Linux kernel vulnerabilities

A race condition was found in the Linux kernel during the initial allocation of mm->futex.phash.ref. In certain nested vfork scenarios, two processes sharing the same address space can concurrently allocate and overwrite this counter, leading to a use-after-free in futex_q_lock().

In the Linux kernel's HID driver for ASUS devices, there is a missing hid_is_usb() check before using to_usb_interface(). This can lead to invalid memory access when the HID device does not have a real USB parent, potentially causing a kernel splat. The fix adds the appropriate check.

In the Linux kernel's HID driver for Huawei devices, there is a missing hid_is_usb() check before using to_usb_interface(). This can lead to invalid memory access when the HID device does not have a real USB parent, potentially causing a kernel splat. The fix adds the appropriate check.

In the Linux kernel's HID driver for Nintendo devices, there is an out-of-bounds read vulnerability in joycon_ctlr_read_handler(). The function casts an incoming HID report to struct joycon_input_report, guarding only with a 12-byte length check, while the structure is 49 bytes. For an IMU report of exactly 12 bytes, it can read past the declared length, and the data is forwarded to userspace, leaking driver-internal memory. The fix applies the full structure size check.

In the Linux kernel's HID driver for Nintendo devices, there is a vulnerability where the input device is registered before all capabilities are set. input_register_device() exposes the device to userspace immediately, and calling it before configuring FF_RUMBLE can lead to NULL dereference on concurrent EVIOCSFF. The fix moves registration to the end of joycon_input_create(), after all capabilities are configured.

In the Linux kernel's HID driver for Nintendo devices, there is a use-after-free vulnerability during failed probe. nintendo_hid_probe() calls hid_device_io_start() before joycon_init() and joycon_leds_create(). If either fails, the error path calls hid_hw_close()/hid_hw_stop() without first calling hid_device_io_stop(), allowing HID reports to still be processed and access driver data being torn down. The fix adds an err_io_stop label that calls hid_device_io_stop() before hid_hw_close().

In the Linux kernel, the HID rapoo driver lacked a hid_is_usb() check before using to_usb_interface(). uhid devices can be identified as USB but not have a USB parent, leading to a kernel crash.

In the Linux kernel, the HID ft260 driver has a stack-use-after-return write during I2C read operations. A race between the read path and ft260_raw_event() can lead to a write to freed stack memory.

In the Linux kernel, the HID sensor custom driver has a use-after-free vulnerability in enable_sensor. Field attributes are created after exposing the enable_sensor sysfs attribute, and on removal enable_sensor is deleted after freeing the field attributes.

A use-after-free vulnerability was found in the Linux kernel's uclogic HID driver. The issue involves the inrange_timer which can be re-armed after cancellation during device removal, leading to a dereference of freed memory when the timer expires.

In the Linux kernel, the HID hyperv driver lacks bounds validation for initial device info. A malicious Hyper-V host or backend can send a short message with an oversized report descriptor length, leading to an out-of-bounds read past the VMBus packet.

A use-after-free vulnerability was found in the Linux kernel's Bluetooth subsystem (hci_event). The hci_cc_reset() function clears the LE accept and resolving lists without holding hdev->lock, allowing a concurrent debugfs read to access freed memory. KASAN reported the issue as slab-use-after-free in white_list_show.

In the Linux kernel, the Bluetooth hci_event handler lacks validation of the LE Set CIG Parameters response. The function hci_cc_le_set_cig_params() trusts the num_handles value and reads entries from the array without checking that the response contains enough data.

A use-after-free vulnerability was found in the Linux kernel's Bluetooth subsystem (hci_sync) during system suspend. The issue stems from improper synchronization of access to the accept list, potentially leading to a reference to freed memory.

In the Linux kernel, the Bluetooth ISO function iso_sock_getname() does not zero the sockaddr structure before returning it to user space, leaking uninitialized bytes from the kernel stack.

In the Linux kernel, the Bluetooth MGMT handler lacks an upper bound for params_len in HCI_CMD_SYNC. params_len can exceed 255, leading to a mismatch with the plen field in the HCI header and potentially causing the controller to interpret trailing bytes as the start of the next packet.

In the Linux kernel, the Bluetooth hci_aml driver's aml_download_firmware() function reads two lengths from the firmware header and uses them to build pointers before checking that the header and segment data are present. A truncated or inconsistent firmware image can cause the driver to read past firmware->data while constructing TCI commands. The fix rejects images shorter than the header and ensures that the ICCM and DCCM ranges fit within the loaded firmware.

In the Linux kernel, the futex mechanism has a use-after-free vulnerability in futex_private_hash_put(). This function drops the reference to fph before reading fph->mm for wake_up_var(). If that put drops the final reference and the task is preempted, another task can pivot to the replacement hash and free the old hash after an RCU grace period, and the first task reads from freed memory. The fix loads the mm pointer while the fph reference is still held and passes the saved value to wake_up_var().

In the Linux kernel's drm/panthor driver, panthor_fw_load_section_entry() skips BO creation for zero-sized firmware sections but adds them to the section list, leading to NULL pointer dereference in later paths. The fix skips adding such sections to the list.

In the Linux kernel powerpc/pseries papr-phy-attest, missing validation of cmd.length could lead to buffer overflow. The fix adds length checks and fixes memory leaks on error paths.

In the Linux kernel Synaptics RMI4 driver (F54), worker errors were not propagated to the V4L2 queue, causing stale or uninitialized data to be delivered to userspace. The fix adds error checking and marks buffers as error state.

In the Linux kernel, the hynitron_cstxxx driver improperly validated touch count and finger IDs. This can lead to corrupted touch state or out-of-bounds buffer access.

In the Linux kernel, the gve driver lacks an implementation of adjfine, leading to a NULL pointer dereference when triggered from userspace, e.g., via testptp.

A use-after-free vulnerability was found in the Linux kernel's gpio-sloppy-logic-analyzer driver. The 'trigger' debugfs file lacked proper protection, allowing a write to freed memory during device unbind. The issue was fixed by using debugfs_create_file() instead of debugfs_create_file_unsafe().

In the Linux kernel, the amdgpu driver for AMD Display has a NULL pointer dereference in amdgpu_dm_crtc_set_vblank() when vblank is enabled or queried before a stream is attached to acrtc_state->stream. This can lead to a system crash.

In the Linux kernel XFS filesystem, during directory tree repair, a self-referential directory may be detected. In such a case, the repair code attempts to lock the same inode twice (double iolock/ilock), leading to a deadlock. The fix detects this corner case and handles it appropriately.

In the Linux kernel XFS filesystem, during AGI repair, the function xrep_iunlink_walk_ondisk_bucket may attempt to use the pointer sc->sa.agi_bp, which can be null if the buffer verifier fails. The fix uses ragi->agi_bp instead, which skips verifier checks, to avoid walking off the end of memory.

In the Linux kernel XFS filesystem, during online fsck, the function xrep_iunlink_resolve_bucket is still vulnerable to infinite loops coming from next_unlinked pointers. The fix remembers which inodes have already been seen and checks new agino pointers against that to detect loops.

In the Linux kernel XFS filesystem, the function xlog_recover_dquot_commit_pass2() validates the recovered dquot with xfs_dqblk_verify(). On failure, it sets error = -EFSCORRUPTED and jumps to out_release, but out_release unconditionally returns 0, so the error is discarded. This allows a corrupt quota buffer to be written back to disk.

A vulnerability in the Linux kernel's ASoC SOF subsystem affects IPC payload handling for copier widgets. After suspend/resume, the ipc_config_data buffer is not refreshed, causing stale DMA channel assignments to be sent to firmware, leading to errors and crashes. The fix refreshes copier_data and dma_config_tlv before sending the IPC message.

In the Linux kernel's rseq mechanism, rseq_grant_timeslice_extension() calls hrtimer_rearm_deferred_tif() with interrupts enabled, while __hrtimer_rearm_deferred() expects interrupts disabled. This can lead to a livelock and is caught by lockdep.

In the Linux kernel, the net/sched act_api module has a TOCTOU vulnerability leading to NULL pointer dereference on a->goto_chain. A concurrent operation can clear the pointer between two reads, causing a NULL dereference.

In the Linux kernel, the regmap sdw-mbq module has a vulnerability of calling an unset readable_reg callback. When the callback is not set, calling it leads to a NULL pointer dereference, potentially causing a system crash.

In the Linux kernel's firewire: ohci driver, a NULL pointer dereference vulnerability was found in ar_context_release(). The issue occurs during the error handling path of the probe function when the context was not initialized, and the devres cleanup mechanism triggers release. An attacker could exploit this to cause a kernel crash (system panic).

A vulnerability in the Linux kernel's khugepaged mechanism can lead to data loss. Specifically, when a file is written, closed, then subjected to MADV_COLLAPSE, and later reopened for writing, dirty folios may be permanently discarded. The issue occurs when khugepaged interacts with previous writes, resulting in data loss.

Parts of the DM_OP handling code assume the caller has provided the required number of buffers without checking. This can lead to access to uninitialized stack structures, causing unpredictable behavior.

In the Linux kernel, a vulnerability related to error handling in the emac_tx_mem_map() function has been fixed. In case of a mapping error, DMA mappings were leaked, which has been resolved by freeing them using the existing emac_free_tx_buf() function.

A vulnerability in the Linux kernel related to duplicate device registration in netdev hooks has been fixed. The issue occurred during the handling of NETDEV_REGISTER notifications, which could lead to incorrect device registrations.

A vulnerability has been identified in the Linux kernel related to the io_uring mechanism, concerning the bounds check for 128-byte SQE_MIXED operations. The flaw involved validating the logical position instead of the physical SQE index, potentially leading to unauthorized memory access.

A vulnerability in the Linux kernel has been resolved in the mana_gd_setup() function. In the event of a setup error, the gc->service_wq pointer was set to NULL after destroying the workqueue, preventing a use-after-free error.

In the Linux kernel, a vulnerability related to the improper invocation of the css_put() function in scx_cgroup_init() has been resolved. This issue could lead to a reference count underflow, creating a risk of a Use-After-Free vulnerability.

A vulnerability has been identified in the Linux kernel related to Rust Binder, allowing improper page insertion into the wrong virtual memory area (vma). The issue arises when a vma is closed and replaced with another vma at the same address, potentially enabling write access to pages that should be read-only.

A vulnerability has been identified in the Linux kernel's rust_binder mechanism that allows reading values from the offsets array. If the target process gains the ability to write to its own vma, it can change the offset before it is read back, leading to misinterpretation by the kernel.

A vulnerability in the Linux kernel related to permission checks for namespace iteration ioctls has been resolved. Even privileged services should not necessarily be able to see other privileged service's namespaces to prevent information leakage between them.

A vulnerability has been identified in the Linux kernel within the damos_walk() function, which does not clear the walk_control pointer in the case of an inactive context. This can lead to use-after-free situations and a permanent -EBUS error.

A vulnerability related to RCU task stalls during threaded busypoll has been identified and fixed in the Linux kernel. This issue caused bpftrace to hang during startup.

A vulnerability has been identified in the Linux kernel related to use-after-free in the remove_nh_grp_entry() function. The issue occurs when removing a nexthop from a group, potentially leading to dereferencing freed percpu memory stats.

A vulnerability has been identified in the Linux kernel that leads to improper access to hypervisor-owned memory on Monaco-based platforms. This issue results in 'Synchronous External Abort' exceptions and kernel crashes.

A vulnerability has been identified in the Linux kernel's interrupt handling for the ADXL380 accelerometer, allowing for reading more FIFO entries than actually available. The issue arises from a mismatch between how the sensor fills the FIFO and the number of active channels.

A vulnerability has been identified in the Linux kernel that allows for out-of-bounds kernel read in the madvise function. A user can provide an invalid pat_index value, leading to unsafe access to the xe->pat.table array.