Linux kernel vulnerabilities

A bug in the Linux kernel's x86 alternatives patching code can cause a kernel crash (BUG_ON) in __text_poke. This occurs when vmalloc_to_page() fails due to a race between text poking and change_page_attr (CPA), particularly when CONFIG_ARCH_HAS_EXECMEM_ROX=y and modules share a single execmem range and call set_memory_*() in parallel. The fix excludes this race by using the init_mm mmap read lock.

A race condition exists in the Linux kernel's __slab_try_return_freelist() function in mm/slab. The function incorrectly assumed that if freelist is NULL and cmpxchg succeeds, no other CPU has freed an object to the slab, leading to a classic ABA problem and list corruption. This results in a kernel panic and denial of service (DoS).

A use-after-free flaw exists in the Linux kernel ftrace subsystem during process forking. The function graph state is initialized too late — after copy_exec_state() — so if the task_exec_state allocation fails, free_task() releases the parent's return stack (ret_stack), which the parent then accesses as freed memory.

In the Linux kernel, the tracing enable_event trigger deferred trace_event_put_ref() to the trigger free kthread, but the associated trace_event_file could already be freed when the instance was removed. This led to a use-after-free. The fix keeps the trace_event_call directly in enable_trigger_data so the deferred free does not access the freed trace_event_file.

In the Linux kernel, the ALSA usbusx2y driver's i_usx2y_in04_int() processes URB data without checking urb->actual_length. A short transfer from a malfunctioning device causes the handler to process uninitialized heap data from in04_buf, which is then copied to the mmap-accessible ctl_snapshot[] array. The fix uses kzalloc() and adds an actual_length check.

In the Linux kernel, the drm/amdgpu driver performs an unnecessary VMID 0 flush for clear-on-release operations on VRAM even though it does not program a GART window. On GFX11 chips (e.g. Navi33) this spurious SDMA flush can wedge the engine. The fix only flushes when a GART window is actually used.

In the Linux kernel accel/ivpu driver, ivpu_to_cpu_addr() did not validate the full buffer range. The lack of a check that the whole [vpu_addr, vpu_addr + size) range stays within the BO could lead to out-of-bounds access.

In the Linux kernel accel/ivpu driver, fw_log_print_buffer() re-read the log header fields from shared memory after they had been validated. This allowed a TOCTOU attack where the NPU firmware changes the values between check and use, causing out-of-bounds reads while printing logs.

In the Linux kernel accel/ivpu driver, printing the name from the tracing buffer header was not limited to the field size. The name field is a fixed-size array populated by the NPU firmware and is expected to be NUL-terminated, but a missing terminator caused reads past the field and exposed adjacent bytes via dmesg and debugfs.

In the Linux kernel accel/ethosu driver, ethosu_job_open() returned the value from WARN_ON() (0 or 1) instead of the original negative errno. This caused an incorrect return code to be passed to userspace.

In the Linux kernel accel/ethosu driver, the command stream was not ensured to end with a stop op. Although the QSIZE register setting should prevent out-of-bounds access, it is unclear whether the hardware generates the required interrupt, which could lead to a timeout.

In the Linux kernel, in the accel: ethosu driver, on SRAM mapping failure, the SRAM size is left non-zero. This allows jobs to access SRAM which points to physical base address 0x0.

In the Linux kernel, in the accel: ethosu driver, userspace can set the job SRAM size to 0 but still have SRAM accesses in the command stream. When the job SRAM size is 0, setting the region base register is skipped, leading to use of a stale base address from a prior job.

In the Linux kernel, in Bluetooth: btqcomsmd, the teardown order is incorrect: hci_dev is freed before destroying the RPMsg endpoints. If WCNSS delivers data in that window, the callback can run with an already freed hci_dev.

A use-after-free vulnerability exists in the Linux kernel's proc_flush_pid() function during process exit. Due to an incorrect assumption about holding a reference to thread_pid, the PID can be freed by an RCU callback before proc_flush_pid() completes. The vulnerability can be triggered by an unprivileged user via a race between wait4(-1) and setsid().

A vulnerability was found in the Linux kernel's filesystem freezing mechanism. After a change in freeze counting, a nested thaw operation returned an incorrect -EINVAL error despite successfully releasing one freeze. This leads to a permanent block device lock, preventing remounting.

In the Linux kernel, the rockchip_dp_drm_encoder_enable() function in the drm/rockchip analogix_dp driver uses sprintf() to format a device tree path into a 32-byte stack buffer. Device tree paths are not limited to this size, so a sufficiently long path can overflow the buffer.

In the Linux kernel, the ring_buffer_subbuf_order_set() function stores the new order and only then checks CPUs, returning -EBUSY if any has resizing disabled. A user-mapped buffer has resizing disabled, and __rb_map_vma() reads buffer->subbuf_order without the mutex, so an mmap racing the failing order change can size the mapping incorrectly.

In the Linux kernel, in net/sched act_api when a batched RTM_NEWACTION request replaces an existing action, tcf_idr_check_alloc() takes a temporary reference. If a later action fails to initialize, tcf_action_destroy() uses strict release semantics, which for a filter-bound action returns -EPERM without dropping the reference. This leaks the action and its IDR slot.

In the Linux kernel's DSA tagger for Broadcom (tag_brcm), there is an issue with FCS calculation for nonlinear frames. The tagger does not declare the required tailroom, causing an out-of-bounds read (slab-out-of-bounds) during CRC calculation. The fix declares the required tailroom, which disables SG and FRAGLIST features and linearizes frames before processing.

In the Linux kernel's netfs module, there is an issue with an uninitialized return value in the netfs_unbuffered_write() function. If preparation of the first subrequest fails, the loop exits before ret is initialized, which can lead to returning an incorrect error code. The fix initializes ret to 0.

In the Linux kernel's autofs module, there is a memory leak in the autofs_fill_super() function. If creating root_inode fails, the function returns -ENOMEM without freeing the previously created inode, leading to a memory leak. The fix adds a call to autofs_free_ino() in the error path.

In the Linux kernel, the EROFS filesystem has a vulnerability in LZMA decoder pool resizing. On partial allocation failure, a broken stream remains in an inconsistent state, potentially passing NULL to xz_dec_microlzma_reset().

In the Linux kernel, the ieee802154 cc2520 driver has a use-after-free vulnerability in FIFOP work. After driver removal, the FIFOP interrupt can still queue work after flush, allowing execution after private data is freed.

In the Linux kernel, the iommu/s390 subsystem has a NULL pointer dereference in iova_to_phys() when using a 5-level translation table via ZPCI_TABLE_TYPE_RFX. get_rso_from_iova() returns NULL when the region-first entry is invalid, but get_rto_from_iova() does not check this before accessing rso[rsx].

In the Linux kernel, the s390/crypto subsystem lacks proper handling of the EBUSY return code in the PHMAC algorithm when a request is transferred to the crypto engine. crypto_transfer_hash_request_to_engine() returns EINPROGRESS or EBUSY to signal success, but EBUSY was not handled.

In the Linux kernel, the s390/crypto subsystem fails to scrub temporary buffers in the PAES algorithm. The buffer processing remaining bytes < AES_BLOCK_SIZE in ctr_paes_do_crypt() was not scrubbed, and __xts_2keys_prep_param() only scrubbed the key field instead of the whole parameter block.

In the Linux kernel, the s390/crypto subsystem returns an incorrect code in asynchronous crypto engine callbacks. When crypto_finalize_hash_request() or crypto_finalize_skcipher_request() explicitly completes a request, the do_one_request callback must return 0; returning a negative error code causes a double completion.

In the Linux kernel, the s390/crypto subsystem propagates persistent -EBUSY after exhausting key conversion retries to crypto_finalize_*_request(). The crypto API completion wrapper treats -EBUSY as a queueing status and swallows it, preventing the completion callback from firing.

In the Linux kernel, the RISC-V perf subsystem stored the available-counter mask as a single unsigned long, but iteration uses RISCV_MAX_COUNTERS which is 64. On RV32 this reads past the object, and setting an unsigned-long bit at index 32 and above is also wrong.

In the Linux kernel, the AFS subsystem's afs_dir_search_bucket() fails to kunmap the block it is using in the "bad:" path. This results in a missing kernel memory unmap.

In the Linux kernel, the AFS filesystem has a double-unmap issue in directory block handling. Manual kunmapping without clearing the pointer can lead to a double-kunmap if afs_dir_find_block() is called twice in a row.

In the Linux kernel, afs_lookup_server() incorrectly frees an existing server's endpoint state during candidate cleanup. The candidate record does not have an endpoint state at that point, so the free is unnecessary.

In the Linux kernel AFS subsystem, a use-after-free vulnerability was found due to improper clearing of peer app data during server address list updates, potentially leading to access of freed memory.

In the Linux kernel, the rkvdec HEVC driver has unbounded tile loops and PPS id in compute_tiles_uniform(), compute_tiles_non_uniform(), and assemble_hw_pps(). These functions may write out of bounds.

In the Linux kernel, a race between disconnect() and retransmission (rtx) in the MPTCP stack was identified, leading to inconsistent state. The fix prevents the race using a synchronous timer stop operation.

In the Linux kernel SMB client, CIFSSMBRead() reads READ_RSP header fields without first verifying that a complete READ_RSP was received. A malicious or compromised SMB1 server can return a response shorter than the READ_RSP header, causing an out-of-bounds read past the receive buffer. This only affects mounts explicitly configured with vers=1.0, as SMB1 is not negotiated by default.

In the Linux kernel, the CIFSSMBRead() function (SMB1 client) did not validate the DataOffset field in the server response. A malicious or compromised SMB1 server can return a large DataOffset with a valid DataLength, causing an out-of-bounds read past the response buffer — leaking kernel heap memory (information disclosure) or triggering an oops (denial of service). The vulnerability only affects mounts explicitly using vers=1.0, as SMB1 is not negotiated by default.

In the Linux kernel's SMB client, there is a cifsFileInfo reference leak in the deferred close mechanism due to a race condition between flags. The fix checks the return value of queue_delayed_work() and hands off the reference only if the work was actually queued.

In the XFS filesystem, a lock is missing when inserting the unmount event into the health monitor. The fix adds proper locking.

In the XFS filesystem, xfs_defer_finish_one() may return an uninitialized error value when the list is empty, which can lead to a false shutdown of the filesystem. The fix initializes the error variable to 0.

In the XFS filesystem, an incorrect args->total value during parent pointer updates can lead to improper free space checking and ENOSPC errors that escalate to a filesystem shutdown. The fix sets args->total in add and replace paths, similar to log recovery.

In the XFS filesystem, the unit conversion in the per_binval computation is backwards, leading to incorrect space calculation. The fix changes the conversion direction from FSB to bytes.

In the Linux kernel, the _maxlevels_ondisk functions for rtrmap and rtrefcount in XFS fail to account for the inode root when computing the size of in-memory btree cursors. With a sufficiently large btree, this can lead to accessing beyond the end of the cursor.

In the Linux kernel, XFS's xmi_can_exchange_reflink_flags() can move the reflink flag between files during range exchange, but when XFS_EXCHMAPS_INO1_WRITTEN is set, some mappings may be skipped. This can clear the reflink flag from an inode that still owns shared written extents, leading to data corruption.

In the Linux kernel, XFS's xrep_dir_recover_data can spin forever if it encounters an unused dirent that claims to have length zero. The fix also prevents the same issue with zero-length entries.

In the Linux kernel, XFS's xfs_btree_bload_prep_block may fail to release new_bp if xfs_btree_bload_drop_buf hits an I/O error while writing the delwri buffer list to disk. This results in a leaked locked buffer.

In the Linux kernel, XFS's xqcheck_mod_live_ino_dqtrx does not free the newly allocated dqa object if rhashtable insertion fails. This leads to a memory leak.

In the Linux kernel, XFS's xchk_dirtree_create_path fails to destroy the seen inode bitmap if the directory path object is created but appending the name to the path fails. A similar bug exists in xrep_dirtree_create_adoption_path.

In the Linux kernel, the hwmon asus_rog_ryujin driver did not validate HID report lengths before parsing response headers and payload fields. A short report could make the driver read uninitialized bytes from the HID buffer and expose them as sensor values via sysfs.