Linux kernel vulnerabilities

In the Linux kernel SCSI libsas subsystem, there is a deadlock during host adapter resume and a race condition in the hisi_sas driver related to disk wake-up. The issue appeared after a change that skipped draining the event workqueue, causing disks to send I/O to a suspended controller and get disabled. The fix moves the PHYE_RESUME_TIMEOUT notification after the workqueue drain, eliminating the deadlock and restoring safe resume behavior.

In the Linux kernel, the ath12k driver had an out-of-bounds error in ath12k_mac_dp_peer_cleanup(), where indexing the free_ml_peer_id_map bitmap used peer_id with the ATH12K_PEER_ML_ID_VALID bit (BIT(13)) set, leading to writes beyond the bitmap memory (256 bits). This caused memory corruption and exhaustion of ML peer IDs.

In the Linux kernel, the hwmon nct6775-core driver for the NCT6116 chip used an incorrect number of temperature registers (six instead of three), leading to an out-of-bounds read (KASAN). The fix sets the number of registers to three and removes the unnecessary array.

In the Linux kernel, the hwmon lm90 driver is vulnerable to reading sysfs attributes before driver registration is complete, which can lead to a NULL pointer dereference in lm90_report_alarms(). The fix schedules work only after data->hwmon_dev is set.

In the Linux kernel, the hwmon nzxt-smart2 driver had an output buffer not aligned to DMA boundaries, which on architectures with non-coherent caches (e.g., ARM, MIPS) led to memory corruption during DMA mapping. The fix aligns the buffer to ARCH_DMA_MINALIGN.

In the Linux kernel network stack, when peer entry allocation (inet_getpeer_v4/v6) fails, functions sending ICMP/NDISC Redirects sent packets without rate limiting, potentially leading to a packet storm. The fix prevents sending redirects when peer is NULL.

In the Linux kernel, the hwmon nct6775-core driver for the NCT6116 chip has weight register arrays with only 3 elements, but the driver iterates up to 5 PWM channels, leading to out-of-bounds reads (KASAN) and invalid hardware register access. The fix extends the arrays with zeroed fields to mark unsupported registers.

In the Linux kernel, the forcedeth driver has a use-after-free vulnerability in nv_remove(), where per-CPU txrx_stats are freed before unregistering the network device, potentially leading to access to freed memory. The fix moves the free after unregister_netdev().

In the Linux kernel, the hwmon adt7470 driver, setting auto_update_interval to 0 via sysfs causes the update thread to loop tightly, leading to continuous CPU usage and flooding the I2C bus. The fix raises the lower limit of the interval to 500 ms.

In the Linux kernel, the adt7470 hwmon driver has a divide-by-zero TOCTOU vulnerability in fan speed read. If fan data becomes zero between the validity check and conversion, a race with a concurrent update can cause a crash.

In the Linux kernel, the cls_u32 classifier lacks validation of the offshift value, allowing shift-out-of-bounds during packet classification. An unprivileged user can trigger undefined behavior via user/network namespaces.

A memory leak in the Linux kernel's UDP tunnel NIC offload code (udp_tunnel_nic) was found. When network device registration fails, udp_tunnel_nic_unregister() returns early without freeing the allocated structure, causing a permanent leak. The fix removes the early return and synchronously cancels pending work before freeing memory.

In the Linux kernel, the netfs subsystem has a folio_queue allocation failure during writeback, causing a warning and potential crash. A mempool and gfp_t flags passing were added to handle allocation failures.

In the Linux kernel, Bluetooth ISO has a use-after-free vulnerability when detaching a connection from hcon. Failure to clear iso_data leads to later use after memory free.

In the Linux kernel, Bluetooth L2CAP has a use-after-free vulnerability in l2cap_le_connect_rsp. The channel is obtained without holding a reference, allowing a concurrent disconnect to free it, leading to use-after-free.

In the Linux kernel, Bluetooth ISO function iso_sock_getname does not hold the socket lock when accessing the conn field, leading to a race condition and potential use-after-free.

In the Linux kernel, Bluetooth ISO function iso_connect_ind does not hold the socket lock when accessing the conn field, leading to a race condition and potential use-after-free. Additionally, conn may be NULL if the socket has changed state.

In the Linux kernel, Bluetooth ISO function iso_conn_ready does not properly hold a reference to the socket when accessing conn->sk, leading to a use-after-free if the socket is concurrently closed.

In the Linux kernel, in the Bluetooth ISO subsystem, a socket reference leak was found after socket release. The early return condition in iso_sock_kill() is always true because sock_orphan() sets SOCK_DEAD, so the reference is never released and the socket destructor is never called. Additionally, the reference leaks when __iso_sock_close() does not set SOCK_ZAPPED, since iso_conn_del() does not call iso_sock_kill() after zapping.

In the Linux kernel, in the Bluetooth ISO subsystem, a potential deadlock was found in iso_sock_timeout(), which takes lock_sock and then synchronously disables the timer, potentially causing a deadlock. Additionally, iso_sock_timeout() may run concurrently with iso_conn_del(), leading to use-after-free (UAF) — one thread frees the hcon structure while another tries to access it.

In the Linux kernel, in the Bluetooth ISO subsystem, a reference counting bug was found in the iso_conn structure. A race between iso_conn_del() and iso_chan_del() can lead to a double-put of iso_conn, resulting in use-after-free (UAF). The issue stems from an extra put in iso_conn_del() for the case when iso_chan_add() fails.

In the Linux kernel, in the Bluetooth ISO subsystem, a race condition was found between kfree and kref_get_unless_zero on the hci_conn::iso_data field, which is accessed and modified without synchronization (lock or RCU). This can lead to use-after-free (UAF) and races between iso_conn_add() and iso_conn_free().

In the Linux kernel, in the Bluetooth subsystem (btintel driver), a missing length validation before accessing tlv->val[0] in btintel_diagnostics() was found. This can lead to reading data beyond the received frame, resulting in information disclosure or a crash.

In the Linux kernel, in the Bluetooth subsystem (hci_conn), a theoretical use-after-free (UAF) vulnerability was found in abort_conn_sync() if the connection (conn) is freed while the hci_sync task is running. There is no reference held to the connection.

In the Linux kernel, in the Bluetooth subsystem (hci_sync), a theoretical use-after-free (UAF) vulnerability was found in hci_connect_big_sync() if the connection (conn) is freed while the hci_sync task is running. There is no reference held to the connection. Additionally, if hcon is NULL, the function returns 0 and does nothing to match previous behavior.

In the Linux kernel, in the Bluetooth subsystem (hci_sync), a theoretical use-after-free (UAF) vulnerability was found in hci_connect_pa_sync() if the connection (conn) is freed while the hci_sync task is running. There is no reference held to the connection.

In the Linux kernel, in the Bluetooth subsystem (hci_sync), a theoretical use-after-free (UAF) vulnerability was found in hci_past_sync() if the connection (conn) is freed while the hci_sync task is running. This can lead to passing freed pointers to hci_conn_valid(), which kmalloc may have reused.

In the Linux kernel, in the octeontx2-af subsystem, a vulnerability was found that allows virtual functions (VFs) to overwrite special CGX PKIND state. When HiGig2 or EDSA parsing is enabled, a VF NIX LF allocation must not reset the LMAC RX PKIND or default TX parse config over the PF setup. Missing permission-checking functions.

In the Linux kernel, a potential deadlock was found in the mpi3mr driver in mpi3mr_fault_uevent_emit(). This function runs from the fault watchdog and reset paths where host I/O may already be blocked. GFP_KERNEL allocations, both local and inside kobject_uevent_env(), can trigger reclaim that waits on blocked I/O and deadlocks.

In the Linux kernel, a memory leak was found in the sxgbe network driver: when RX descriptor ring allocation fails, init_dma_desc_rings() only frees the partially allocated RX rings and returns, leaking the TX rings that were allocated earlier in the same function.

In the Linux kernel for RISC-V, a vulnerability was found causing out-of-bounds page-table walk during memory hot-remove. Functions remove_pud_mapping() and remove_p4d_mapping() obtain a child table base with offset 0, then add the index for addr. With page-table folding, this can walk past the parent table and pass an invalid page to __free_pages(), causing a kernel BUG.

A deadlock was found in the qede driver of the Linux kernel during recovery after a TX timeout on NICs with VXLAN/GENEVE tunnel ports configured. The recovery process tries to re-lock the same mutex (qede_lock), causing the entire rtnetlink control plane to wedge and many system services to hang.

In the Linux kernel's SMB server (ksmbd), a use-after-free vulnerability was found in __close_file_table_ids(). A ksmbd_file can remain alive after logical close while another session holds a temporary reference. When the foreign holder performs the final put, the object is freed without being removed from its owner's idr, leading to a stale pointer dereference during file-table teardown.

In the Linux kernel's iommu/iommufd subsystem, a use-after-free vulnerability was found in IOPF group ownership. IOPF groups are linked into the generic pending list before invoking the domain fault handler, and after acceptance they are also queued in the IOMMUFD deliver list without removal from the generic list. When detach or HWPT replacement drops the device's IOPF reference count to zero, groups can be freed, and later access leads to UAF.

In the Linux kernel's pinctrl subsystem for devicetree, a vulnerability was found causing freeing of uninitialized dev_name on error path. dt_remember_or_free_map() duplicates dev_name for each map entry. If kstrdup_const() fails, dt_free_map() frees dev_name in all entries, including uninitialized ones, leading to a double-free.

A vulnerability in the Linux kernel's hugetlb mechanism causes list corruption in allocate_file_region_entries(). The issue stems from using list_splice() instead of list_splice_init(), which under concurrent access to a shared mapping can lead to memory corruption or a system panic.

A vulnerability in the Linux kernel's KVM/SVM was found where x2APIC MSR intercepts are not updated for L1 when AVIC is inhibited while L2 is active. This allows L1 to read host APIC state, send arbitrary interrupts, and change task priority, potentially leading to a host DoS.

In the Linux kernel, in the KVM subsystem for s390 architecture in PCI handling, a vulnerability was found where a request to enable interrupt forwarding is not rejected if it is already enabled for the zPCI device. The MPCIFC instruction does not allow re-registering interrupts without first unregistering. The fix adds a proper check, preventing overwriting and resource leaks when the ioctl is called multiple times for the same device.

In the Linux kernel, in the KVM subsystem for s390 architecture in PCI handling, a memory accounting issue was found for pinned/unpinned pages. The account_mem() and unaccount_mem() functions call get_uid() which increments the reference count of struct user_struct on every invocation, but free_uid() is not called to decrement it. Additionally, accounting is done against current->mm, which may be incorrect when unaccount_mem() is called from a different process context than the one that originally pinned the pages. The fix stores the pinning process's user_struct and mm_struct and frees these resources when unpinning.

A use-after-free vulnerability was found in the Linux kernel's dibs layer, affecting attach/detach/unregister operations for dmb_node in loopback mode. The issue stems from a race between hash table lookup and refcount operations, potentially leading to use of freed memory. The fix makes refcount transitions and hash table removal atomic under the write lock.

In the Linux kernel, in the audit module, a potential use-after-free vulnerability was found in audit_del_rule(). This function destroys e->rule.exe via audit_remove_mark_rule() before unlinking the rule from RCU-visible filter lists and waiting for a grace period. Concurrent readers in audit_filter() and audit_filter_rules() still dereference e->rule.exe, while the fsnotify mark can be freed on an independent lifetime path. The fix unlinks the rule from RCU-visible lists and invokes synchronize_rcu() before calling audit_remove_mark_rule() and other rule removal helpers.

In the Linux kernel, in the Bluetooth subsystem (mgmt), a use-after-free vulnerability was found in pair command cancellation. The pairing completion and authentication failure callbacks look up the pending MGMT_OP_PAIR_DEVICE command by walking hdev->mgmt_pending, but without holding mgmt_pending_lock for the later dereference and removal. A concurrent MGMT_OP_CANCEL_PAIR_DEVICE request can remove and free the same pending command before the callback uses it. The fix transfers ownership of the pending command by removing it from hdev->mgmt_pending while holding mgmt_pending_lock, and the callbacks and cancel path then complete and free it directly.

A use-after-free vulnerability was found in the Linux kernel's Bluetooth subsystem (hci_sync). The hci_find_adv_instance() function returns a pointer to advertising data that is only valid while hdev->lock is held, but the HCI command-sync paths use it without that lock, which can lead to use of freed memory during an advertising termination event.

In the Linux kernel, in the Bluetooth HIDP subsystem, a vulnerability was found where data is read before checking if the frame contains a transaction header. The functions hidp_recv_ctrl_frame() and hidp_recv_intr_frame() read skb->data[0] before checking that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty basic-mode SDU, leading to use of an uninitialized byte. The fix pulls the transaction header with skb_pull_data() and discards frames that do not contain it.

In the Linux kernel, in the Bluetooth HIDP subsystem, a vulnerability was found where numbered report payloads are not validated. When hidp_get_raw_report() waits for a numbered report, hidp_process_data() compares the expected report number with skb->data[0]. A connected HIDP peer can reply with only a DATA transaction header, leaving the skb empty after the header is removed. The fix requires a payload byte before comparing a numbered report ID; unnumbered reports continue to accept an empty payload.

A Use-After-Free (UAF) vulnerability has been found in the Linux kernel's afs_make_call() function in the AFS filesystem. The issue arises from a race condition between sending asynchronous calls and their destruction, potentially leading to access to freed memory. The bug was reported by KASAN during tests with random CPU offlining.

In the Linux kernel, the ALSA 6fire driver failed to cancel a pending URB before freeing resources during probe error handling, potentially leading to a use-after-free. The fix applies a cleanup similar to the normal disconnect phase.

A vulnerability in the Linux kernel's ALSA sequencer subsystem causes a divide-by-zero in initialize_timer(). An unprivileged user can set the timer resolution to a very large value (e.g., 2^63), causing the product to overflow and leading to a division by zero, which results in a system hang (oops with a held spinlock).

A vulnerability was found in the Linux kernel's ALSA timer subsystem. The SNDRV_TIMER_IFLG_DEAD flag is never cleared after a close operation completes, leading to a use-after-free when the same timer instance is reopened. An attacker with access to /dev/snd/timer and /dev/snd/seq can trigger this to escalate privileges or cause a system crash.

In the Linux kernel, ALSA UMP has a double free in snd_ump_attach_legacy_rawmidi(). After snd_rawmidi_new() fails, the out_cvts array is freed but the pointer is not cleared, leading to a second free during endpoint teardown.