Linux kernel vulnerabilities

In the Linux kernel, a vulnerability in the libceph library can lead to incorrect data interpretation during a short read from the socket. The read_partial_sparse_msg_data() function may invoke the OSD client state machine, leading to bogus data. The fix reuses cursor->total_resid to determine whether to bail and wait for more data.

In the Linux kernel netfilter nftables exthdr module, there is a 4-byte stack out-of-bounds write vulnerability. If priv->len is a multiple of 4, writing to dst[len / 4] can go past the destination array, causing stack corruption.

In the Linux kernel, NFSv4 fixed a NULL pointer dereference in pnfs_mark_matching_lsegs_return(). The function did not check if the struct pnfs_layout_range argument had a value before dereferencing it, causing an oops.

In the Linux kernel, the mt7530 DSA driver has a vulnerability causing VLAN traffic leaks. The PCR_MATRIX field is not reset when VLAN filtering is disabled, which may lead to unintended traffic forwarding between bridges.

A data-race vulnerability was found in the Linux kernel's ipv6_mc_down / mld_ifc_work functions for IPv6 multicast. The idev->mc_ifc_count field can be written without proper locking, leading to undefined behavior.

In the Linux kernel, a vulnerability related to buffer overflow in the trans_stat_show() function has been fixed. The use of snprintf has been changed to the more secure scnprintf, and conditions checking for exceeding PAGE_SIZE have been added.

In the Linux kernel, the MPTCP protocol has a corruption of the sk_forward_memory field during retransmission. This field is protected by the msk socket spin_lock, but a code path updates it without that lock, potentially leading to data corruption.

In the Linux kernel's NVMe over Fabrics (nvmet) subsystem, there is a bug where it attempts to free p2p memory that was not allocated from the p2p pool. When a p2p device is found but the pool is empty, the NVMe target tries to free the SGL from the p2p pool instead of the regular pool, causing a crash (BUG). The fix assigns p2p_dev only if the memory was actually allocated from the p2p pool.

In the Linux kernel neighbour module, there is a vulnerability where NUD_NOARP entries cannot be forced to be garbage collected. Point-to-point interfaces use NUD_NOARP entries for IPv6, which can fill up the neighbour table and prevent valid connections.

In the Linux kernel, a vulnerability in the cachestat mechanism was fixed, involving use-after-free of a folio during page cache walk. Lack of holding a reference to the folio could lead to concurrent release and reuse of the object.

In the Linux kernel, the iwlwifi driver has a vulnerability leading to memory corruption. The issue is copying data to the data pointer in the iwl_fw_ini_trigger_tlv structure with an offset in bytes, which can write past the buffer.

In the Linux kernel, an alignment check was added for the event ring read pointer in the MHI host driver. Lack of alignment could lead to DoS or ring buffer memory corruption.

In the Linux kernel, the media mtk-jpeg driver has a use-after-free bug due to error path handling in mtk_jpeg_dec_device_run. If an error occurs in mtk_jpeg_set_dec_dst, the timeout worker may be started and the job marked as finished, leading to use-after-free when removing the module or closing the file descriptor.

In the Linux kernel, the JFS filesystem has a use-after-free vulnerability in jfs_evict_inode. When diMount(ipimap) fails, the released ipimap object may be accessed in diFreeSpecial(). Therefore, sbi->ipimap should not be initialized as ipimap when diMount fails.

In the amdgpu driver in the Linux kernel, a potential NULL pointer dereference in amdgpu_ras_query_error_status_helper() was fixed. The function now returns -EINVAL for invalid block IDs.

In the Linux kernel, the Ceph filesystem has an incorrect lock order between a directory entry and its parent, leading to a deadlock or dead code. The fix removes the unused code.

In the Linux kernel, the Marvell Prestera network driver has a vulnerability due to incorrect structure access. The code accesses the upper_dev field, which is relevant only for specific events, leading to invalid memory access.

In the Linux kernel, the mm subsystem has an issue where large anonymous mappings are forced to align on THP boundaries on 32-bit systems. This forcing is not sensible on 32-bit systems due to constrained virtual address space and causes reported problems.

In the Linux kernel, the mac80211 subsystem has a potential key use-after-free vulnerability. When ieee80211_key_link() returns 0 due to KRACK protection, ieee80211_gtk_rekey_add() still returns a pointer to the key, which may lead to use of freed memory.

In the Linux kernel, the neigh_periodic_work() function lacked an annotation when deleting an RCU-protected item from a list, which could lead to store tearing. The fix adds rcu_assign_pointer() on the writer side.

In the Linux kernel's RDMA/siw subsystem, a vulnerability exists in connection failure handling. When immediate MPA request processing fails, the new endpoint unlinks the listening endpoint, and later TCP socket close causes a NULL dereference in siw_cm_work_handler(). The fix cancels the useless MPA timeout and simplifies MPA processing.

In the Linux kernel on LoongArch architecture, a vulnerability causes a system panic during initialization when DEFERRED_STRUCT_PAGE_INIT is enabled. The issue stems from incorrect node id assignment to reserved memory blocks, leading to a NULL pointer dereference in reserve_bootmem_region(). The fix assigns all reserved memory blocks to Node#0 during initialization.

In the Linux kernel, the Ceph filesystem fails to drop messages from MDS during unmount, causing inodes to be held with ihold. With encryption enabled, this triggers a warning when removing keys and later a kernel crash when releasing inodes after superblock destruction.

In the Linux kernel, the EROFS filesystem has a vulnerability in LZ4 in-place decompression that can lead to data corruption. The issue arises from uncertain buffer ordering when mapping two separate virtual buffers, exposed on new Intel x86 processors with FSRM feature.

In the Linux kernel, the AMD Display driver (drm/amd/display) did not wake the DMCUB before sending commands, which could cause a system hang. The fix adds waking DMCUB before command submission.

In the Linux kernel, a workaround for ARM Cortex-A520 erratum 2966298 was added. On affected cores, speculatively executed unprivileged loads might leak data from privileged loads via a cache side channel. The workaround executes a TLBI before returning to EL0.

In the Linux kernel, the ksmbd module has a use-after-free vulnerability in the smb20_oplock_break_ack function, involving the use of opinfo after the reference is dropped. This could lead to incorrect behavior or potential exploitation.

In the Linux kernel's mt76/mt7915 driver, an issue with txrate reporting was found. Improper checking of the rate_info structure led to unexpected reports, which could cause errors in bandwidth calculations.

In the Linux kernel, the ath10k driver has a use-after-free vulnerability in ath10k_htc_send_bundle. The bundle_skb variable may be freed, but later used to read the len field.

In the Linux kernel's xprtrdma (RPC-over-RDMA), after a reconnect, the reply handler opens the congestion window (cwnd) before enough Receive WRs are posted, causing an RNR error and immediate connection loss.

A vulnerability has been identified in the Linux kernel that has been resolved. It concerns the atomisp_alloc_css_stat_bufs() function, where a double free and use after free issue occurs.

In the Linux kernel's CIFS client, the smb2_get_enc_key function returns an incorrect error code, leading to a warning in errseq_set. The issue occurs when the encryption key cannot be obtained, and the error propagates to the write path, generating unnecessary warnings.

In the Linux kernel, the sfc (farch) network driver has a bug in TX event handling, where the TX queue lookup is incorrect. The function efx_channel_get_tx_queue() is used with a TXQ label instead of a type, which can return NULL and cause a panic.

In the Linux kernel, the i2c subsystem has a potential use-after-free. The adap structure is freed before it is done being used, which can lead to accessing freed memory.

In the Linux kernel, the ext4 filesystem has a vulnerability where the buddy bitmap is not regenerated after block freeing fails during fast commit replay. This can lead to corruption of the buddy bitmap and subsequent allocation errors.

In the Linux kernel, the AMD PM driver has a use-after-free vulnerability in kv_parse_power_table. When the allocation of ps by kzalloc returns NULL, the function frees adev->pm.dpm.ps, but later in the call chain kv_dpm_fini uses this freed memory in a loop, leading to use-after-free.

In the Linux kernel's nvmet-tcp subsystem, a vulnerability causes a kernel panic when a host sends an H2CData command with an invalid DATAL length. The issue leads to a NULL pointer dereference in nvmet_tcp_build_pdu_iovec(). The fix raises a fatal error if DATAL is not coherent with the packet size and ensures PDU length does not exceed MAXH2CDATA.

In the Linux kernel, a vulnerability in the UIO subsystem was fixed, involving use-after-free in uio_open. The issue occurred during device unregistration when another process could access already freed memory, potentially leading to double free.

In the Linux kernel, in the f2fs filesystem, when setting an extended attribute (xattr), the xattr list was not explicitly null-terminated. This removes the fragile assumption that unused xattr space is always zeroed.

In the Linux kernel, in the ext4 filesystem (file super.c), there is a use-after-free flaw in __ext4_remount. This occurs when freeing old quota file names before a potential failure, leading to an information leak.

A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on.

An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileges on the system.

A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel's SCTP subsystem. Guests with local user privileges can trigger a deadlock and potentially crash the system.

In the Linux kernel, in the SMB client sub-component (file smb2ops.c), there is an out-of-bounds memory read flaw in receive_encrypted_standard. This issue is caused by an integer underflow on the memcpy length, leading to a denial of service.

In the Linux kernel, the blkgs destruction path in block/blk-cgroup.c causes a cgroup blkio memory leak. A circular dependency prevents freeing blkcg and blkgs after they are offline, potentially leading to system instability like out-of-memory errors.

A heap out-of-bounds write vulnerability exists in the Linux kernel's Performance Events component. The read_size field of a perf_event can overflow, leading to an out-of-bounds write in perf_read_group().

An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This could allow a local attacker to crash the system or leak internal kernel information.

An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.

A use-after-free vulnerability exists in the af_unix component of the Linux kernel, exploitable for local privilege escalation. The unix_stream_sendpage() function adds data to the receive queue without locking, leading to a race with the garbage collector and use of a freed skb.

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component is caused by a race condition between netlink control plane transaction and nft_set element garbage collection. Reference counter underflow leads to use-after-free, exploitable for local privilege escalation.