Linux kernel vulnerabilities

In the Linux kernel, the openvswitch module's key_extract() function does not check the Ethernet header length before accessing it, which can lead to a kernel BUG in __skb_pull() for packets arriving on ARPHRD_NONE devices such as TUN. The fix is to call check_header() before accessing the Ethernet header.

A vulnerability was found in the Linux kernel's network filter mechanism (net/sched). The issue is a race condition during filter creation that can lead to use-after-free (UAF) in the cls_u32 class. The fix ensures rtnl_lock is always acquired when destroying locked classifiers.

In the Linux kernel, the bnxt_en driver has a vulnerability causing data corruption. When EOP (end of frame padding) is enabled on the AGG ring, zero padding may overlap with the next segment's data, especially with Relaxed Ordering (RO) enabled. On older chips (P5 and older), RO is not automatically disabled, potentially overwriting valid data.

In the Linux kernel, the TCP Fast Open (TFO) implementation has an issue with max_qlen accounting during SO_REUSEPORT listener migration. After migration, the qlen counter is not correctly transferred, causing the limit of pending Fast Open requests to be exceeded.

In the Linux kernel, the netfilter nf_flow_table module has an issue with dst_entry reference leak. When a packet passing through flowtable hooks already has a ref-counted dst, calling skb_dst_set_noref() overwrites the pointer, causing a reference leak and triggering DEBUG_NET_WARN_ON_ONCE warnings.

A TOCTOU race condition was found in the Linux kernel's net/smc module. The smc_listen_out() function checks the socket state without holding the lock, then acquires it later, allowing a race with listener close. This can lead to kernel memory leaks due to unreleased references to the child socket.

In the Linux kernel's Thunderbolt network driver, a vulnerability was found in the teardown sequence: DMA rings are stopped and frame buffers freed before DMA paths are deactivated. This causes in-flight data to have nowhere to drain, so the 'pending' bit never clears, leading to timeouts and link failure.

In the Linux kernel, the s390/ism driver has a use-after-free vulnerability. During ism_dev_exit(), an interrupt handler may be active in parallel, accessing freed data structures, leading to memory safety violation.

In the Linux kernel, the net/atm module has a slab-out-of-bounds read vulnerability in vcc_setsockopt(). An ineffective optlen check allows bypassing validation, which could lead to reading beyond buffer boundaries.

In the Linux kernel, the at91sam9_wdt watchdog driver has a vulnerability where at91_ping() rearms the watchdog timer from its callback. Using timer_delete() neither waits for a running callback nor prevents rearming, potentially leading to access to freed memory during probe failure or driver removal.

In the Linux kernel, the net: tap driver has a vulnerability where in tap_get_user_xdp() the virtio-net header is parsed before assigning skb->dev. When the vhost TX path passes an XDP buffer with a GSO virtio-net header and protocol set to zero, dev_parse_header_protocol() can be called with skb->dev NULL, leading to a crash.

In the Linux kernel, the Input: evdev driver has a vulnerability where the user-supplied event type index in EVIOCGMASK / EVIOCSMASK ioctls is used to index arrays in evdev_get_mask_cnt() and evdev_get_mask(). Speculative execution may mispredict bounds checks and perform out-of-bounds loads.

In the Linux kernel, the net: usb: ax88179_178a driver has a vulnerability where when the interface has NETIF_F_SG enabled and skb_linearize() fails in ax88179_tx_fixup(), the function returns NULL without freeing the skb. This leads to a memory leak on every TX frame whose linearization fails (e.g., under memory pressure).

In the Linux kernel, the vt driver lacks a permission check for the KDSKBMETA ioctl, allowing a process to change keyboard meta mode on a non-controlling console without authorization.

In the Linux kernel, kbd_keycode() reads the port.tty pointer without acquiring a proper reference, racing with con_shutdown() and potentially causing use-after-free.

A vulnerability in the Linux kernel's zap_pte_range function during direct page table reclaim causes an incorrect flush address passed to pte_free_tlb. This leads to improper TLB (paging-structure-cache) flushing, potentially resulting in use-after-free or system crashes. The issue primarily affects architectures where flushing depends on the address, such as AMD with EFER.TCE or Intel with INVPCID.

In the Linux kernel, the evdev subsystem does not fully initialize the input_event structure, leaking uninitialized stack memory to userspace via padding bytes.

A use-after-free (UAF) vulnerability has been found in the Linux kernel's vmalloc mechanism, caused by a race between page table freeing and the ptdump tool. The issue occurs when promoting entries to huge pages, where the lower page table is freed without proper locking, potentially leading to access to freed memory. The patch resolves this by acquiring the mmap lock on init_mm during vmap operations and in the CPA (Change Page Attributes) mechanism on x86.

In the Linux kernel, the IPVS estimator thread may continue after the calculation phase is disabled, leading to out-of-bounds writes and potential crashes.

In the Linux kernel, the packet subsystem's tpacket_snd() reads dev->hard_header_len independently for allocation and header construction, which can lead to buffer overflow during concurrent reconfiguration.

In the Linux kernel, the packet socket transmit path does not reset the MAC header for protocol-bound SOCK_RAW, SOCK_DGRAM, and SOCK_PACKET frames. In PACKET_QDISC_BYPASS mode, the frame reaches the driver with an unset MAC header, causing an out-of-bounds read.

In the Linux kernel, packet_set_ring() updates RX ring state under lock but publishes the tpacket receive mode after releasing it. This race can cause packet_poll() or packet_recvmsg() to access stale or NULL ring storage.

In the Linux kernel net/sched subsystem, overly deep qdisc hierarchies can cause excessive recursion and kernel stack exhaustion. The existing loop check does not cover the create-and-graft path, allowing hierarchy extension.

In the Linux kernel mac802154 subsystem, the beacon worker reads local->beacon_req under RCU but continues to use sdata and wpan_dev after leaving the RCU section. This can lead to use-after-free after interface teardown.

A vulnerability in the Linux kernel netfilter ebt_nflog module leads to a use-after-free condition. The issue arises from not holding a reference to the NFLOG logging module, allowing an ebtables rule to be invoked after per-net data has been freed by nfnetlink_log. An attacker could exploit this to corrupt kernel memory.

In the Linux kernel, fib_nlmsg_size() incorrectly estimated nexthop space assuming every gateway is encoded as an IPv4 RTA_GATEWAY attribute. IPv4 routes can also carry an IPv6 gateway, which is dumped as RTA_VIA, leading to undersized skb allocation and -EMSGSIZE errors, and with panic_on_warn set, a kernel panic.

A use-after-free vulnerability was found in the Linux kernel's fib_nhc_update_mtu() function for IPv4. The issue stems from lack of synchronization between walking the PMTU exception table and updates, potentially leading to access to freed memory. An attacker could exploit this flaw to compromise system integrity.

In the Linux kernel's qcom-geni UART driver, there is an issue with flushing the TX DMA buffer during transmission, causing the UART to get stuck infinitely repeating corrupted TX DMA frames. The DMA-mode uart_ops lacks a flush_buffer callback, and the stop path is broken, leading to a hang.

A vulnerability in the Linux kernel serial driver 8250_of for the NXP LPC32xx UART was found. The UART can report an RX timeout interrupt while the FIFO is empty, which is never cleared. This causes an interrupt storm that can livelock the CPU on single-core ARM926 systems.

In the Linux kernel's amba-pl011 driver, RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel both timers.

In the Linux kernel's staging rtl8723bs driver, rtw_get_wpa_ie() reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short trailing IE.

In the Linux kernel's staging rtl8723bs driver, WMM_param_handler() copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read for a short WMM IE.

In the Linux kernel's staging rtl8723bs driver, the WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg_txt buffer, potentially causing overflow or underfill.

In the Linux kernel's staging rtl8723bs driver, rtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and reads the 802.11 frame control field without checking that a base 802.11 header remains, potentially causing out-of-bounds reads or insufficient data.

In the Linux kernel's fastrpc module, there is a potential race condition during buffer unmap operations. The buffer is removed from the list only after the unmap operation, which can cause issues when multiple threads invoke unmap concurrently. The fix moves the list removal before the unmap, re-adding the buffer if unmap fails.

In the Linux kernel's fastrpc module, the fl->lock is not held when moving memory mappings after an interrupted invoke. The list_del() and list_add_tail() operations run without this lock, which can cause races with other operations on the mmaps list. The fix adds the lock around the move.

In the Linux kernel's DAMON module, there is an issue with folios when the migration target is invalid (e.g., NUMA_NO_NODE). Functions damon_pa_migrate() and damos_va_migrate() isolate folios, but when target_nid is invalid, folios are not returned to the LRU, causing reference leaks and pages staying off the LRU. The fix adds putting folios back on the invalid-nid path.

In the Linux kernel, the ALSA usx2y driver (for USB US-X2Y sound cards) lacks offset validation in the mmap function for the hwdep interface. An attacker can supply an arbitrary offset, leading to access to kernel memory outside the allocated region, and in extreme cases to a system oops.

A vulnerability in the Linux kernel's ALSA FCP driver causes an out-of-bounds write in fcp_meter_ctl_get(). The issue stems from an incorrect map size limit (255 instead of 128), allowing writes beyond the allocated buffer. An attacker with CAP_SYS_RAWIO can install an oversized map, and any process with access to /dev/snd/controlC0 can trigger the out-of-bounds write.

In the Linux kernel, the V3D DRM driver (drm/v3d) has a vulnerability due to lack of serialization of timeout handlers for different hardware queues (BIN, RENDER, TFU, CSD). Since the reset is global, concurrent timeout handling can lead to inconsistent job credit counts, resulting in GPU hang and UI freeze.

A use-after-free vulnerability was found in the Linux kernel's perf subsystem, related to improper sibling event detachment from a group. When a sibling event is detached (e.g., during CPU hot-unplug), its group_leader pointer remains pointing to the old leader, which may be freed, leading to dereferencing freed memory during a PERF_IOC_FLAG_GROUP ioctl. The issue was reproduced by running the perf event fuzzer, CPU hotplug, and a stress workload concurrently.

In the Linux kernel fbdev driver, the bit_cursor() function did not validate the glyph index read from the screen buffer, which could lead to an out-of-bounds memory read. The issue was reported by Syzkaller and affects the write path to /dev/vcsa.

In the Linux kernel, ring_buffer_subbuf_order_set() frees buffer pages, which is not allowed when resizing is disabled. A non-consuming reader is at risk of use-after-free in rb_advance_iter(). The function now returns -EBUSY when resize_disabled is set, matching ring_buffer_resize() behavior.

A subtle race condition in the Linux kernel's huge_zero_folio implementation can cause the huge_zero_pfn to be overwritten with an invalid sentinel value by the shrinker, leading to misidentification of the huge zero page as a regular THP folio. This may result in incorrect splitting and handling of the huge zero folio.

In the Linux kernel, smc_rx_splice() has a lifetime imbalance issue for splice entries. The function passes pages to splice_to_pipe() before taking references, which can lead to use-after-free due to refcount underflow.

In the Linux kernel, in6_dev_get() can resurrect an inet6_dev object after it has been freed. It reads dev->ip6_ptr under RCU and then unconditionally increments its refcount. If device teardown clears the pointer and drops the last reference between these operations, the increment can resurrect an object whose RCU free has already been queued, leading to use-after-free.

In the Linux kernel, the net/dibs module has a double-free and use-after-free (UAF) issue with dmb_clientid_arr. An interrupt handler can be active after dibs_dev_del() and still access the array. In case of failure in dibs_dev_add(), the array is freed twice.

In the Linux kernel, the zerocopy_fill_skb_from_devmem() function lacks a check to prevent mixing net_iov and page-backed fragments in a single skb. Such mixing can cause a crash in the network stack.

In the Linux kernel, the ntb_netdev driver's ntb_netdev_rx_handler() hands the received skb to the network stack before allocating its replacement. If allocation fails, the buffer is not reposted, gradually depleting the RX queue and potentially stalling reception.

In the Linux kernel's netfilter bridge subsystem, a nftables ct zone rule can attach a conntrack template to an skb before nf_ct_bridge_pre() processes it. For non-IP EtherTypes, the function overwrites the conntrack state without releasing the template reference, causing memory leaks.