Linux kernel vulnerabilities

In the Linux kernel, a NULL pointer dereference occurs in the tracing module when removing events from the module cache. A module-specific event filter such as ':mod:foo' is cached with a NULL pointer when the module is not loaded. A later attempt to remove a specific match from the same module passes this NULL to strcmp(), causing a NULL pointer dereference.

In the Linux kernel's atlantic driver, aq_ring_rx_deinit() only walks the range [sw_head, sw_tail), skipping buffers that were consumed but not yet refilled. This causes leaks of pages and DMA mappings on every interface down.

A vulnerability was found in the Linux kernel's OverlayFS filesystem. An unprivileged user can trigger a WARN_ON in ovl_fill_super(), potentially causing kernel tainting, log flooding, and even a system panic (if panic_on_warn is enabled). The issue stems from the ability to complete a mount from a different user namespace.

A vulnerability in the Linux kernel's binfmt_misc module allows an unprivileged process to trigger a WARN_ON() in bm_fill_super() by completing a mount context from a different user namespace. This can be exploited to flood kernel logs and potentially cause a system panic if panic_on_warn is enabled.

In the Linux kernel, the setattr_prepare() function contains an unnecessary check for fs-verity being enabled. This check is not needed and its presence can allow truncate operations on fsverity files to succeed, which is undesirable.

In the Linux kernel, the Thunderbolt subsystem has an out-of-bounds read vulnerability during DROM parsing. The dual_link_port_nr field, derived from the device, is not properly validated before being used as an index into the sw->ports array. This can lead to an out-of-bounds pointer and subsequent dereference.

A vulnerability in the Linux kernel's khugepaged mechanism can lead to data loss. Specifically, when a file is written, closed, then subjected to MADV_COLLAPSE, and later reopened for writing, dirty folios may be permanently discarded. The issue occurs when khugepaged interacts with previous writes, resulting in data loss.

Parts of the DM_OP handling code assume the caller has provided the required number of buffers without checking. This can lead to access to uninitialized stack structures, causing unpredictable behavior.

In the Linux kernel, a vulnerability related to error handling in the emac_tx_mem_map() function has been fixed. In case of a mapping error, DMA mappings were leaked, which has been resolved by freeing them using the existing emac_free_tx_buf() function.

A vulnerability in the Linux kernel related to duplicate device registration in netdev hooks has been fixed. The issue occurred during the handling of NETDEV_REGISTER notifications, which could lead to incorrect device registrations.

A vulnerability has been identified in the Linux kernel related to the io_uring mechanism, concerning the bounds check for 128-byte SQE_MIXED operations. The flaw involved validating the logical position instead of the physical SQE index, potentially leading to unauthorized memory access.

A vulnerability in the Linux kernel has been resolved in the mana_gd_setup() function. In the event of a setup error, the gc->service_wq pointer was set to NULL after destroying the workqueue, preventing a use-after-free error.

In the Linux kernel, a vulnerability related to the improper invocation of the css_put() function in scx_cgroup_init() has been resolved. This issue could lead to a reference count underflow, creating a risk of a Use-After-Free vulnerability.

A vulnerability has been identified in the Linux kernel related to Rust Binder, allowing improper page insertion into the wrong virtual memory area (vma). The issue arises when a vma is closed and replaced with another vma at the same address, potentially enabling write access to pages that should be read-only.

A vulnerability has been identified in the Linux kernel's rust_binder mechanism that allows reading values from the offsets array. If the target process gains the ability to write to its own vma, it can change the offset before it is read back, leading to misinterpretation by the kernel.

A vulnerability in the Linux kernel related to permission checks for namespace iteration ioctls has been resolved. Even privileged services should not necessarily be able to see other privileged service's namespaces to prevent information leakage between them.

A vulnerability in the Linux kernel related to handle opening in nsfs has been resolved, which involved overly permissive permission checks. Even privileged services should not have access to other privileged services' namespaces to prevent information leakage.

A vulnerability has been identified in the Linux kernel within the damos_walk() function, which does not clear the walk_control pointer in the case of an inactive context. This can lead to use-after-free situations and a permanent -EBUS error.

A vulnerability related to RCU task stalls during threaded busypoll has been identified and fixed in the Linux kernel. This issue caused bpftrace to hang during startup.

A vulnerability has been identified in the Linux kernel related to use-after-free in the remove_nh_grp_entry() function. The issue occurs when removing a nexthop from a group, potentially leading to dereferencing freed percpu memory stats.

A vulnerability has been identified in the Linux kernel that leads to improper access to hypervisor-owned memory on Monaco-based platforms. This issue results in 'Synchronous External Abort' exceptions and kernel crashes.

A vulnerability has been identified in the Linux kernel's interrupt handling for the ADXL380 accelerometer, allowing for reading more FIFO entries than actually available. The issue arises from a mismatch between how the sensor fills the FIFO and the number of active channels.

A vulnerability has been identified in the Linux kernel that allows for out-of-bounds kernel read in the madvise function. A user can provide an invalid pat_index value, leading to unsafe access to the xe->pat.table array.

A vulnerability has been identified in the Linux kernel related to double destruction of the workqueue in the mana driver during PCI scanning. This issue leads to a use-after-free crash, potentially causing system instability.

A vulnerability has been identified in the Linux kernel regarding the improper classification of data as interlaced plain extents. This issue occurs when data is not properly aligned to the block size, potentially leading to out-of-bounds read errors.

A vulnerability related to null pointer dereference in the __udp_enqueue_schedule_skb() function has been fixed in the Linux kernel. This issue was reported by syzbot and may lead to failures in the UDP socket initialization functions.

A vulnerability in the Linux kernel related to bind attributes in sysfs for the reset device has been resolved. The issue allowed users to unbind the device, leading to a use-after-free error.

A vulnerability has been identified in the Linux kernel within the cachefiles_cull() function, leading to a loss of dentry references. Changes made in the cachefiles_bury_object() function did not account for all calls, resulting in improper reference management.

A vulnerability has been identified and resolved in the Linux kernel. The issue involves a double call to ida_free in the hv_pci_probe error path, leading to an attempt to free the same identifier twice.

A vulnerability has been identified in the Linux kernel related to improper initialization of the aio_cmd->iocb structure in target_core_file. This issue may lead to incorrect write failure statuses during write command execution.

A vulnerability has been identified in the Linux kernel regarding incorrect length accounting for TX packets that span multiple buffer descriptors. This issue leads to the loss of earlier bytes, potentially stalling the TX queue.

A vulnerability has been identified in the Linux kernel that allows the import of a zero-length buffer, leading to out-of-bounds memory reads. This issue occurs in the validate_fixed_range() function, where the lack of proper buffer length checking results in incorrect offset calculations.

A vulnerability in the Linux kernel related to the container_of operation in the intel_pmu_hw_config function has been fixed. The issue could lead to out-of-bounds memory reads when software events are present in a group of events.

A vulnerability has been identified in the Linux kernel that leads to a slab-out-of-bounds read in the io_bundle_nbufs() function. The issue arises from improper storage of length values, resulting in overflow and an infinite loop.

A vulnerability has been identified in the Linux kernel that allows out-of-bounds access to the odr_table array in the st_lsm6dsx_hwfifo_odr_store() function. This issue occurs when a user attempts to set the buffer sampling frequency for sensors other than the accelerometer or gyroscope.

A vulnerability has been identified in the Linux kernel related to a double free in the reset_add_gpio_aux_device() function on error. The issue occurs when __auxiliary_device_add() fails, leading to improper resource deallocation.

A vulnerability has been identified in the Linux kernel related to incorrect buffer size in DMA allocation and memcpy in zynqmp_nvmem. This flaw may lead to undersized DMA buffer access and potential memory corruption.

A vulnerability has been identified in the Linux kernel that occurs when switching to an alternate screen after resizing. The issue is that the old Unicode buffer is not properly discarded, leading to memory errors when restoring the screen state.

A vulnerability in the Linux kernel related to the unmap function was identified, which can unmap more than requested if the endpoint lands within the middle of a large or contiguous IOPTE. This issue has been resolved with a fix that ensures all unmapped areas are properly flushed.

A vulnerability has been identified in the Linux kernel's krb5enc function that allows bypassing integrity verification during asynchronous decryption. The issue is that upon completion of the skcipher operation, it signals 'done' without performing hash verification.

A vulnerability has been identified in the Linux kernel that leads to a double free when splitting a virtual memory area (VMA). The issue occurs when a user performs a partial munmap() on a privcmd mapping, allowing for improper memory pointer management.

A buffer overflow vulnerability has been identified in the Linux kernel in the file drivers/xen/sys-hypervisor.c. The issue arises because the build id returned by HYPERVISOR_xen_version(XENVER_build_id) is not NUL terminated, leading to memory overflow.

A vulnerability has been identified in the Linux kernel related to incorrect length checking of the response authenticator in the rxgk_verify_response() function. This flaw allows oversized authenticators to be accepted, potentially leading to system crashes.

A vulnerability has been identified in the Linux kernel related to the iptfs_clone_state() function. The issue is that x->mode_data is stored before the allocation of the reorder window, which may lead to pointing to freed memory in case of allocation failure.

A vulnerability has been identified in the Linux kernel related to memory access after a Function Level Reset (FLR). If the second FLR cannot allocate memory for the saved configuration, invalid memory access may occur.

A vulnerability in the Linux kernel has been fixed that caused all remaining subrequests from a read request to be abandoned during retry under certain circumstances. The abandonment process did not always have a valid value for the 'subreq' variable, which could lead to errors.

A vulnerability has been identified in the Linux kernel regarding incorrect pte restoration for lazyfree folios. The issue involved potentially setting an entire batch of anonymous folios as writable during unmapping, which has been fixed by respecting the writable bit during batching.

A vulnerability in the Linux kernel related to improper unwinding in the error path of the rocket_probe function has been resolved. The issue occurs when rocket_core_init() fails, potentially leading to out-of-bounds memory access.

A vulnerability has been identified in the Linux kernel that may lead to ubuf size overflow. This can result in undersized memory allocation and potential memory corruption.

A vulnerability in the Linux kernel related to task work flag manipulation in the context of io_uring has been resolved. The issue occurred during ring resizing, potentially leading to incorrect processing of the IORING_SQ_TASKRUN flag.