Linux kernel vulnerabilities

In the Linux kernel, the SCTP protocol has a use-after-free vulnerability in the ASCONF mechanism. The cached ASCONF chunk is not properly cleared after release, leading to access to stale memory. The fix clears the addip_last_asconf pointer after release and protects against a race with T4 expiry.

A use-after-free vulnerability was found in the Linux kernel's SCTP subsystem. An authenticated remote SCTP peer can add and remove a transport within a single ASCONF chunk, leaving the new_transport pointer dangling. Subsequent operations (e.g., sending a HEARTBEAT) may read freed memory, as shown by a KASAN report in sctp_outq_select_transport.

In the Linux kernel, the fib6_rule_suppress() function (IPv6 routing) does not clear the res->rt6 pointer after dropping a route, which can lead to use of a freed rt6_info object and trigger rcuref_put_slowpath() during release.

In the Linux kernel, the iommu/arm-smmu-v3-iommufd subsystem has a vulnerability where arm_vsmmu_vsid_to_sid() maps a guest's vSID to a single physical Stream ID, assuming a device has exactly one stream. Devices with multiple streams get only the first one mapped, so vSID invalidations cannot reach the others' ATC and IOTLB entries; devices with none cause an out-of-bounds read. The fix adds an arm_vsmmu_vdevice_init() op to reject the vDEVICE with -EOPNOTSUPP when master->num_streams is not one.

In the Linux kernel, the NTFS filesystem has a vulnerability related to unsafe size calculations during runlist reallocation. A shared helper was added to safely convert runlist element counts to byte sizes with overflow checks, used in ntfs_rl_realloc() and ntfs_rl_realloc_nofail().

In the Linux kernel, the netfilter nf_conntrack_sip module has a vulnerability due to an s16 overflow in the size change counter during NAT rewriting. A single SIP message can grow by more than 32767 bytes, causing the counter to wrap and leading to an out-of-bounds read (use-after-free).

In the Linux kernel's KVM/arm64 VGIC subsystem, a race condition exists between releasing an LPI structure and re-registering it. This can lead to deletion of a newly registered LPI from the xarray or to a memory leak of the old structure. The issue is triggered by guest operations such as DISCARD and MAPTI.

In the Linux kernel, the libiscsi_tcp module lacked a check on the data segment size in SCSI responses, which could lead to overflow of the conn->data buffer (8192 bytes) by a malicious iSCSI server. The vulnerability affects the ISCSI_OP_SCSI_CMD_RSP path, where the data segment (sense/response data) was copied without proper bounds.

In the Linux kernel, the rtase driver has a double free of multi-frag skb on DMA map failure. When the head buffer DMA mapping fails after fragments are mapped, the error path frees the skb twice, leading to a crash.

In the Linux kernel's SMB server (ksmbd), a vulnerability was found in the comparison of ClientGUIDs. ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. Using strncmp() stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equal.

A vulnerability in the Linux kernel's KVM for x86 was found, involving delayed EOI (End of Interrupt) processing by the I/O APIC. If the delayed EOI work is processed after vCPUs are destroyed, a use-after-free (UAF) occurs, potentially leading to system crash or code execution.

In the igbvf driver, there is a memory leak in TX DMA error cleanup. Due to an off-by-one error, if some mappings succeed and then an error occurs, one DMA mapping (the head) is not unmapped, causing a leak.

A use-after-free vulnerability was found in the Linux kernel's SMC network module during link group termination. The issue arises from insufficient socket protection against concurrent close, potentially leading to memory corruption.

In the Linux kernel, the bridge module has a bug in br_multicast_leave_group() that can lead to a use-after-free after deleting a port group during fast-leave multicast handling.

In the Linux kernel, the UML vector driver has a use-after-free bug in vector_mmsg_rx() when a packet with an invalid header is discarded. The freed skb remains in the buffer, leading to double-free and potential exploitation.

In the Linux kernel, the veth interface has a vulnerability in handling frag_list skbs before running XDP. Frag_list skbs can have data_len set but empty frags[], leading to bogus XDP fragment metadata and a crash in AF_XDP copy mode.

In the Linux kernel, the vxlan module's route_shortcircuit() function reads the neighbour hardware address n->ha without holding the seqlock, which can lead to torn reads or partially updated MAC addresses.

In the Linux kernel, the vxlan module's vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get() functions use pskb_may_pull() instead of pskb_network_may_pull(), which does not account for the MAC header offset and can leave part of the network header in non-linear frags.

In the Linux kernel, the vxlan module's route_shortcircuit() function uses pskb_may_pull() instead of pskb_network_may_pull(), which does not account for the MAC header offset and can lead to reading beyond the pulled linear buffer when accessing IP header fields.

In the Linux kernel's iommu/vt-d subsystem, the Present bit is not cleared before tearing down a scalable-mode context entry, creating a window where hardware can fetch a torn entry, leading to unpredictable behavior or spurious faults. The issue affects device_pasid_table_teardown(), which was not aligned with a previous fix.

In the Linux kernel's rxrpc subsystem, lack of synchronization between rxrpc_kernel_charge_accept and socket teardown can lead to use-after-free. A concurrent rxrpc_discard_prealloc can free the rxrpc_backlog structure while a preallocation worker still uses it.

In the Linux kernel's rxrpc subsystem, when reading an OOB message with MSG_PEEK, the message is moved to the pending_oobq queue even though it should not be removed from the queue. This leads to double-free and use-after-free, potentially causing memory corruption.

In the Linux kernel's rxrpc subsystem, rxgk_issue_challenge() frees the page containing the challenge content after invoking the tracepoint, but the whdr pointer passed to the tracepoint points into the just-freed page, leading to use-after-free.

In the Linux kernel, the rxrpc subsystem fixed a double unlock in rxrpc_recvmsg() when handling OOB messages.

In the Linux kernel, the AFS subsystem fixed a netns teardown issue to cancel the preallocation charger. afs_charge_preallocation() skips charging when net->live is false, and afs_rx_new_call() avoids requeuing the charger.

In the Linux kernel, vxlan_gro_prepare_receive() has a potential null pointer dereference when sk_user_data is set to NULL during execution. This could lead to a system crash.

In the Linux kernel, the DLM module has an issue with the ordering of message handles in the send_queue, which can lead to refcounting issues and use-after-free. An attacker could exploit this to crash the system.

In the Linux kernel, addrconf_dad_failure() in IPv6 could overwrite DEAD state with ERRDAD, leading to use-after-free and system crash. The fix checks the state before transitioning to ERRDAD and performs operations in a single critical section.

In the Linux kernel, in the RDMA/srpt driver, the immediate data length check did not check for integer overflow, allowing a malicious initiator to bypass bounds check and pass ~4GB length to sg_init_one(). The fix uses check_add_overflow().

A vulnerability was found in the Linux kernel's nvme-multipath driver. The nvme_ns_head structure has a flexible array current_path[] indexed by NUMA node ID. Memory allocation used num_possible_nodes, which on systems with sparse NUMA IDs (e.g., POWER9) leads to out-of-bounds access (slab-out-of-bounds).

In the Linux kernel, the md/raid10 driver has been fixed to reset read_slot when reusing r10bio for discard. If the r10bio was previously used for a read, read_slot could be non-negative, causing the cleanup to skip bio_put() on repl_bio.

In the Linux kernel, a vulnerability in the NVMe driver has been fixed regarding an incorrect bounds check for the fdpcidx index in the FDP (Flexible Data Placement) mechanism. The bug used > instead of >=, incorrectly accepting an index equal to NUMFDPC + 1.

In the Linux kernel, a vulnerability in the OCFS2 filesystem was found due to missing validation of fast symlinks during inode read. A corrupted inode with a zero-cluster symlink can cause an out-of-bounds read beyond the inode block buffer, leading to a use-after-free error.

In the Linux kernel, a vulnerability in the RDMA/siw driver was fixed that caused a use-after-free when disassociating a socket from an endpoint. The issue occurred during processing of a malformed MPA request, potentially leading to closure of the new endpoint and access to freed memory.

In the Linux kernel, the lockd service's nlm4svc_lookup_file() function uses uninitialized bytes in file_hash() when the file handle length is less than LOCKD_FH_HASH_SIZE. This causes the same handle to hash to different buckets, leading to lookup failures. The fix zeroes only the tail bytes that file_hash() would otherwise consume.

A vulnerability in the Linux kernel's vhost-net allows zerocopy ubufs to be completed multiple times. Cloning skbs by the network stack (e.g., batman-adv) increments the ubuf_info refcount, but vhost_zerocopy_complete() treats every callback as a completed descriptor, leading to use-after-free.

In the Linux kernel, the vdpa/octeon_ep driver's interrupt handler looks up the IRQ index in oct_hw->irqs instead of assuming irq - irqs[0]. The fix supports non-contiguous IRQ numbers and avoids incorrect ring indexing.

In the Linux kernel, the SCTP functions sctp_verify_asconf() and sctp_verify_param() do not validate that the embedded address parameter length fits within the outer parameter bounds. This can lead to out-of-bounds reads when processing malformed INIT or ASCONF packets.

In the Linux kernel Marvell OcteonTX crypto driver, the DMA cleanup path used the wrong loop index, leaking mapped entries and repeatedly unmapping the failed one.

In the Linux kernel Cavium CPT crypto driver, the DMA cleanup error path used the wrong loop index, leaking mapped entries and repeatedly unmapping the failed one.

A vulnerability in the Linux kernel's bnxt driver causes an underflow when building the skb head during XDP head-grow operations. This leads to corrupted page reference counts, potentially causing premature recycling and double-free of memory.

In the Linux kernel, the TCP subsystem clears sock_ops cb flags before force-closing a child socket. A child socket inherits the listener's bpf_sock_ops_cb_flags, and if its setup fails, it may be closed without holding the lock, leading to a warning in tcp_set_state(). The fix clears these flags at a common point to avoid BPF callbacks on an unestablished socket.

In the Linux kernel, the net/sched/sch_codel module has a vulnerability where qdisc_tree_reduce_backlog is called during peek before qlen is restored. This can lead to incorrect deactivation of the parent class, causing a system crash (e.g., wild memory access) when qfq is used with codel as a child.

In the Linux kernel, the tipc_l2_send_msg() function has a use-after-free (UAF) vulnerability. The issue arises because tipc_disable_l2_media() calls synchronize_net() while the media_ptr pointer is still valid, allowing concurrent RCU readers to obtain the device pointer after synchronization, and then the device can be freed while still in use.

In the Linux kernel, in the RDMA/bnxt_re driver, the function bnxt_qplib_alloc_dpi returns success even when ioremap fails. Proper rollback is added for ioremap failure and -ENOMEM status is returned.

In the Linux kernel, in the RDMA/bnxt_re driver, applications can request multiple WC pages for the same ucontext, but only one WC page per ucontext is currently supported. A lock is added to avoid concurrent access and a check to fail repeated requests. Also, if the mmap entry insert fails for the WC, the Doorbell page index mapped for the WC page is freed.

In the Linux kernel, in the RDMA/irdma driver, the waitqueue and request_done flag are replaced with a completion. The previous use of the flag without proper memory barriers could lead to concurrency issues. Using a completion solves this problem in a purpose-built way.

In the Linux kernel, in enqueue_to_backlog(), there is a TOCTOU race related to the lockless netif_running() check. The check is moved inside the backlog lock, serializing it with the flush operation and preventing the use-after-free reported by syzbot.

A race condition was found in the Linux kernel's 9p/RDMA driver (trans_rdma.c) affecting the rdma->state field. The field is modified without req_lock in recv_done() and p9_cm_event_handler(), while rdma_request() uses the lock. This can lead to lost state transitions, corrupted connection state machine, and use-after-free of RDMA request objects during teardown.

In the Linux kernel, the NTFS3 filesystem has an issue with error handling during file rename. Instead of calling _ntfs_bad_inode() when rename fails, the driver uses WARN_ON, which does not prevent further operations on the inconsistent inode. The fix replaces WARN_ON with a call to _ntfs_bad_inode() to prevent further operations on the corrupted inode.