Linux kernel vulnerabilities

A vulnerability in the Linux kernel related to reserving slots for the clk_hw structure in the 9FGV0841 has been resolved. The issue concerns the lack of sufficient slots for eight outputs, which may lead to out-of-bounds writes.

A vulnerability in the Linux kernel related to swapped parameters in the pci_{primary/secondary}_epc_epf_unlink() functions has been resolved.

In the Linux kernel, a vulnerability related to a 'scheduling while atomic' bug in the mlx5e_ipsec_init_macs() function has been fixed. This was resolved by replacing mlx5_query_mac_address() with ether_addr_copy() to directly obtain the local MAC address.

A vulnerability has been identified in the Linux kernel within the kfd_event_page_set() function, which allows for out-of-bounds writes. This function writes data without checking the buffer size, potentially enabling unauthorized access by unprivileged users.

A vulnerability in the Linux kernel related to the cpumask_of_node() function has been resolved. This function could not properly handle the NUMA_NO_NODE index, potentially leading to system errors.

A vulnerability has been identified in the Linux kernel related to the dwc3_gadget_vbus_draw() function, which can be called from atomic context. This leads to invoking power-supply APIs that may cause synchronization issues as some operations may require sleeping.

A vulnerability related to error handling after finding a match in an async connection has been fixed in the Linux kernel. Once a match with an fwnode is found, a sub-device may be registered, and its bound operation is called.

A vulnerability was found in the Linux kernel's KVM for AMD SEV. It fails to reject attempts to synchronize vCPU state with an already encrypted VMSA after the VM has been launched.

A vulnerability has been identified in the Linux kernel in the rtw_core_enable_beacon() function, which reads 4 bytes from an address that is not a multiple of 4. This can lead to system crashes on some devices.

A vulnerability in the Linux kernel has been resolved regarding the introduction of locking when enabling/disabling SR-IOV, which led to deadlocks.

In the Linux kernel, the BPF verifier now tracks the changes_pkt_data property for global functions. It invalidates packet pointers in the current state after calling certain helpers.

A vulnerability has been identified in the Linux kernel related to a heap buffer overflow in the __ioam6_fill_trace_data() function. This issue occurs on the receive path, where the function incorrectly assesses the amount of data to write based on a trusted field from the incoming packet.

In the Linux kernel, RCU protection was added for the conventional zones bitmap of a disk (conv_zones_bitmap) in the block layer. This prevents invalid memory references during disk revalidation.

A vulnerability has been identified in the Linux kernel that could lead to a map leak in the fastrpc_put_args function. A failure in the copy_to_user() function could cause an early return without cleaning up the file descriptor list, which has been fixed.

In the Linux kernel, the BPF verifier now checks the changes_pkt_data property for extension programs. It decides whether to invalidate all packet pointers in the current state based on this property.

In the Linux kernel, a vulnerability in the IPv4 stack was resolved: if a packet with bad checksum metadata enters the stack, skb_checksum_help can corrupt the network header. Additional validation of checksum_start before completing the checksum was added.

In the Linux kernel RDMA/rxe subsystem, mr_check_range() has an integer overflow vulnerability that allows a remote unauthenticated client to bypass memory range validation and trigger out-of-bounds access, causing a kernel oops. The fix rewrites the check in an overflow-safe form, returning -EINVAL for crafted requests.

In the Linux kernel, the RDMA/siw driver has an out-of-bounds (OOB) write vulnerability caused by improper length limiting of fragmented header copies. The fix uses the number of already received header bytes to calculate the next copy length.

In the Linux kernel, in the RDMA/srpt driver, the function srpt_alloc_rw_ctxs() on partial failure does not reset the n_rw_ctx and n_rdma counters and does not clear the rw_ctxs pointer, leading to incorrect send queue credit accounting. The fix resets the counters and clears the pointer before returning an error.

In the Linux kernel, in the RDMA rtrs-srv subsystem, process_read and process_write did not validate that usr_len is less than or equal to off, which could lead to an integer underflow. A malicious RDMA client could send usr_len greater than off, causing data_len to wrap to a huge size_t value and leading to out-of-bounds memory access. Validation of usr_len <= off was added before calling rtrs_srv_get_ops_ids().

A vulnerability was found in the Linux kernel's svcrdma module (NFS/RDMA server). A remote peer can send a Write or Reply chunk with a segcount field of zero, which passes validation in xdr_check_write_chunk() and causes a degenerate chunk (ch_segcount == 0) to be linked onto the rc_write_pcl or rc_reply_pcl lists. An earlier patch made pcl_for_each_segment() safe for segcount 0, but the issue remains relevant as defense in depth.

A vulnerability in the Linux kernel's SUNRPC module involves not zeroing the rpc_gss_wire_cred structure at the entry of svcauth_gss_decode_credbody(). Since the structure is reused across requests, early decode failures leave partially stale data, potentially leading to dangling pointers or incorrect lengths. The fix zeroes the structure at entry.

In the Linux kernel, xfrm_dev_direct_output() frees the skb when local_out() returns a value other than 1, even though the skb has already been consumed or its ownership transferred. This causes a double-free when netfilter drops the packet.

A vulnerability in the Linux kernel's IB/isert (iSER) module allows an unauthenticated initiator to declare more data in a login PDU than was actually sent. This leads to an out-of-bounds read before authentication, potentially causing information disclosure or a system crash.

In the Linux kernel's sunrpc subsystem, xprtsock functions use plain stores and loads for shared callback pointers sk_data_ready and sk_write_space. This can lead to another CPU using a stale pointer after the original callbacks are restored. The fix adds READ_ONCE/WRITE_ONCE for these operations.

In the Linux kernel nvmet subsystem, nvmet_auth_negotiate() performs a heap out-of-bounds read because it does not validate the host-supplied transfer length (tl) or the halen/dhlen values. A malicious or non-conformant host can supply a too-small tl or too-large halen/dhlen (up to 255), causing reads past the allocated buffer. The fix passes tl into the function and rejects invalid values.

In the Linux kernel's smb (smbdirect) module, completion queues created by ib_alloc_cq_any() were torn down with ib_destroy_cq(), which did not cancel the previously queued ib_cq_poll_work(). A late completion (e.g. an RNR error from Soft-RoCE/rxe) re-queued the poll work on the already-freed CQ, causing a use-after-free.

A vulnerability exists in the Linux kernel's inetpeer rate limiting system, which stores peer entries in a Red-Black tree keyed deterministically on the remote IP address. An off-path adversary can predict the tree topology and force eviction of targeted nodes, resetting their rate-limiting token buckets, which allows bypassing IP-keyed ICMP rate limits and inferring open UDP ports. The fix randomizes the RB-tree node comparison using SipHash with a secret key.

In the Linux kernel, the NFSv4.1 implementation fails to zero referring call lists before decoding. decode_cb_sequence_args() allocates csa_rclists with kmalloc_objs(), leaving each referring_call_list uninitialized, and decode_rc_list() assigns rcl_refcalls only when rcl_nrefcalls is nonzero. A valid list with zero referring calls leaves the pointer uninitialized, and nfs4_callback_sequence() later passes stale slab contents to kfree().

In the Linux kernel, a vulnerability in skb_zerocopy() was fixed: it incorrectly called skb_tx_error() on the source skb when copying frags. This completed the zerocopy uarg and cleared the SKBFL_SHARED_FRAG flag on an skb still in use by the network stack. Specifically on the OVS_ACTION_ATTR_USERSPACE path, the skb was not freed on error, which could lead to ESP data being decrypted in place where the skb did not privately own frags, potentially causing data corruption or other issues.

A vulnerability was found in the Linux kernel's Ceph filesystem where ceph_fname_to_usr() passed vmalloc() buffers to the fscrypt crypto API, which requires linear memory. This can cause kernel oopses, especially on non-x86 platforms. The fix adds support for vmalloc() buffers using a bounce buffer.

In the Linux kernel, nfsd4_revoke_export_states() drops nn->client_lock but the held stateid reference does not pin the client. A concurrent client teardown can free the client while revoke_one_stid() still dereferences it, causing a use-after-free.

In the Linux kernel, an nfs4_openowner left on nn->close_lru holds only a raw pointer to its nfs4_client. When the laundromat reaps entries, drops client_lock and calls nfs4_put_stid(), a concurrent force_expire_client() can free the client, causing a use-after-free.

In the Linux kernel, a bare lock owner left on nn->blocked_locks_lru holds only a raw pointer to its nfs4_client. When the laundromat reaps such a lock, the final nfs4_put_stateowner() takes the client's cl_lock, which a concurrent force_expire_client() may have already freed, causing a use-after-free.

In the Linux kernel, __spi_map_msg() mishandles DMA mapping ownership on partial map failure. When RX or TX mapping fails, flags and device pointers are not properly cleared, which can lead to re-unmapping or using a NULL/stale device pointer. This can trigger a kernel oops.

In the Linux kernel, the scsi target iscsi function iscsi_target_check_login_request() does not reserve a NUL terminator byte for the login buffer. With payload_length from 8189 to 8192, the entire 8192-byte buffer is filled and then consumed as a C string, leading to out-of-bounds reads. The vulnerability is reachable by an unauthenticated initiator when CHAP is configured.

In the Linux kernel, ceph_mds_check_access() traverses the s_cap_auths array without holding the mutex. A concurrent MDS session reopen can free this array while it is being inspected, resulting in a use-after-free.

In the Linux kernel, the nvme_alloc_ns() error path removes the namespace from the sibling list using list_del_rcu() but does not wait for SRCU readers before freeing the namespace struct. A concurrent reader in the multipath code may still hold a reference to ns when kfree(ns) runs, leading to a use-after-free.

In the Linux kernel, nvmet_auth_sq_free() cancels auth_expired_work with cancel_delayed_work(), which does not wait for an already-started callback. As a result, during transport teardown the queue containing struct nvmet_sq can be freed or reused while nvmet_auth_expired_work() still accesses it.

In the Linux kernel, nvmet_tcp_try_recv_pdu() computes the remaining PDU payload length without bounding it against the size of the queue->pdu buffer. When a header digest is negotiated, a duplicate ICReq packet causes a 4-byte write past the end of the 128-byte buffer, overwriting queue->hdr_digest and queue->data_digest with attacker-controlled data.

In the Linux kernel, KVM nVMX does not service local TLB flushes when a nested VM-Enter fails. This can lead to a missed TLB flush if L1 changes L2's VPID, then does a failed VM-Enter followed by a successful one.

In the Linux kernel, KVM for arm64 has an issue with incorrectly handling the end of the VA space during TLB invalidation. The range comparison does not account for address rollover, which can lead to failed TLB invalidation for the last page/block in the TTBR1 VA space.

In the Linux kernel, a KVM arm64 issue exists in VNCR invalidation. When one vcpu invalidates the VNCR TLB while another vcpu is faulting in the same page, a stale TLB entry can be inserted. The fix extends invalidate_vncr_va() to update the mmu_invalidate_seq counter so the fault is replayed.

In the Linux kernel, the global VNCR mapping counter in KVM arm64 was removed. This counter was used to decide whether a TLB invalidation was needed, but it had flaws: checking it could cause missed TLB invalidations, and an L1 vcpu invalidating its own TLB would not invalidate the VNCR pseudo TLB. Since it failed to provide required guarantees, it was removed entirely.

In the Linux kernel, the decode_range_tlbi() helper used for S1 range-based TLB invalidation in KVM arm64 omitted the required sign extension of the virtual address. This could lead to incorrect invalidation range calculation. The fix adds the missing sign extension and guards against PA bit overflow when used for S2 invalidation.

In the Linux kernel, the scsi qla2xxx driver's qla_nvme_ls_reject_iocb() function lacks qpair locking when allocating and sending NVMe LS reject, potentially leading to concurrent access and corruption of the request ring state, causing duplicated or dropped commands.

In the Linux kernel, the scsi: qla2xxx driver's qla2x00_async_iocb_timeout() could call sp->done() twice when the response ISR completed the same handle before the timeout handler. This led to a write into a freed stack frame (use-after-free).

In the Linux kernel, the scsi: qla2xxx driver's qla2x00_status_entry() did not bound rsp_info_len from the target's FCP response, causing par_sense_len underflow and an out-of-bounds sense-data read when a hostile or buggy target reported a large value. This could leak adjacent heap memory into the sense buffer.

In the Linux kernel, ext4_read_inline_dir() has an out-of-bounds read. Directory iteration uses a larger extra_size than the actual inline_size buffer, allowing a dirent header to be read past the end of the buffer, potentially leading to information disclosure or crash.

In the Linux kernel, xfrm6_input_addr() has an out-of-bounds write due to an off-by-one depth check. When sp->len reaches XFRM_MAX_DEPTH, writing to sp->xvec[sp->len++] goes past the array, potentially causing a system crash.