Linux kernel vulnerabilities

In the Linux kernel, the crypto: qce driver has an AAD buffer underallocation bug in qce_aead_ccm_prepare_buf_assoclen(). The buffer can be smaller than the length later programmed into the DMA scatterlist, leading to out-of-bounds read by QCE hardware during CBC-MAC computation. The fix adds the maximum AAD header length before alignment.

In the Linux kernel, the crypto: mxs-dcp driver's mxs_dcp_aes_block_crypt() uses sg_dma_len() without mapping the source scatterlist with dma_map_sg() first. This can lead to incorrect data length during encryption/decryption when CONFIG_NEED_SG_DMA_LENGTH=y. The fix uses the original scatterlist length.

In the Linux kernel, the ALSA: usb-audio driver has an out-of-bounds write vulnerability in snd_usbmidi_novation_output(). A malicious USB device can advertise wMaxPacketSize=1, leading to a negative transfer length and writing beyond the buffer. The fix adds a check that the endpoint can hold the header plus at least one payload byte.

In the Linux kernel, a vulnerability in the ALSA usb-audio driver involves incomplete cleanup after a system-resume error. A failed resume can leave the sound card unusable until reboot, and the suspended-interface counter becomes inconsistent, affecting subsequent suspend/resume cycles.

In the Linux kernel, the USB: serial: option driver has a slab out-of-bounds read vulnerability in the interrupt URB callback. The interrupt buffer is allocated based on wMaxPacketSize, and when a device sends a short packet, the code reads beyond the allocated buffer. The fix adds missing bounds checks before accessing data.

In the Linux kernel, the USB: c67x00 driver has a use-after-free vulnerability in c67x00_add_iso_urb(). When TD creation fails for the last packet of an isochronous URB, the URB is given back before updating the endpoint scheduling state, leading to access to freed memory. The fix updates next_frame and cnt before giving back the URB.

In the Linux kernel, a vulnerability in the mt76 driver for mt7925 chipsets fails to ensure adequate headroom in USB/SDIO transmit buffers. Forwarded frames from a wired interface to an mt7925u AP can trigger a kernel panic (skb_under_panic) due to insufficient headroom. The issue affects the transmit path for forwarded frames that do not reserve the required headroom.

A use-after-free vulnerability was found in the Linux kernel's usbfs driver (usbdev_release). The function drops its reference to the usb_device structure before draining the list of completed URBs, which after a disconnect leads to reading freed memory. The issue is reachable by an unprivileged process with access to /dev/bus/usb.

In the Linux kernel's st21nfca NFC driver, the declared length of an ATR_REQ frame was not validated against the actual received length. A nearby attacker can send a short frame with an inflated length, causing an out-of-bounds read that may disclose kernel memory or lead to a denial of service.

In the Linux kernel's NVMe PCIe endpoint subsystem (nvmet pci-epf), a missing CQ reference release on PCI mapping failure leads to memory and controller reference leaks. A remote PCI host can repeatedly trigger this, exhausting resources.

In the Linux kernel's XFS filesystem, the online scrub functionality can livelock if the unlinked inode list contains a loop. There is no cycle detection.

A vulnerability was found in the Linux kernel's Bluetooth RFCOMM subsystem. The rfcomm_sock_recvmsg() function calls rfcomm_dlc_accept() without holding the rfcomm_mutex lock, which can lead to a NULL pointer dereference when a remote peer sends a DISC frame for a deferred setup connection (BT_DEFER_SETUP). The issue is fixed by taking rfcomm_mutex around rfcomm_dlc_accept() and re-checking the session.

In the Linux kernel, the iommu/tegra241-cmdqv driver has a use-after-free vulnerability during teardown. The CMDQ queue is freed before arm_smmu_impl_remove() runs, which then attempts to issue a CMD_SYNC on the freed memory, potentially causing a system crash.

A vulnerability in the Linux kernel's iommu/iommufd subsystem causes a NULL pointer dereference in iommufd_ioas_change_process when racing with iopt_map_file_pages. The issue arises from a window between IOAS area creation and pages pointer assignment, leading to a kernel crash.

In the Linux kernel's ALSA FCP (USB) driver, a shared URB intended for another endpoint was used, leading to initialization errors and potential crashes. A separate URB and proper synchronization initialization were added.

In the Linux kernel, the ALSA driver for 2nd-generation Focusrite Scarlett devices has a vulnerability where a shared URB is used for the notification endpoint, causing initialization to be skipped and cmd_done to remain zeroed. This can lead to a crash in wait_for_completion_timeout() during the init sequence.

In the Linux kernel, the nvmet subsystem's nvmet_execute_identify_nslist() function dereferences a NULL pointer when handling an Identify command with CNS 07h. This occurs because req->ns is not set and then used for comparison.

A memory leak in the Linux kernel's io_uring subsystem for asynchronous commands has been detected. The iovec array is not freed when the command is not recycled and the command cache is full. The issue affects paths related to NVMe passthrough commands.

In the Linux kernel's io_uring/rsrc subsystem, a vulnerability was found in io_vec_fill_bvec() due to an integer overflow when calculating folio size. Using a plain int instead of unsigned long for bit shifting leads to undefined behavior for folio shifts of 32 or more, causing out-of-bounds writes. The issue mainly affects systems with gigantic hugetlb pages (e.g., 16G on arm64).

In the Linux kernel, the OCFS2 filesystem lacks metadata reservation for large extended attributes (xattrs). This can lead to a kernel panic during lsetxattr() on a fragmented filesystem when the file already has an external xattr block.

In the Linux kernel, the ext4 filesystem has a vulnerability causing an infinite retry loop in ext4_xattr_block_set() when selecting a cached extended attribute entry. A corrupted filesystem can cause an entry with a saturated reference count to be selected repeatedly, leading to a task hang and blocking rmdir operations on the parent directory.

In the Linux kernel, the nilfs2 filesystem lacks range validation of parameters in the nilfs_vdesc structure used by the GC ioctl. This can lead to inserting a page with index ULONG_MAX into the page cache, causing list corruption and a crash.

In the Linux kernel, the ext4 filesystem may enable DAX on new encrypted files, causing data written to the file to bypass encryption. This occurs because the EXT4_INODE_ENCRYPT flag is set too late.

In the Linux kernel XFS filesystem, the attribute entry verification function accesses fields before checking whether the entry pointer is within buffer bounds. This can lead to an out-of-bounds read if the nameidx field points near the end of the buffer. Explicit bounds checks for entry pointers have been added before accessing their fields.

In the Linux kernel XFS filesystem, when __xfs_trans_commit() fails in xfs_trans_roll(), the NOFS context is cleared but only restored in the success path. This leaves the error path without nofs protection, causing a circular lock dependency between xfs_nondir_ilock_class and fs_reclaim. The fix moves xfs_trans_set_context() before the error check so that nofs context is always restored on the new transaction.

In the Linux kernel NFC subsystem, the digital_in_recv_sensf_res() function copies data from an NFC-F device response into a fixed-size buffer without checking the upper bound of the length. A malicious nearby NFC-F device can send an oversized SENSF_RES response to overflow the stack buffer. The fix clamps the response length to the maximum allowed size before copying.

In the Linux kernel NFC subsystem for FDP (NXP) controllers, the fdp_nci_i2c_read() function takes the next packet length from two device-supplied bytes and never validates it. This can lead to a stack out-of-bounds write or an skb leak in case of a faulty device. The fix rejects lengths outside the allowed range and frees a previously allocated skb before allocating the next.

In the Linux kernel NFC subsystem for the Microread reader, the microread_target_discovered() function parses target discovery data but does not check whether the skb data length is sufficient for the fields being read. This can lead to out-of-bounds reads or copying data from beyond the buffer. The fix adds length validation for each data type before reading or copying.

A vulnerability was found in the Linux kernel's nfc_llcp_connect_sn() TLV parser in the NFC LLCP subsystem. The parser fails to check buffer boundaries when reading TLV headers and values, leading to out-of-bounds reads or infinite loops due to length underflow for short frames. The issue is remotely reachable by a nearby NFC device without authentication.

The TLV parsers in NFC LLCP (nfc_llcp_parse_gb_tlv and nfc_llcp_parse_connection_tlv) have three bugs: an u8 offset wraps after 255, missing bounds checks before reading the TLV header and data, leading to out-of-bounds reads. These functions are reachable without authentication via nfc_llcp_set_remote_gb.

The NFC LLCP receive path did not check that a frame is at least the LLCP header size before parsing. Short frames cause the size calculation to wrap, leading to out-of-bounds reads. This is reachable without authentication from a nearby NFC device.

In the pn533 NFC driver, the cleanup path did not purge fragment_skb, leading to memory leaks when the device is removed while fragments are still queued.

The NCI activation parameter extractors (nci_extract_activation_params_iso_dep and nci_extract_activation_params_nfc_dep) lack length checks before memcpy, allowing a crafted notification to cause a slab out-of-bounds read.

In the Linux kernel's NFC (NCI) subsystem, a vulnerability was found involving an out-of-bounds write in the nci_target_auto_activated() function. This function adds a target to a fixed-size array without checking if the array is full, which can lead to a write beyond the allocated memory region (slab out-of-bounds).

In the NCI RF discover and activated NTF handlers, on-stack structures are not initialized, and when the technology-specific parameter length is zero, uninitialized data is passed to nci_add_new_protocol, leading to an uninit-value read.

In ip_do_fragment(), undersized MTUs were not rejected, causing fragmentation to loop and eventually trigger a softlockup. The issue occurs when the effective MTU is smaller than hlen + 8.

In ip6_finish_output2(), a pointer to the IPv6 destination address is cached before invoking lwtunnel_xmit(), which can reallocate the skb head and free the memory. After LWTUNNEL_XMIT_CONTINUE, the stale pointer is used, leading to a use-after-free.

In nvmet_execute_auth_receive(), the response buffer is allocated with kmalloc() and not zeroed, and only part of it is filled by DH-HMAC-CHAP. Uninitialized data is sent to the initiator during the pre-authentication handshake.

In nvmet_fc_alloc_ls_iodlist(), the error unwind loop decrements iod past the start of the array, and the final kfree(iod) frees an invalid address, leading to an invalid free.

In the Linux kernel's NVMe-over-TCP subsystem (nvmet-tcp), a vulnerability allows unbounded kernel memory allocation. An attacker can send a crafted write command with an oversized SGL length (up to 4 GiB) that is not properly validated before buffer allocation, leading to uncontrolled memory consumption.

In the Linux kernel, a use-after-free vulnerability was found in the NVMe over Fabrics (nvmet) subsystem for PCIe Endpoint controllers (pci-epf). The function nvmet_pci_epf_exec_iod_work() reads iod->data_len and iod->dma_dir after calling req->execute(), but for commands without device-to-host data transfer, the iod can be freed asynchronously on another CPU before those fields are read, leading to a use-after-free.

A vulnerability in the Linux kernel's MPTCP subsystem causes a memory leak due to a race between socket teardown and concurrent userspace PM ANNOUNCE handling. The issue stems from improper synchronization in mptcp_pm_destroy() and allocation paths, leading to lost list entries and memory leaks.

In the Linux kernel's HID magicmouse driver, a vulnerability allows unbounded recursion in magicmouse_raw_event(). A malicious HID device can send a report with the sequence [0xf7, 0x00], causing thousands of nested calls and kernel stack overflow. The fix bounds recursion depth to two levels.

In the Linux kernel's HID magicmouse driver, a use-after-free vulnerability was found. If input device registration fails, the msc->input pointer remains non-NULL, leading to dereferencing freed memory on subsequent reports. The fix clears the pointer when no input device is claimed.

In the Linux kernel HID subsystem, a vulnerability was found involving an out-of-bounds read in hid_set_field(). The issue arises because hid_dump_input() is called before the offset bounds check, which with CONFIG_DEBUG_FS enabled can lead to reading beyond the allocated usage[] array. The bug was reported by XBOW and affects e.g. the picolcd driver.

In the Linux kernel, the HID PIDFF driver (hid_pidff) has a vulnerability involving an out-of-bounds write when the hid->inputs list is empty. The function hid_pidff_init_with_quirks() derives a pointer to hid_input without checking if the list is empty, leading to a type-confused pointer and writes past the end of the object. An attacker can trigger the vulnerability by plugging in a malicious USB device, with no user interaction or logged-in user required.

In the Linux kernel, the net/ionic driver has a vulnerability involving an out-of-bounds read when looking up the TX partner for the dedicated hardware timestamp RX queue. This queue has an index equal to the number of regular queue pairs, causing a read past the txqcqs array and a write through the derived pointer. The fix avoids pairing this queue and makes the XDP_TX path abort cleanly if no TX partner exists.

In the Linux kernel's futex/pi mechanism, there is a vulnerability where a private futex owner from a different address space is accepted. The private futex key borrows the waiter's mm without taking an mm_users reference, and attach_to_pi_owner() copies the key into the owner's PI state. When the owner exits, a use-after-free can occur if the waiter's mm is freed concurrently. The fix adds validation that for private futexes, the owner's mm and waiter's mm are the same.

In the Linux kernel's futex/pi mechanism, there is a race condition during exec() for private futexes. There is a window between setting exit_state to OK and changing the mm pointer where the mm check is incorrect, potentially leading to use-after-free. The fix sets exit_state to FUTEX_STATE_DEAD in futex_exec_release() and only sets it to FUTEX_STATE_OK after the mm switch.

A race condition in futex_pivot_pending() during private hash resize in the Linux kernel can leave a task blocked in uninterruptible sleep indefinitely, leading to a hung-task detection and kernel panic.