Linux kernel vulnerabilities

In the Linux kernel's i2c amd-mp2 driver, on adapter registration failure, the I2C context is freed by devres, but the PCI driver may still dereference the stale pointer in IRQ and sleep callbacks. The fix unregisters the callback before returning the error.

In the Linux kernel's s390/dasd driver, in dasd_release_space(), using the logical AND operator instead of OR leads to calling is_ese() even when the function pointer is NULL, causing a NULL pointer dereference.

In the Linux kernel's i2c imx driver, there is a race during slave registration and error handling. Assigning the slave pointer before pm_runtime_resume_and_get() can leave it non-NULL after an error, and a race with the interrupt handler can cause a NULL dereference. The fix defers the assignment until after successful resume and performs it inside the slave_lock critical section.

In the Linux kernel, dev_has_sync_state() reads dev->driver twice without holding device_lock(), which can lead to a race during concurrent unbind. The fix reads dev->driver exactly once with READ_ONCE(), pairing with WRITE_ONCE() in device_set_driver().

In the Linux kernel, the vmbus driver accesses the driver_override field without a lock during match() from __driver_attach(), potentially leading to use-after-free. The fix uses the generic driver_override infrastructure that handles locking internally.

In the Linux kernel NTFS driver, a vulnerability was found where the restart-area length is truncated to u16, allowing the bounds check to be bypassed. A crafted NTFS image can cause an out-of-bounds read during filesystem mount.

In the Linux kernel, BPF LSM programs can currently attach to the xfrm_decode_session() hook, which may return an error, but security_skb_classify_flow() calls it from a void path and triggers BUG_ON() on error. The fix disables BPF attachment to this hook to prevent a system panic.

In the Linux kernel, the mlx5 driver for LAG and MPESW was missing a complete() call in the error path when mlx5_lag_get_devcom_comp() returned NULL. A process waiting for the work to finish could block indefinitely. The fix routes the early return through a 'complete' label to always wake the waiter.

A vulnerability in the Linux kernel Bluetooth SCO subsystem causes a deadlock in sco_sock_timeout(). The issue arises from acquiring the same lock (lock_sock) twice when the socket is closing while the timer runs asynchronously. The fix moves disable_delayed_work_sync() outside the locked section.

In the Linux kernel, KVM for ARM64 in nested virtualization mode, kvm_handle_vncr_abort() assumed that -EFAULT from kvm_translate_vncr() always indicates an abort. However, 'late' failures on the output of S1 translation are possible, e.g., a GFN outside memslots. The fix prepares an external abort before returning from kvm_translate_vncr() and removes the BUG_ON() in the fault injection path.

In the Linux kernel, netfilter xt_nat SNAT and DNAT target handlers assume IP-family conntrack state and can dereference a NULL pointer when instantiated from an unsupported family through nft_compat. A bridge-family compat rule can trigger a NULL-dereference in nf_nat_setup_info(). The fix rejects non-IP families in xt_nat_checkentry() so unsupported targets cannot be installed, while keeping NFPROTO_INET allowed.

In the Linux kernel, the intel-speed-select tool (tools/power/x86) daemon uses a fixed pidfile path under /tmp. A local unprivileged user can pre-create a symlink at that path and cause a root-run daemon instance to write into an attacker-chosen file. The fix opens the pidfile with O_NOFOLLOW and validates it with fstat() before locking/writing.

In the Linux kernel, a vulnerability was found in the CXL subsystem where CXL_HEADERLOG_SIZE was defined as 512 bytes, while the actual Header Log register size in the RAS Capability structure is 64 bytes. This caused an out-of-bounds read (by 448 bytes) during data copying, and in the CPER caller path led to leaking 448 bytes of kernel stack memory into the trace event ring buffer, readable by userspace via tracefs.

In the Linux kernel, the UFS core driver trace events in drivers/ufs/core/ufs_trace.h used a pointer to the hba structure in TP_printk(), which is not allowed because TP_printk() is executed when the trace file is read, potentially much later when the pointer may be stale. The fix saves the device name at the time the tracepoint is called and places it into the ring buffer, eliminating the risk of dereferencing a freed pointer.

A vulnerability in the Linux kernel's hwmon (OCC) subsystem involves a lock ordering inversion between the OCC mutex and sysfs callbacks during hwmon device unregistration. This can lead to a deadlock, as confirmed by lockdep reports. The issue was discovered via static analysis and manually reviewed.

In the Linux kernel, the MMC vub300 driver had a deadlock caused by recursive acquisition of cmd_mutex during USB device reset after a command response timeout. The fix defers the reset until the mutex is released.

In the Linux kernel, the DRM driver for Rockchip (dw_dp), dw_dp_remove() attempts to access driver data via platform_get_drvdata(), which can lead to a null pointer dereference if the bind() callback was not executed. The fix removes the unnecessary call to platform_get_drvdata() and instead references the target device structure via platform_device.

In the Linux kernel, the accel/amdxdna driver lacked NULL checks before using the management mailbox channel pointer. Cleanup functions could be called after the channel was destroyed, leading to NULL pointer dereference. Added checks to safely return instead.

In the Linux kernel, the HFS+ filesystem lacked validation of B-tree node size. A corrupted HFS+ image with an invalid node size could lead to reading uninitialized memory during mount. Added a sanity check based on the technical specification.

In the Linux kernel, the soc: xilinx driver had a race condition in event registration. Work structures were initialized after registration, which could lead to NULL pointer dereference if firmware triggered an event immediately. Fixed by initializing before registration.

In the Linux kernel, the soc: xilinx driver had an error in rx mailbox channel cleanup. Due to incorrect condition, the channel was not shut down or freed, leading to use-after-free. Fixed by checking rx_chan correctly.

In the Linux kernel, the scsi: hisi_sas driver lacked a slave_destroy interface, causing warnings during simultaneous link reset and module removal. The fix adds this interface to ensure proper link removal after workqueues are flushed.

In the Linux kernel, the crypto CCP driver (AMD) mishandled a zero-length certificate chain buffer during PDH export. Instead of treating it as a query for blob lengths, the kernel attempted to get the physical address of the ZERO_SIZE_PTR, triggering a BUG_ON() when CONFIG_DEBUG_VIRTUAL=y. This leads to a kernel oops and can be triggered by an unprivileged user via ioctl.

In the Linux kernel, the crypto: ccp/sev-dev-tsm driver had a NULL pointer dereference when pdev->bus is NULL. dsm_create() checked the condition but later used the pointer without checking, potentially causing a crash. Fixed by returning -ENODEV early.

In the Linux kernel, the media: atomisp: gc2235 driver had error handling bugs leading to use-after-free and memory leak. The fix replaces gc2235_remove() calls in error paths with explicit unwind labels that free only initialized resources.

In the Linux kernel, the scmi_power_name_get() function in firmware: arm_scmi lacked validation of the domain number, which could lead to out-of-bounds access. Fixed by returning "unknown" for invalid domains, like scmi_reset_name_get() does.

In the Linux kernel, the pinctrl: spacemit driver had a NULL check error in spacemit_pin_set_config. It checked the pin variable instead of the spin pointer, causing valid pin 0 to be rejected and PAD configuration skipped. Fixed by checking spin, restoring configuration and preventing NULL deref.

In the Linux kernel, the RDMA/hns driver has an issue in direct mode poll CQ. CQs allocated by ib_alloc_cq() always have a comp_handler, which although not expected to be called in direct mode, is called during driver reset, triggering a WARN_ONCE().

In the Linux kernel, there is a possible NULL pointer dereference in __in6_dev_stats_get(). The dev_get_by_index_rcu() function can return NULL if the original physical device is unregistered.

In the Linux kernel, the rapidio/tsi721 driver has an issue in tsi721_db_dpc(). In a list_for_each() loop, the 'found' variable is not reset at the start of each iteration, which can lead to incorrectly marking all items as found after the first correct doorbell, and if the item is not found, it may dereference invalid memory.

A vulnerability in the Linux kernel's OCFS2 filesystem causes a BUG_ON crash when mounting a corrupted filesystem image. A specially crafted image can trigger a kernel panic instead of a clean mount failure. The issue is in ocfs2_journal_toggle_dirty, which should return an error instead of crashing.

In the Linux kernel, the EDAC/igen6 driver has an issue due to missing release() function for memory controller devices. When unloading the driver, a call trace appears with a warning that the device does not have a release() function.

In the Linux kernel, the liveupdate mechanism has an issue with proper reference counting for incoming FLB data. The liveupdate_flb_get_incoming() function does not increment the reference count, which can lead to use-after-free when a subsystem holds the data.

In the Linux kernel, the wlcore driver has an issue with the cipher set that causes the number of ciphers to decrease on every boot of too old firmware. On some wl128x chips, this leads to key setting errors and endless hardware recovery attempts.

In the Linux kernel, the cxlctl_get_supported_features() function has a false positive buffer overflow detection by Fortify, leading to a kernel panic. The issue is due to an uninitialized num_entries variable.

In the Linux kernel, the setup_xor_mapping() function has a false positive buffer overflow detection by Fortify, leading to a kernel panic. The issue is due to an uninitialized nr_maps variable.

In the Linux kernel, the OCFS2 filesystem has an out-of-bounds write in ocfs2_remove_refcount_extent, which can lead to a kernel panic. The issue occurs when unlinking a refcounted file and the last leaf block is removed.

In the Linux kernel, the netfilter synproxy module has an unaligned memory access issue when adjusting the timestamp. Using unsafe operations can cause performance degradation or crashes on strict alignment architectures.

In the Linux kernel, the netfilter conntrack module reverts the ct extension genid infrastructure because it is no longer used. The previous change could disable all ct extensions for unconfirmed connections, potentially leading to crashes.

In the Linux kernel, the wcn36xx driver has an out-of-bounds read due to a short trigger BA firmware response. Lack of length validation can lead to reading stale heap data and corrupting the BA session state.

In the Linux kernel, the iommufd module lacks the dma_resv lock before calling dma_buf_unpin() in the release path, causing a kernel warning. This occurs when destroying or unmapping IOAS.

In the Linux kernel, the mt76 (mt7996) driver has a NULL pointer dereference in mt7996_init_tx_queues() when MT76_NPU and CONFIG_NET_MEDIATEK_SOC_WED are enabled. The issue occurs when an NPU is detected.

In the Linux kernel, in the Btrfs filesystem's LZO decompression function, there is an out-of-bounds read vulnerability. The segment length validation does not account for the compressed data size, which can lead to a null-ptr-deref and system crash.

In the Linux kernel, in the OcteonTX2 AF driver for the NPC, there is an out-of-bounds write (slab-out-of-bounds) vulnerability. The issue arises from an incorrect size of the entry2cntr_map array, which can lead to memory corruption.

A vulnerability in the Linux kernel's ALSA SEQ OSS subsystem involves a race condition in the read queue reset path. The snd_seq_oss_readq_clear() function modifies queue state without holding q->lock, which can race with concurrent read/free operations, leading to stale records, dropped events, or incorrect readiness reporting.

In the Linux kernel for the MIPS architecture, in the maar_res_walk() function, there is an out-of-bounds write vulnerability. The function does not check if the array is full before writing, which can lead to memory corruption when there are many memory ranges.

In the Linux kernel, in the powerpc/perf driver for FSL EMB, there is a preempt count underflow vulnerability. The fsl_emb_pmu_del() function calls put_cpu_var() without a preceding get_cpu_var() under certain conditions, which can lead to a 'scheduling while atomic' bug.

In the Linux kernel, in the RDMA HNS driver, there is a memory leak vulnerability related to bonding resources. During concurrent driver removal and reset, resources may be allocated after they have been released, leading to memory leak and potential kernel panic.

In the Linux kernel, in the mfd cs42l43 driver, there is an out-of-bounds read vulnerability. The code does not check if the firmware size is larger than the header, which can lead to invalid memory access.

In the Linux kernel, in the coresight ete driver, there is a vulnerability due to not saving state on CPU power down. This can lead to operational errors and warnings when using Coresight with ACPI.