_header_len() returns a large u32 value. The batadv_mcast_forw_packet() function then accepts an oversized multicast tracker and accesses memory beyond the skb data. The fix adds the skb_set_transport_header_careful() function and rejects unrepresentable TVLVs.

In the Linux kernel's vxlan module, there is a vulnerability involving an invalid pointer during FDB flush operations. When a filtered bulk flush removes all remotes from an FDB entry, the last remote is unlinked in vxlan_fdb_dst_destroy() and only afterwards the parent FDB entry is destroyed. During this interval, an RCU reader can find the parent entry, and first_remote_rcu() applies list_entry_rcu() to the empty list head, producing an invalid remote pointer that the receive learning path can read from and write to. The fix leaves the last remote linked and asks the caller to destroy the entire FDB entry.

In the Linux kernel, the crypto_rng interface was removed from the qcom-rng driver because it was redundant and buggy. The driver exposed the same hardware through two separate interfaces, which could lead to concurrent register access and generation of incorrect random values. The hwrng interface remains active and is the one that matters.