Linux kernel vulnerabilities

In the Linux kernel, in the tlclk driver, there is a use-after-free vulnerability in the tlclk_cleanup() function. The issue involves freeing memory before device operations are complete, which can lead to crashes or incorrect behavior.

In the Linux kernel's PCI dwc driver, dwc_pcie_rasdes_debugfs_deinit() can dereference a NULL pointer when the controller lacks RAS DES capability. Initialization succeeds but does not allocate rasdes_info, and the cleanup function tries to access it.

A vulnerability was found in the Linux kernel's PCI/MSI subsystem. A previous fix (commit 1a8d4c6ecb4c) caused a double iounmap() on a NULL pointer during an error path in msix_capability_init(), triggering a WARNING in iounmap. The issue was fixed by reverting that change and leaving the unmap to the existing __free(free_msi_irqs) cleanup.

In the Linux kernel's AppArmor module, the function aa_replace_profiles accessed udata->size after calling aa_put_loaddata(udata), potentially causing a use-after-free (UAF). The fix saves the size to a local variable before dropping the reference.

In the Linux kernel's amdkfd driver, there is a double-unpin of DOORBELL and MMIO BOs during GPU memory free. The function amdgpu_amdkfd_gpuvm_free_memory_of_gpu() unpins these objects before checking if they are still mapped, leading to a double unpin and a warning in ttm_bo_unpin.

In the Linux kernel's ieee802154 subsystem, cfg802154_switch_netns() calls WARN_ON() on memory allocation failure in dev_change_net_namespace() and device_rename(). This leads to unnecessary warnings during deliberate fault injections.

In the Linux kernel's tun_dst_unclone function, there is a false-positive memcpy overflow warning. The compiler with clang and source fortification estimates that options cannot fit into the structure, even though memory is actually allocated, causing a warning.

In the Linux kernel's emac driver, there is a NULL pointer dereference in emac_probe. The function devm_request_irq() is called before devm_platform_ioremap_resource(), which can cause an interrupt to hit emac_irq() before dev->emacp is mapped, leading to a crash.

In the Linux kernel's veth driver, there is a NAPI leak in the XDP enable error path. The rollback loop skips calling netif_napi_del() for the failed index, leaving a dangling napi_struct in the device's NAPI list, leading to use-after-free (UAF) during device destruction.

In the Linux kernel, ACPI LPI entry functions were not marked as __cpuidle, causing RCU warnings when function tracing or Kprobes were enabled during idle entry. The fix annotates these functions with __cpuidle, disabling ftrace instrumentation on this sensitive path.

In the Linux kernel, the enetc driver had a potential divide-by-zero when num_vsi was zero, which occurs on i.MX94 platforms without SR-IOV support. The fix adds an explicit check and early return when num_vsi is zero.

In the Linux kernel, the accel/amdxdna driver had a race condition regarding the iommu domain lifetime during device removal. In force_iova mode, accessing xdna->domain after device removal could lead to use-after-free. The fix moves domain freeing to a managed release action, ensuring its validity until all resources are released.

In the Linux kernel, the parse_btf_arg function in tracing/probes contained a WARN_ON_ONCE that users could easily trigger by adding a kprobe event based on a raw address with BTF parameter. Since this is not an unexpected condition, the warning was removed.

In the Linux kernel, a vulnerability was found in the DRM driver for Intel GPUs (xe). With CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y enabled, xe_pt_svm_userptr_pre_commit() calls vma_check_userptr() with notifier_lock held in read mode, while the test path requires write mode. This triggers an assertion and a WARNING in drm_gpusvm_unmap_pages(), potentially destabilizing the system.

In the Linux kernel, the HID picolcd driver had a potential NULL pointer dereference in picolcd_send_and_wait() due to an integer overflow of the signed loop counter. Changing the counter type to unsigned int prevents the overflow and eliminates the out-of-bounds access.

In the Linux kernel, the hid_get_report function in HID core had an out-of-bounds read issue for numbered reports when the data size was 0. The fix moves the minimum size validation before calling hid_get_report, preventing out-of-bounds pointer dereference.

A vulnerability in the Linux kernel's perf subsystem for AMD processors leaks kernel addresses to user space. Even when PERF_SAMPLE_BRANCH_USER is requested, the branch stack may contain entries with branch-from addresses in the kernel (e.g., for SYSRET/ERET). The issue affects AMD processors with X86_FEATURE_AMD_LBR_V2, where the hardware filter only considers the privilege level of the branch target.

In the Linux kernel, the batman-adv gw module does not reassign the ethernet header pointer after pskb_may_pull() reallocates the buffer. This can lead to a use-after-free condition.

In the Linux kernel, the batman-adv batadv_dat_get_vid() function does not verify that the proto field of the ethernet header is accessible before reading it. This could lead to an out-of-bounds read.

In the Linux kernel, the NTFS3 filesystem's decompress_lznt() function does not validate array index bounds before accessing the decompression table. A corrupted NTFS3 image with invalid compressed data can trigger an out-of-bounds read.

In the Linux kernel, the mtd maps vmu-flash driver does not link the device structure to its parent, causing a NULL pointer dereference during MTD initialization.

In the Linux kernel, the ims-pcu driver exposes sysfs attributes on all interfaces, but only supports them on the control interface. Accessing these attributes on data interfaces can lead to unexpected behavior or crashes.

In the Linux kernel, the ims-pcu driver processes response data from device buffers without verifying that the device actually sent enough data. This can lead to out-of-bounds reads or processing stale data.

In the Linux kernel, the ims-pcu driver does not verify that the bLength of each descriptor is at least 2 when parsing CDC union descriptors. A malicious device could provide a descriptor with bLength=0, leading to an infinite loop.

In the Linux kernel, the hwmon asus_atk0110 driver's atk_ec_present() function does not check that the sub-package is non-empty before reading its first element. This can lead to an out-of-bounds read.

A vulnerability in the Linux kernel's DAMON mtier sample module can trigger a WARN_ONCE() in damon_new_region() when address range parameters are invalid. This occurs if the module is enabled before node{0,1}_{start,end}_addr are initialized or if a node is memoryless. The fix adds early validation of parameters before region creation.

In the Linux kernel, a vulnerability was found in the f2fs filesystem's f2fs_listxattr() function. Lack of validation of xattr entries before reading their fields may result in returning a partial result instead of an error when an entry is outside the valid storage area.

A vulnerability in the Linux kernel's IP fragmentation stack allows an attacker to send IP fragments with GSO metadata (e.g., via tun/tap), causing a kernel panic (BUG_ON in skb_segment) after reassembly. It affects IPv4, IPv6, nf_conntrack, and 6lowpan reassembly paths.

In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX path errors. After commit 9db5b3cec4ec ("mptcp: borrow forward memory from subflow"), errors in the receive path prior to queueing skbs into the receive queue do not trigger forward-allocated memory reclaiming. Prevent forward memory from growing unboundedly in pathological drop scenarios by explicitly reclaiming memory when skbs are dropped.

In the Linux kernel's s390/qeth driver, qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by a user-supplied length without checking a lower bound, leading to out-of-bounds write. The fix rejects buffers smaller than udata_offset before allocation.

In the Linux kernel's ASoC lpass-tx-macro driver, tx_macro_dec_mode_get() and tx_macro_dec_mode_put() access the control value via ucontrol->value.integer.value[0] instead of ucontrol->value.enumerated.item[0], leading to out-of-bounds access for enum types. The fix uses the correct field.

In the Linux kernel's drm/shmem_helper driver, the ->huge_fault handler did not check if the PMD mapping exceeds VMA boundaries, potentially leading to VM_BUG_ON_VMA() in copy_pmd_range(). The fix adds VMA boundary checks before installing the mapping.

In the Linux kernel's ASoC SOF ipc4-pcm driver, IPC errors for pipeline state change are ignored if the firmware is crashed or IPC timed out. The fix allows continuing with state changes to reset the kernel's internal state.

In the Linux kernel's fbdev driver, mode_string() uses snprintf() which can return a value larger than the remaining buffer space, causing the offset to advance past the sysfs buffer. The fix adds a size parameter and uses scnprintf(), plus an early return when offset exceeds the buffer.

In the Linux kernel's fbdev driver, fb_set_var() can delete a mode from the modelist, but does not check if fb_info->mode points to the deleted entry, leading to a stale pointer dereference on sysfs read. The fix clears fb_info->mode before deleting the mode.

In the Linux kernel's fbdev driver in fb_io_read(), a partial copy_to_user() causes desynchronization of the hardware pointer, leading to out-of-bounds reads. The fix breaks out of the loop immediately upon a partial copy.

In the Linux kernel amdgpu driver, there was no limit on the IB buffer size for GFX rings, which could corrupt adjacent control bits and destabilize command submission. A per-ring IB packet size limit was added and oversized submissions are now rejected.

In the Linux kernel, a vulnerability was found in the cs40l50-vibra input driver. The driver copies custom data of an FF_PERIODIC/FF_CUSTOM effect from user space without validating its length, which can lead to out-of-bounds reads and improper indexing of the bank array. Missing length checks (custom_len) and incorrect masking of the bank value (stored as s16) allow an attacker to trigger undesirable behavior.

In the Linux kernel FocalTech touchscreen driver, an array out-of-bounds bug in focaltech_process_rel_packet was fixed by making finger indices unsigned, preventing writes to state->fingers[-1].

In the Linux kernel Iforce driver, input packet lengths were not validated, allowing out-of-bounds reads from short packets. The fix rejects zero-length USB transfers and requires proper packet prefixes.

In the Linux kernel BYD touchscreen driver, a race condition during disconnect was fixed by using timer_shutdown_sync() instead of timer_delete(), preventing use-after-free.

In the Linux kernel Synaptics RMI4 driver (F54), a bug could lead to heap buffer overflow because report_size was not zeroed on error, causing stale larger payload to be copied into a smaller V4L2 buffer.

In the Linux kernel Synaptics RMI4 driver (F54), a bug allowed report size to exceed allocated buffer, leading to out-of-bounds write. The fix records allocation size and rejects reports that do not fit.

In the Linux kernel Synaptics RMI4 driver (F54), a bug allowed changing input type during streaming, which could change report size and lead to heap buffer overflow. The fix blocks VIDIOC_S_INPUT with -EBUSY when streaming.

In the Linux kernel, the crypto qce driver has an error path bug in devm_qce_register_algs. On registration failure, the error path repeatedly calls the same unregister function instead of unregistering previously registered algorithms.

In the Linux kernel, the gpio ml-ioh driver used a regular spinlock for register protection, which is invalid in irq_chip callbacks on PREEMPT_RT systems. The fix converts it to raw_spinlock_t.

In the Linux kernel for the OpenRISC architecture, restore_sigcontext() restored all SR bits from the signal frame, leaving privileged bits under user control. This allows an unprivileged task to disable the MMU and gain access to arbitrary physical memory.

In the Linux kernel, the sur40 driver registered the input device too early, before V4L2 and vb2_queue components were fully initialized. This can lead to data races and system crashes. The fix moves registration to the end of the probe function.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a memory leak when cp_init() fails. The current cleanup logic does not handle all channel program segments, leading to memory leakage.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a lack of cancellation of existing workqueues during initialization. This can lead to dispatching work after the private structure is freed.