Linux kernel vulnerabilities

In the Linux kernel, the BPF verifier incorrectly inferred that a pointer with an unbounded offset is non-NULL based solely on its type. As a result, a BPF program could pass verification while a NULL pointer dereference occurred at runtime.

In the Linux kernel, the BPF verifier could resurrect a scalar id dropped by collect_linked_regs() because snapshots of compared registers were taken before linked registers were collected. This could lead to range inconsistencies and precision propagation issues.

In the Linux kernel, the BPF verifier incorrectly predicted the outcome of pointer vs zero comparisons in JMP32 instructions, failing to distinguish BPF_JMP from BPF_JMP32 comparisons. This led to incorrect inference that a jump is always taken.

In the Linux kernel, the BPF verifier did not mark the zero register as precise for a register-form NULL check. As a result, one path was pruned and the program could dereference a zero pointer at runtime.

In the Linux kernel, the BPF verifier did not require the MEM_PERCPU flag for stores to percpu kptr fields, accepting both plain bpf_obj_new() allocations and kernel pointers. This could lead to arbitrary kernel read/write or invalid address relocation.

In the Linux kernel, the BPF verifier incorrectly classified borrowed RCU kptr references as owning references, thus not requiring a NULL check. At runtime refcount_inc_not_zero() could return NULL while the verifier treated the result as non-NULL.

In the Linux kernel, the BPF verifier treated PTR_UNTRUSTED pointers with the MEM_ALLOC flag as live allocated objects even though their lifetime is no longer protected. The bpf_refcount_acquire() function could then dereference NULL or stale memory.

In the Linux kernel, rhtab_map_update_elem() reinitialized special fields in recycled map elements, clearing the only pointer to a timer. As a result, the timer could fire with its key and value pointing into freed memory.

A vulnerability in the Linux kernel BPF subsystem related to rhtab maps was fixed. The functions rhtab_map_update_existing() and rhtab_delete_elem() called bpf_obj_free_fields(), which could be unsafe in NMI context. The fix uses bpf_obj_cancel_fields() to cancel only asynchronous fields, leaving referenced kptr release to the allocation destructor.

A vulnerability in the Linux kernel BPF verifier regarding stores to kptr fields was fixed. The function check_map_kptr_access() allowed a scalar store into an untrusted kptr field only when the register was known to be zero, but did not mark that register as precise. This could allow bypassing the verifier and writing attacker-controlled data into the kptr field.

A vulnerability in the Linux kernel BPF subsystem regarding inner map identity in callback frames was fixed. Callback frame constructors cleared the map_uid field, preventing distinction between inner maps sharing an inner_map_meta template. This could lead to use-after-free of a map.

A vulnerability in the Linux kernel tracing subsystem regarding subbuffer resize races was fixed. Concurrent subbuffer resizes could crash trace_pipe_raw readers or leak uninitialized memory to userspace. The fix modifies ring_buffer_alloc_read_page() and adds a new ring_buffer_read_page_size() function.

In the Linux kernel, the nfp ethernet driver dumps ntuple rules into a caller-provided buffer without checking its size. nfp_net_get_fs_loc() writes every entry of nn->fs.list into rule_locs[] while ignoring cmd->rule_cnt, so a user without CAP_NET_ADMIN can call ETHTOOL_GRXCLSRLALL with fewer slots than there are rules and run past the allocation; a rule_cnt of 0 leaves a NULL pointer that gets dereferenced.

In the Linux kernel, the nfp ethernet driver fails to drop a replaced rule from the list when reprogramming fails. nfp_net_fs_add() deletes the old rule from hardware and decrements nn->fs.count, but if nfp_net_fs_add_hw() fails the old entry stays on nn->fs.list, so the list is one longer than the counter and still advertises a rule whose hardware entry was already torn down.

A vulnerability was found in the Linux kernel's network interface creation and modification mechanism. The IFLA_TXQLEN attribute (txqueuelen) was not properly limited to S16_MAX during netlink parsing, allowing an oversized transmit queue length to be set. This led to excessive memory allocations in pfifo_fast, tun, and tap modules, which could be exploited by an unprivileged user in a namespace.

In the Linux kernel, the BPF verifier failed to mark the underlying scalar register as precise in two cases: when a helper argument is NULL (check_func_arg) and when the second parameter of bpf_get_local_storage() is zero (check_helper_call). As a result, a checkpoint created on such a path could be pruned against an arbitrary scalar value, leading to incorrect BPF program verification.

In the Linux kernel, mctp_i3c_probe() dropped busdevs_lock after finding the matching bus, allowing a concurrent I3C_NOTIFY_BUS_REMOVE to unregister and free the bus netdev before probe passed its private data to mctp_i3c_add_device(). This resulted in a use-after-free through the freed mbus pointer.

In the Linux kernel erofs filesystem, inode_share keys were encoded as fingerprint || domain_id without a separator, which could cause the fingerprint to be parsed as part of a domain ID. The fix changes the encoding to domain_id || '\0' || fingerprint, making in-memory key indices unambiguous.

In the Linux kernel iommu/riscv driver, command queue publishing was not serialized, potentially causing a race between producer state and hardware tail updates. The fix serializes publishing so software producer state advances only after a command is written and the hardware tail is updated, and waits for hardware consumption outside the queue lock when the queue is full.

In the Linux kernel iommu/amd driver, iommu_init_ga_log() unconditionally assigns the ga_log and ga_log_tail pointers, so each resume replaces the boot-time pointers and leaks both allocations. The function also uses GFP_KERNEL from a syscore resume callback, where interrupts are disabled and non-boot CPUs are offline. The fix returns early if both buffers are already allocated and clears the pointers in free_ga_log().

In the Linux kernel iommu/amd driver, amd_iommu_pdom_id_alloc() returns an int (domain ID or negative errno), but amd_iommu_alloc_domain_nested() stores the result in the u32 field gdom_info->hdom_id, discarding the sign. As a result, -ENOSPC becomes 0xffffffe4 and the "<= 0" test never fires, so the nested domain is set up with an unallocated ID. The fix keeps the value in an int, tests it, and stores it only after validation.

In the Linux kernel hwmon ltc4282 driver, ltc428_clk_provider_setup() does not initialize all members of the clk_init_data structure, in particular init.num_parents remains uninitialized despite being assumed NULL. With CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE enabled, this may cause a crash. The fix ensures all members are fully initialized.

In the Linux kernel pec_store() takes a guard(mutex)(&hwdev->lock). If the chip write operation returns an error other than -EOPNOTSUPP, the code jumps to the put label, which calls put_device(hdev); if this drops the final reference, the device is freed, and when the function returns the guard cleanup attempts to unlock the freed mutex (UAF). The fix uses scoped_guard() instead of guard().

In the Linux kernel, the virtio_ring packed ring handling leaves stale AVAIL and USED descriptor flags after a failed packed add. These descriptors can be misinterpreted by the device as another command entry, blocking the virtqueue. This typically occurs in swiotlb configurations under memory pressure when vring_map_one_sg() fails for larger I/O requests.

A use-after-free vulnerability exists in the Linux kernel's unregister_virtio_device() function. After device_unregister() is called, the memory holding the virtio_device object may be freed, and virtio_debug_device_exit() then reads the debugfs_dir field from that freed object. The affected transports are virtio_mmio, virtio_vdpa, virtio_uml, mlxbf-tmfifo, and virtio_ccw.

A use-after-free vulnerability exists in the Linux kernel's vhost-vdpa mechanism. The vhost_vdpa_config_cb() function reads the v->config_ctx pointer without a lock or reference, while a concurrent VHOST_VDPA_SET_CONFIG_CALL ioctl frees the old eventfd context via eventfd_ctx_put(), leading to use of freed memory. The issue is reachable from userspace when using VDUSE (access to /dev/vduse, root by default).

In the Linux kernel, the vduse module has a bug where virtqueue alignment is not validated. vduse_validate_config() only checks the upper bound of vq_align, so invalid values can reach vring_create_virtqueue_map(). The split-ring helpers use align - 1 as a bit mask, so the alignment must be a non-zero power of two; a zero value makes vring_size() drop the descriptor and available-ring part and vring_init() leave the used ring pointer NULL. Opening a virtio-net device created with vq_align=0 triggers a null-ptr-deref in virtqueue_kick_prepare_split().

In the Linux kernel, the vhost subsystem has an issue with invalidating vring access on IOTLB transitions. When VIRTIO_F_ACCESS_PLATFORM changes, cached vring pointers and IOTLB metadata are interpreted in a different address space, potentially leaving stale ring mappings in use. A common vhost_clear_device_iotlb() helper was added to serialize the transition with workers and prevent mixed address space mappings.

In the Linux kernel, the AF_UNIX subsystem has a bug in manage_oob() that fails to update the last skb marker. As a result, a blocking recv(MSG_PEEK) call can hog CPU by busy-waiting for a new skb. The fix updates the @last marker in manage_oob().

In the Linux kernel, the vduse module has a bug in compat ioctl handling. The compat handler handles VDUSE_IOTLB_GET_FD and VDUSE_VQ_GET_INFO but then calls the native handler, which returns -ENOIOCTLCMD due to different command sizes. For GET_FD, this overwrites receive_fd()'s return value after the descriptor is installed, leaking one fd per call. The fix returns handled compat results directly.

In the Linux kernel, the s390/debug subsystem has a NULL pointer dereference in debug_set_level(). Commit a2cec6863709 removed a null-id check from debug_set_level(), introducing a possible NULL pointer dereference for debug-API users that put debug_register() results unchecked into debug_set_level(). The fix moves the check back to the external wrapper.

In the Linux kernel, the ice network driver has a double dereference in the TP_printk() function of the ice_tx_dim_work trace event. After new checks were added to the tracing subsystem, dereferencing pointers at print time can lead to use of invalid data because the pointers may be stale. The fix copies eight scalar values into the event instead of storing pointers.

In the Linux kernel, the Bluetooth btintel_pcie driver lacks validation of the packet_len field before using it in skb_put_data(). The function btintel_pcie_submit_rx_work() reads packet_len from the rfh_hdr header without checking if it exceeds the RX buffer size. An oversized packet_len can lead to an out-of-bounds read in skb_put_data(). The fix adds validation to ensure packet_len is non-zero and does not exceed the buffer size.

A race condition exists in the Linux kernel between hci_conn_del_sysfs() and concurrent unregistration of a child device (e.g., a BNEP network device in bnep_session). During unregistration, device_del() uses a stale parent pointer, leading to a NULL pointer dereference in klist_put(). The issue is fixed by holding an explicit reference to the parent device (get_device/put_device) and restoring the __match_tty filter.

A null-ptr-deref vulnerability exists in the Linux kernel's IPv6 __ip6_del_rt_siblings() function. When deleting a route (inet6_rtm_delroute) without the RTNL lock, another thread can modify the routing table and set rt->fib6_node to NULL, leading to a NULL dereference and kernel crash.

In the Linux kernel, the macb network driver has a reference leak to the 'mdio' child node in the device tree. The macb_mii_init() function holds the reference returned by of_get_child_by_name() for macb_mdiobus_register() and drops it only on error paths, causing a reference leak on every successful probe. The fix drops the reference after registration, where __mdiobus_register() has already taken its own.

A flaw was found in the Linux kernel's namespace listing mechanism (listns), where legitimize_ns() takes a reference on the namespace before may_list_ns() checks permissions. On the denied path, dropping the last reference to a mount namespace occurs inside an RCU read-side critical section, which can sleep there and trigger a kernel warning.

In the Linux kernel hwmon corsair-cpro driver, debugfs entries were created before hwmon device registration. If registration failed, the entries remained, and after HID core freed the memory, reading one of them caused a use-after-free. The fix moves debugfs creation after hwmon registration.

In the Linux kernel hwmon corsair-cpro driver, when hwmon device registration failed, debugfs entries were not removed, leading to use-after-free when reading them. The fix adds debugfs removal on the error path.

In the Linux kernel, the vxlan_xmit_one() function in the VXLAN driver has an uninitialized stack variable _md when a VXLAN device has both VXLAN_F_COLLECT_METADATA and VXLAN_F_GBP enabled, and the transmitted packet lacks the IP_TUNNEL_VXLAN_OPT_BIT flag. This leads to reading garbage from the stack, which can spuriously set flags in the VXLAN header and leak 16 bits of uninitialized kernel data onto the wire.

In the Linux kernel net/mlx5e driver, the vnic health reporter for representors was created and destroyed along the netdev (un)load path, not serialized by the devlink lock, causing a warning on unbind. The fix moves the reporter's lifecycle to the eswitch devlink port.

In the Linux kernel perf/core, list corruption of sched_cb_list is possible during event overflow processing when PMU calls perf_sched_cb_dec() during iteration. The fix changes for_each_list_entry() to for_each_list_entry_safe().

In the Linux kernel perf/x86/intel, drain_pebs() can be reentered, leading to out-of-bounds memory access. The fix disables the full PMU around intel_pmu_drain_pebs_buffer() and adds a warning when PMU is not disabled.

In the Linux kernel, the net_failover driver has a deadlock in net_failover_slave_name_change(). Using dev_open() instead of netif_open() leads to a mutex deadlock. The fix changes the call to netif_open() to avoid the deadlock.

In the Linux kernel, the mana driver has an issue with the XDP program pointer. When RX buffer pre-allocation fails, mana_xdp_set() returns an error without restoring the previous pointer, leading to use-after-free. The fix restores the previous program on the error path.

In the Linux kernel, the stmmac driver has an issue with TX descriptor availability for TSO traffic. The estimation of free descriptors is inaccurate, potentially leading to writing past available descriptors and corrupting the TX ring. The fix adds a function to compute the exact number of descriptors needed.

In the Linux kernel, the x86/amd_node subsystem has a potential NULL pointer dereference in __amd_smn_rw() when amd_smn_init() fails and 'amd_roots' remains NULL. The fix replaces the 'smn_exclusive' flag check with a direct check of 'amd_roots', simplifying logic and eliminating the risk.

In the Linux kernel, the x86/amd_node subsystem has a PCI device reference counting issue in amd_smn_init(). The fix uses the __free() cleanup macro to automatically decrement the refcount for the temporary pointer and increments the refcount when caching a root pointer, separating temporary from in-use references.

In the Linux kernel, the x86/cfi subsystem has a bug in cfi_get_func_hash() that reads the FineIBT hash from the wrong offset (7 instead of 5). This causes BPF struct_ops trampolines to receive an incorrect hash, leading to a CFI failure on the first indirect call.

A vulnerability was found in the Linux kernel's x86 CPA (Change Page Attributes) mechanism. During the collapse of page table entries into huge pages, page tables are freed without holding relevant locks, leading to a potential use-after-free (UAF) when concurrent operations like ptdump walk the page tables.