Linux kernel vulnerabilities

In the Linux kernel's netfilter nf_conntrack, TCP and SCTP paths can emit invalid-packet logs while holding ct->lock. If logging is routed to nfnetlink_log and conntrack export is enabled, a deadlock can occur.

In the Linux kernel's atlantic driver, during TX ring deinitialization, aq_vec_deinit() cleans only a limited number of descriptors and stops at hw_head, leaving many buffers (skb or xdp_frame) unreleased. This causes memory leaks on every interface down, and with page_pool can block its destruction.

A vulnerability in the Linux kernel's net/sched/act_ct module causes an sk_buff leak when header checks reject a packet. The function tcf_ct_handle_fragments() returns errors without freeing the skb, and the caller treats all non-zero returns as ownership transfer, leading to a memory leak. Reproduced on v7.2-rc6, each malformed packet leaks a 232-byte skbuff_head_cache object plus a 704-byte data buffer.

In the Linux kernel, a vulnerability was found in net/sched: act_gact and act_police. The fallback control action supplied by user space lacks range validation, allowing TC_ACT_CONSUMED (outside the UAPI range) to be set. This causes a memory leak (sk_buff and data buffer) for every packet traversing the filter, unbounded, including kernel-generated packets.

A vulnerability in the Linux kernel's VXLAN driver arms the ageing timer on a down interface due to a missing netif_running() check. This leads to a use-after-free when the interface is deleted, as the timer is still queued on freed memory. An unprivileged user can trigger this in a new user and network namespace.

In the Linux kernel, in virtio vsock, the RX, TX, and event workers read their virtqueue before checking the run flag, which can lead to use of a deleted queue after device suspend/resume.

A vulnerability in the Linux kernel's vsock/virtio driver allows the RX worker to refill the queue after teardown, leading to a use-after-free and kernel panic. The issue occurs when work is queued after virtio_vsock_vqs_del() has been called.

In the Linux kernel, in TLS, when the sk_msg ring is full, the full_record flag is not set, which can lead to pointer wrap and overwriting entries, then to a system crash (NULL pointer dereference).

A use-after-free vulnerability was found in the TIPC module of the Linux kernel. The tipc_node_link_down() function reads the link pointer before acquiring the lock, which can lead to dereferencing freed memory during concurrent link deletion. The issue was fixed by moving the pointer read inside the lock.

In the Linux kernel KVM/SVM subsystem, a synchronization issue was found with the owner and mirror lists. Concurrent move and copy operations of encryption context can corrupt the list or cause an incorrect kvm_put_kvm() call.

In the Linux kernel eventfs subsystem, a use-after-free vulnerability was found in eventfs_remove_rec(). During recursive removal, the list iterator may read a pointer after memory is freed, leading to security issues.

In the Linux kernel eventfs subsystem, an issue was found with using the list field as an RCU head and missing memory barriers. This could lead to reading corrupted data during iteration over the children list.

In the Linux kernel hwmon thermal driver, a commit was reverted that introduced a use-after-free in the error path of thermal_add_hwmon_sysfs(). The fix restores the removed validation.

In the Linux kernel ptp_ocp driver, an out-of-bounds read was found in the board ID field from EEPROM. The field is not NUL-terminated, which could lead to reading memory beyond the buffer.

In the Linux kernel ring-buffer subsystem, a missing initialization of the order field in the bpage structure was found. This could lead to incorrect freeing of buffers larger than a page.

A vulnerability was found in the Linux kernel's ring-buffer mechanism, where ring_buffer_swap_cpu() can swap per-CPU buffers during an ongoing write operation. The committing counter may temporarily drop to zero, allowing an unsafe buffer swap and leading to inconsistent state and RB_WARN_ON. The fix replaces the counter check with current_context checks, which are set at the start of the operation and remain valid throughout.

In the Linux kernel, the page_table_check mechanism incorrectly accounts special zero mappings (shared zero-page and huge zero PMD) as file-backed pages. An unprivileged process can create enough such mappings to overflow file_map_count and trigger BUG_ON().

In the Linux kernel, the ptdump mechanism has a race condition with kernel page table freeing. Previous fixes only protected ptdump for init_mm, but on x86 and arm64 ptdump can operate on other mm's, leaving the race. The fix acquires a nested mmap write lock for init_mm in ptdump_walk_pgd().

In the Linux kernel, the rt6_route_rcv() function has an incorrect validation of the Route Information option length (RFC 4191). Due to an off-by-one error, the kernel can read up to 8 bytes past the end of the option, potentially leaking data from adjacent memory into routes visible to userspace.

In the Linux kernel, the fscrypt_ioctl_set_policy() function uses nop_mnt_idmap instead of the mount's idmap when checking file ownership. On filesystems supporting idmapped mounts (e.g., ext4, f2fs), this can lead to incorrect denial of access to the actual owner or granting access to an unrelated caller.

A vulnerability in the Linux kernel's PSI (Pressure Stall Information) mechanism for cgroups was found. A race between psi_schedule_rtpoll_work() and psi_trigger_destroy() can lead to re-arming a timer after its deletion, resulting in a use-after-free when the timer fires on a freed group structure.

In the Linux kernel, the sched_ext mechanism has a potential deadlock due to lock ordering in scx_cgroup_lock(). The function locks scx_cgroup_ops_rwsem first and then cgroup_lock(), which can deadlock with cgroup rmdir operations and cpu.weight writes.

In the Linux kernel, the IMA mechanism lacks immediate reset of action cache flags (IMA_DONE_MASK) during truncate operations. The fix instantiates file_truncate and path_truncate hooks to force re-collection, re-measurement, re-audit, and re-appraisal on next access.

In the Linux kernel, the bpf_get_fsverity_digest() function has an issue with dynptr assumptions. Although the BPF verifier and dynptr abstraction ensure memory validity, they do not guarantee stability of contents. The function could crash if arg->digest_size was concurrently modified. The fix uses the known-good value hash_alg->digest_size and widens types to u64.

A use-after-free vulnerability has been found in the Linux kernel's BPF sockmap mechanism during send verdict processing. The issue occurs because tcp_bpf_send_verdict() copies a pointer to the destination socket without taking a reference, which can lead to use of freed memory under concurrent access. An attacker could exploit this flaw to escalate privileges or cause a system crash.

In the Linux kernel, the RDMA bnxt_re driver has a kernel memory leak to userspace. The shared page (shpg) is not zeroed before being exposed to userspace, causing unsanitized kernel data to be revealed. The fix uses get_zeroed_page() instead of __get_free_page().

In the Linux kernel, the route4 classifier (net/sched: cls_route) has a use-after-free bug in its fastmap cache. The classifier stores raw filter pointers in a 16-slot cache, and a race between read and write operations can lead to use of freed memory, potentially causing system crashes or privilege escalation.

In the Linux kernel, the packet_snd() function (packet send path) has an inconsistency in reading dev->hard_header_len, which can lead to an out-of-bounds write during skb construction. The issue also affects packet_sendmsg_spkt().

A vulnerability was found in the Linux kernel's vhost subsystem. The vring metadata cache (vq->meta_iotlb[]) is not reset when the vring is reconfigured via VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM while a device IOTLB is attached. This can lead to stale mappings being used, resulting in memory access outside the actually mapped region.

The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t, but does not zero the stack struct first. An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain sensitive information.

The ARM PL011 UART driver (drivers/serial/uart_pl011.c) fails to acknowledge receive error interrupts. Framing, parity, break, and overrun errors are cleared only by writing the UARTICR register, but the interrupt service routine pl011_isr() does not do this, leaving the interrupt pending. An attacker controlling the serial peer can trigger these errors, causing an interrupt storm and permanent system hang.

In the Linux kernel, a vulnerability in netfilter: nft_payload was fixed regarding mask build for partial field offload. For a partial IPv6 address match (field_len = 16, priv_len = 1), the shift 1 << 120 is undefined on 32-bit int. It also over-masks trailing bytes, potentially causing packet matching errors. The fix sets bytes directly and removes the unsafe shift.

A vulnerability in the Linux kernel's AF_ALG (algif_skcipher) mechanism allows an unprivileged user to overwrite the initialization vector (IV) during asynchronous processing, leading to IV/keystream reuse and potential plaintext recovery. The fix forces synchronous processing, eliminating the race condition.

In the Linux kernel, the mpls_getroute() function did not initialize the rtm_tos field in the rtmsg structure, leading to a one-byte leak of uninitialized heap memory to user space when receiving RTM_GETROUTE replies. The issue was detected by KMSAN and affects the MPLS protocol.

A vulnerability in the Linux kernel leads to unbounded recursion in the memory free path of the slab allocator. Cycles between obj_exts arrays of different kmalloc caches can cause stack overflow and system crash.

In the Linux kernel, the Thunderbolt subsystem has a use-after-free vulnerability in XDomain delayed work during disconnect. The tb_xdp_handle_request() function may queue delayed work after tb_xdomain_remove() cancels it synchronously but before the xdomain object is freed, leading to work executing on freed memory. The fix adds an xd->removing flag and synchronization via xd->lock.

In the Linux kernel, the dmaengine idxd driver has a cleanup issue after fdev setup failure in idxd_cdev_open(). The failed_dev_add and failed_dev_name paths drop the file-device reference while holding wq->wq_lock, which can deadlock if put_device() triggers idxd_file_dev_release() trying to reacquire the same lock. Additionally, these paths fall through to later ctx cleanup labels that may operate on freed context. The fix moves idxd_wq_get() before possible failure and unlocks wq->wq_lock before put_device().

In the Linux kernel, a deadlock was found in the btrfs subsystem for zoned filesystems between metadata writeback and transaction commit. The issue occurs when metadata writeback holds the zoned_meta_io_lock and then tries to activate a zone, which requires waiting for a transaction commit that needs the same lock. The fix releases the lock before calling btrfs_zone_finish_one_bg() and re-acquires it afterwards.

In the Linux kernel, the btrfs filesystem has a NULL pointer dereference vulnerability when mounting with rescue=ibadroots after corrupting the block group tree or RAID stripe tree root. The function btrfs_update_global_block_rsv() dereferences the missing root based on the feature bit, causing a crash.

In the Linux kernel, the keys subsystem has an out-of-bounds read vulnerability in keyring_get_key_chunk(). For description-level chunks, the read pointer is advanced by level * sizeof(long) past the inline prefix but only the prefix is bounds-checked, allowing reads past the allocated memory for long key descriptions.

In the Linux kernel, the keys subsystem has a vulnerability due to byte order disagreement in keyring key chunks between keyring_get_key_chunk() and keyring_diff_objects(). Differences in byte order and bit position can allow key collisions, potentially leading to incorrect key placement in keyrings.

In the Linux kernel, netfilter nf_tables has a use-after-free vulnerability due to a global rhltable for nft objects. This allows access to objects being dismantled from other network namespaces, potentially leading to use-after-free.

In the Linux kernel, netfilter xt_hashlimit has a vulnerability due to uninitialized access to the burst field in the union of the dsthash_ent structure when XT_HASHLIMIT_RATE_MATCH mode is used by fewer than two rules referring to the same hashtable. Additionally, this mode is rejected for revisions less than 3.

In the Linux kernel, RDS/TCP has a use-after-free vulnerability in rds_tcp_laddr_check(). The function obtains a pointer to an IPv6 interface, drops the RCU lock, and then uses that pointer in ipv6_chk_addr(), which can lead to reading freed memory if the interface is deleted.

In the Linux kernel's nexthop module, there is a race condition during nexthop replacement. The functions fib6_check_nh_list() and __nexthop_replace_notify() walk the f6i_list without holding the nh->lock, while IPv6 RTM_NEWROUTE/RTM_DELROUTE operations mutate that list under the same lock. This leads to a use-after-free condition that could be exploited for code execution or system crash.

In the Linux kernel's nexthop module, there is a race condition in the nh_rt_cache_flush() function, which walks the f6i_list without holding the nh->lock. IPv6 route add/delete operations mutate that list under the lock and can free fib6_info entries, leading to a use-after-free. An attacker could exploit this to escalate privileges or cause a system crash.

A vulnerability in the Linux kernel's AF_XDP causes a buffer leak when dropping multi-buffer packets in xsk_drop_skb(). In three scenarios (overflow error, invalid TX descriptor, socket close), TX descriptors are consumed but buffer addresses are not published to the CQ, causing userspace to lose track of them. The fix triggers the skb destructor to submit addresses to the CQ and moves address assignment before the overflow check.

In the Linux kernel's XSK (AF_XDP) module, there is a vulnerability in the xsk_build_skb() function related to multi-buffer logic in the generic transmit path. When packets are too large (descriptor count exceeds MAX_SKB_FRAGS) or contain an invalid descriptor, continuation descriptors are silently lost and cannot be reused. The fix introduces the xdp_sock::drain_cont flag to drain them to the Cq queue.

In the Linux kernel, a vulnerability was found in the XSK zero-copy Tx batch processing path. Invalid descriptors can cause UMEM frame loss or completion ordering violations, leading to incorrect Tx queue behavior.

In the Linux kernel's libiscsi (SCSI) library, there is a vulnerability involving stale-data leak into the sense buffer. The iscsi_scsi_cmd_rsp() function copies sense data from a SCSI response, but the bounds check does not account for the 2-byte sense length prefix. A target can return a response with datalen equal to senselen, causing a read up to two bytes past the data and copying them into the sense buffer, which is returned to userspace.