Linux kernel vulnerabilities

In the Linux kernel, ALSA USB-audio has a use-after-free in ump_to_endpoint(). After registering a UMP endpoint, if a later creation step fails, the snd_usb_midi2_ump object is freed but the endpoint still points to it, causing a use-after-free read when the UMP node is opened.

In the Linux kernel, the ALSA USB-audio driver (RME Digiface) has a stack information leak. The status read function copies uninitialized stack memory to a buffer when the device responds with a short transfer, and this data is exposed to unprivileged users via /dev/snd/controlC*.

In the Linux kernel, ALSA USB-audio has an out-of-bounds write in snd_usbmidi_akai_output(). When a device advertises a small transfer size, the loop bound becomes negative, leading to writes past the URB buffer when writing to the MIDI node.

In the Linux kernel, ALSA USB-audio has an out-of-bounds DMA buffer write when the fill_max flag is set. The buffer size is calculated based on the original packet size, but transfers use a larger size, causing writes past the buffer by the USB controller.

In the Linux kernel, ALSA USB-audio lacks clamping of frame size in implicit-feedback mode. Received sync packet sizes are not limited to the maximum frame size, potentially causing packet transfers beyond hardware limits.

In the Linux kernel, the fou_create() function has a use-after-free vulnerability. The fou structure is published via sk_user_data before adding the port to the list, and on error it is freed while still reachable, allowing concurrent reads of freed memory.

In ksmbd (the SMB server in the Linux kernel), repeated SMB2 NEGOTIATE requests are not rejected. An unauthenticated client can send multiple such requests, leading to memory leaks because only the last allocation is freed.

In netfilter ipset, there is an issue with updating comments from kernel-side operations. During table resize, comment pointers are copied, and a packet-side update can free a shared comment, leading to use of a dangling pointer.

In the Linux kernel, of_pci_range_parser_one() has a NULL pointer dereference. When a node has ranges but no local #address-cells, of_match_bus() returns NULL, causing a crash during iteration.

In TIPC, there is a use-after-free vulnerability in tipc_poll() during queue dumps via tracepoints. The tracepoint call without holding a lock allows access to freed packets.

In the Linux kernel's mac80211 subsystem, a use-after-free vulnerability was found in ieee80211_stop_tx_ba_cb(). After stopping a BA session, the tid_tx structure is freed via kfree_rcu(), and then the tid_tx->ndp field is read without proper RCU protection, potentially accessing freed memory. The issue occurs during local session teardown, e.g., on idle timeout, PTK rekey, suspend, or HW reconfig.

In the Linux kernel, the mwifiex driver has a vulnerability where the A-MSDU parent frame length is used instead of the subframe length when parsing TDLS frames. This leads to a use-after-free or out-of-bounds read, potentially exploitable by a remote attacker.

In binfmt_misc, there is an issue with restoring write access after removing an entry. Registering an entry with the MISC_FMT_OPEN_FILE flag blocks write access to the interpreter, and removing the entry does not restore access, causing persistent ETXTBSY errors.

In the Linux kernel, the binfmt_misc module has an inconsistency between deny_write_access() and exe_file_allow_write_access() when handling interpreter clones. This can lead to incorrect decrementing of i_writecount, making the interpreter unwritable even after the entry is removed.

In the Linux kernel's binfmt_misc module, a vulnerability allows an out-of-bounds read when the user-chosen field delimiter is also a flag character (P, O, C, or F). The flag parser fails to stop at the buffer padding and reads past the allocated memory. This is reachable by unprivileged users in a user namespace.

A vulnerability in the Linux kernel's binfmt_misc mechanism allows an 'F' entry to pin its own instance, causing a superblock deadlock and memory leak. An attacker can exploit this flaw to cause a denial of service (DoS) and permanently consume user namespace charges.

A vulnerability in the Linux kernel's binfmt_misc mechanism causes a user namespace reference leak when a mount operation fails. Due to improper superblock lifecycle handling, an unprivileged user can intentionally trigger mount failures and exhaust memory by accumulating unreleased namespaces.

A vulnerability was found in the Linux kernel's huge page splitting mechanism in mm/huge_memory. After splitting a folio, the code still accessed the mapping structure (i_mmap_rwsem) after the split folios were unlocked and freed, leading to a use-after-free. This occurs especially during memory failure handling for poisoned tails of shmem folios.

A use-after-free (UAF) vulnerability was found in the Linux kernel during system suspend (S3) or hibernation (S4). The page reporting work (page_reporting_process) was scheduled on the global system_wq, which lacks the WQ_FREEZABLE flag, leaving it active during suspend and causing access to deleted virtqueues, leading to a crash. The fix switches to system_freezable_wq, which is frozen before device drivers destroy their virtqueues.

A use-after-free vulnerability has been found in the Linux kernel's pktgen module. The issue involves a race between network device renaming and removal of the /proc entry, which can lead to accessing freed memory by the kpktgend thread.

In the Linux kernel, the uprobes mechanism has a NULL pointer dereference bug in hprobe_expire() when forking a process with a pending uretprobe. This can cause a kernel oops.

In the Linux kernel, the ublk module's ublk_ctrl_add_dev() function does not reset driver-owned dev_info fields such as ->state and ->ublksrv_pid after copying data from userspace. This can lead to crashes (oops) when deleting a device or to incorrect behavior.

In the Linux kernel, the tracing module's trace_module_add_events() function ignores the return value of __register_event() and unconditionally calls __add_event_to_tracers(). If event registration fails, it can lead to a use-after-free.

In the Linux kernel, the scsi_debug module's resp_report_zones() function has an underflow vulnerability in alloc_len calculations, which on 32-bit systems can lead to an out-of-bounds write and kernel panic.

In the Linux kernel, the SCTP module's sctp_assoc_add_peer() function increments the 16-bit transport_count, which can wrap to zero after adding 65,536 unique peers. This can lead to an out-of-bounds write in SCTP diagnostics (sock_diag).

In the Linux kernel, a vulnerability was found in the PCH GPIO driver where pch_irq_type() uses a regular spinlock (spinlock_t) in a context requiring a raw spinlock (raw_spinlock_t). On PREEMPT_RT systems, a regular spinlock is an rtmutex-based sleeping lock, leading to an invalid sleep in atomic context and a kernel BUG.

In the Linux kernel, the s390/qeth module lacks a CAP_NET_ADMIN check for private ioctls (SIOCDEVPRIVATE), allowing unprivileged users to invoke these commands.

In the Linux kernel, in the s390/zcrypt subsystem, a speculative memory read possibility was found. The user-controlled domain value is used as an array index after bounds checking, but without a speculation barrier. The missing array_index_nospec() call was added to prevent speculative execution.

A use-after-free vulnerability was found in the Linux kernel's Open vSwitch module. The issue occurs when attaching a newly created meter: attach_meter() can make the meter visible to other CPUs but still fail afterwards. On failure, ovs_meter_cmd_set() frees the meter without waiting for RCU readers, leading to use-after-free.

In the Linux kernel, in the openvswitch module, a skb leak was found on flow key update failure during connection tracking. ovs_ct_execute() always steals or frees the skb on failure, but ovs_flow_key_update() does not, leading to a memory leak. The fix breaks out of the loop and lets the common error handling code free the skb properly.

A severe AB/BA deadlock between the Common Clock Framework (CCF) and the I2C adapter lock in the Linux kernel's jz4780 driver has been fixed. The issue occurred when an I2C-controlled clock generator client (e.g., Si5351) changed frequency while a parallel transfer on the same bus called clk_get_rate() in the active transfer path, causing a system freeze. The fix caches the static host clock rate during probe and uses it in jz4780_i2c_set_speed(), removing the dependency on CCF internal locks during transfers.

In the Linux kernel, in the i2c: imx driver, a problem was found where the I2C adapter was not marked as suspended when hardware is powered down. During the time window between suspend_noirq and system entering suspend, and between resume start and resume_noirq, I2C controller resources (clock, pinctrl) may be unavailable. If a workqueue triggers an I2C transfer in this period, it may lead to system hang. The fix marks the adapter as suspended during noirq suspend and blocks new transfers until resume.

In the Linux kernel, in the i2c: imx driver, a problem was found where the hrtimer was not canceled before clearing the slave pointer. In i2c_imx_unreg_slave(), the slave pointer is set to NULL after disabling interrupts, but a pending interrupt might have already started the hrtimer. If the hrtimer fires after slave is set to NULL, it can lead to use-after-free or NULL pointer dereference. The fix cancels the hrtimer and waits for it to complete before clearing the slave pointer.

In the Linux kernel, the ems_usb driver for CAN bus added validation of CPC message lengths. The ems_usb_read_bulk_callback() function processes CPC messages in a USB buffer and now checks that each message fits in the URB payload and that its type-specific part covers the fields used by the CAN, state, error, and overrun handlers.

In the Linux kernel, the etas_es58x driver for CAN bus fixed an RX buffer leak in es58x_read_bulk_callback() on URB resubmit failure. When usb_submit_urb() fails, the callback unanchors the URB and returns without freeing the buffer allocated by usb_alloc_coherent(), causing a memory leak.

In the Linux kernel, the kvaser_usb_leaf driver for CAN bus added validation of received command lengths in kvaser_usb_leaf_wait_cmd(). Commands with non-zero length that do not contain the fixed header or extend beyond the current USB buffer item are rejected, and in the wait path also commands exceeding the destination structure size.

In the Linux kernel, the peak_usb driver for CAN bus added bounds checking for the USB channel index. The ctrl_idx index comes from USB data and can take values 0-15, but the usb_if->dev[] array has only 2 elements, leading to heap out-of-bounds read and kernel panic in IRQ context.

In the Linux kernel, the peak_usb driver for CAN bus fixed a double free of the transfer buffer in peak_usb_start() on URB submit error. The buffer is freed explicitly by kfree(buf) and then again by usb_free_urb() due to the URB_FREE_BUFFER flag, leading to a double free.

In the Linux kernel, the peak_usb driver for CAN bus added validation of uCAN receive record lengths in pcan_usb_fd_decode_buf(). Each record must contain the fixed header for its type, and CAN payload bytes are verified before copying them into the skb.

In the Linux kernel, the drm/vc4 graphics driver fixed a bug where BPOS was set to the whole binner BO size instead of the overflow slot size. This allows the PTB to write tile lists outside the intended area, leading to memory corruption by GPU DMA, GPU hangs, and system crashes.

In the Linux kernel, the drm/vc4 graphics driver added zeroing of the Tile State Data Array (TSDA) before each BIN job. Previously, binner slots were reused without clearing, which could cause the PTB to act on stale data and lead to GPU hangs.

In the Linux kernel, the drm/panthor graphics driver added rejection of firmware sections with oversized data. Previously, the data size to copy was not validated against the allocated section size, which could lead to heap buffer overflow and massive out-of-bounds zeroing of kernel memory.

In the Linux kernel, the drm/panthor graphics driver added validation of firmware interface structure sizes. The iface_fw_to_cpu_addr() function only checked that the MCU virtual address points inside the shared section, but did not check that the entire structure fits, which could lead to out-of-bounds accesses.

In the Linux kernel, the amdgpu driver has a use-after-free vulnerability in amdgpu_dpm_get_pp_table(). The function returns a pointer to the power table after dropping the mutex, and a concurrent pp_table write can free the memory during the copy, leading to use-after-free. The fix copies data into caller-provided storage while holding the mutex.

In the Linux kernel, the amdgpu display driver has a divide-by-zero vulnerability in calculate_mcache_setting when the viewport has zero area. This causes a kernel panic and potential underflow on num_mcaches. The fix changes the function to return bool and adds guards to reject the mode when values are zero.

In the Linux kernel, the amdkfd driver has a QID bit leak in pqm_create_queue(). When kernel memory allocation fails during the first queue creation, the function returns early without clearing the QID bit, causing a permanent leak of queue slots. The fix changes the error path to goto err_allocate_pqn to always call clear_bit.

In the Linux kernel, the amdkfd driver has a uint32_t overflow vulnerability in EOP ring buffer size alignment. A user-supplied size of 0xFFFFF001 wraps to 0, bypassing the size check and allowing acceptance of any BO. This can lead to out-of-bounds writes and GPU faults.

In the Linux kernel, the amdkfd driver has a race condition in kfd_criu_checkpoint_events(). The counting and walking of events are not protected by event_mutex, which can lead to out-of-bounds writes or use-after-free. The fix holds the mutex during both operations.

In the Linux kernel, the vmwgfx driver has a vulnerability where DX_BIND_QUERY is processed without checking for a DX context. A user can trigger a NULL pointer dereference, causing a kernel panic. The fix adds an early rejection when no DX context is present.

In the Linux kernel, the vmwgfx driver has a vulnerability where the DRAW_PRIMITIVES header size is not validated before division. A small header size causes unsigned subtraction to wrap, leading to an out-of-bounds read. The fix rejects undersized headers.