Linux kernel vulnerabilities

In the cpm_fwtp_msg_handler function in cpm/google/lib/tracepoint/cpm_fwtp_ipc.c, there is a possible memory overwrite due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

A use-after-free vulnerability has been identified in the Linux kernel in the geneve_find_dev() function. The issue arises when the geneve_dev.next structure is linked to a backend UDP socket that has already been freed.

A vulnerability has been identified in the Linux kernel related to the unused check_buddy_priv function in the rtlwifi driver. This function, although added, was never utilized, leading to potential issues with accessing freed memory during a second probe.

A vulnerability has been identified in the Linux kernel in the __neigh_notify() function, which can be called without RTNL or RCU protection. A fix has been implemented to use RCU protection to avoid potential use-after-free (UAF) issues.

A vulnerability has been identified in the Linux kernel in the function ovs_vport_cmd_fill_info(), which can be called without proper RCU or RTNL protection. Using RCU protection and dev_net_rcu() helps avoid potential use-after-free (UAF) errors.

A vulnerability related to virtual socket (vsock) handling has been resolved in the Linux kernel. The issue was improper management of socket bindings, leading to a use-after-free error during transport reassignment.

A vulnerability in the Linux kernel has been resolved by adding a gain range check in the 'wlc_phy_iqcal_gainparams_nphy()' function. This change aims to prevent potential out-of-bounds access to memory.

A use-after-free vulnerability was identified in the Linux kernel in the padata_reorder function, which may lead to unexpected system behavior. The issue was detected during LTP testing, where a bug related to reading memory after it has been freed occurred.

A Use-After-Free (UAF) vulnerability has been identified in the Linux kernel within the reorder_work function, which may lead to unauthorized memory access. This issue occurs during the processing of cryptographic requests, potentially resulting in unpredictable system behavior.

A vulnerability in the Linux kernel related to a shift-out-of-bounds in the iova_bitmap_offset_to_index() function has been resolved. This issue could lead to undefined behavior when the shift value exceeds 31 bits.

A vulnerability has been identified in the Linux kernel related to improper CPU state management during hotplug operations. The issue arises when a CPU transitions through various states, leading to incorrect assumptions about hrtick activity and the cpu_base.online state.

A vulnerability has been identified in the Linux kernel that allows indexing an out-of-bounds class in the ets_class_from_arg() function when clid is passed as 0. This overflow may lead to local privilege escalation.

A use-after-free (UAF) vulnerability has been identified in the Linux kernel within the blkcg_unpin_online() function. The issue occurs while traversing the blkcg hierarchy, potentially leading to unexpected system behavior.

A use-after-free (UAF) vulnerability has been identified in the Linux kernel in the bfq_limit_depth() function. The issue arises when bfqq is dereferenced without proper locking, which can lead to unexpected behavior when the io_context is shared by multiple tasks.

A vulnerability has been identified in the Linux kernel within the qdisc_tree_reduce_backlog function, which may lead to a use-after-free (UAF) due to incorrect assumptions about qdiscs with major handle ffff:. This issue has been resolved in an update.

A vulnerability has been identified in the Linux kernel related to the trie_get_next_key() function. This function allocates a node stack of size trie->max_prefixlen but writes (trie->max_prefixlen + 1) nodes, leading to out-of-bounds writes.

A vulnerability in the Linux kernel has been fixed that occurred when building an SMB2_IOCTL request. The issue was related to the client using encryption, leading to out-of-bounds writes when a user passed a buffer larger than expected.

A vulnerability has been identified in the Linux kernel affecting USB Type-C altmode devices. The issue was that the altmode device release did not keep a reference to its parent device, which could lead to errors in object management.

A vulnerability has been identified in the Linux kernel within the 'taprio_change()' function that may lead to a use-after-free situation. Due to a scheduler switch or removal, the 'admin' pointer may become dangling, which was detected by KASAN.

A vulnerability has been identified in the Linux kernel in the `nfs4_state_shutdown_net` function, which may lead to use-after-free errors. The issue occurs during the concurrent operation of `nfsd_client_shrinker` and the attempt to release resources associated with the NFS client.

A vulnerability has been identified in the Linux kernel within the ppp_async_encode function, which may lead to illegal access related to incorrect data size. The issue occurs when pppoe_sendmsg() is called with a zero size, resulting in an empty skb being passed to ppp_async_encode.

A vulnerability has been identified in the Linux kernel related to improper access to an uninitialized value in the lzo1x_1_do_compress function. The issue concerns the ea_buf variable, which was not properly initialized, potentially leading to unpredictable system behavior.

A vulnerability has been identified and resolved in the Linux kernel. The issue pertains to the 'rtw_wait_firmware_completion()' function, which improperly handled concurrent firmware loading, potentially leading to memory management errors.

A vulnerability has been identified in the Linux kernel related to the incorrect definition of the value for AMDGPU_DMUB_NOTIFICATION_MAX, potentially leading to out-of-bounds access in the array.

A vulnerability has been identified in the Linux kernel that allows up to three bytes of buffer to be leaked when sending packets shorter than 60 bytes. This issue can be resolved by padding all packets to ETH_ZLEN.

A vulnerability in the Linux kernel related to a KASAN bug was fixed, which occurred when writing data that was not 4-byte aligned to TX FIFO. This issue could be reproduced by writing 3 bytes of data to a NOR chip.

A vulnerability has been identified in the Linux kernel that led to underflows when writing limit attributes in hwmon. This issue occurred when a user provided a large negative number, resulting in incorrect calculations.

A use-after-free vulnerability has been identified in the Linux kernel that occurs during the concurrent occurrence of a DPC event and hot removal of the same portion of the hierarchy. This issue can lead to kernel crashes when accessing the pci_dev structure after the device has been removed.

In the Linux kernel, a vulnerability related to the zap_modalias_env() function has been fixed, which incorrectly calculated the size of the memory block to move, leading to out-of-bounds memory access.

A vulnerability has been identified in the Linux kernel related to the allocation of the cpumask variable on the stack, which may lead to stack overflow. It has been resolved by recommending the use of the *cpumask_var API for neutral configuration allocation of the cpumask variable.

A vulnerability in the Linux kernel related to the allocation of cpumask variable on the stack has been resolved. When CONFIG_CPUMASK_OFFSTACK is enabled, such allocation can lead to potential stack overflow.

A vulnerability related to incorrect signed integer overflow checking in the block ioctl code has been resolved in the Linux kernel.

A vulnerability has been identified in the Linux kernel that leads to a crash when reading a debugfs attribute in the qedi_dbg_do_not_recover_cmd_read() function. The issue arises from directly invoking sprintf() on a __user pointer, resulting in a system crash.

A vulnerability has been identified in the Linux kernel regarding improper string termination in a kernel buffer. The issue arises from copying data from user space without ensuring the string is NUL terminated, which can lead to out-of-bounds reads.

A vulnerability related to the Bluetooth protocol in the Linux kernel has been fixed, which involved not validating the length of user input data before copying it.

A vulnerability has been identified in the Linux kernel related to a possible use-after-free issue during kprobe registration. This issue occurs when the module's state changes during operations, potentially leading to attempts to modify a non-existent module text address.

A vulnerability has been identified in the Linux kernel that led to infinite recursion in the fib6_dump_done() function during netlink socket destruction. The issue occurred due to memory allocation errors, which could lead to system crashes.

A vulnerability in the Linux kernel has been fixed that led to an information leak in the btrfs_ioctl_logical_to_ino() function. The issue was reported by Syzbot and involved improper data copying to user space.

A vulnerability in the Linux kernel has been fixed that caused a warning in rds_conn_connect_if_down. The issue occurred when a connection was not yet established, resulting in a failure in get_mr().

A vulnerability has been identified in the Linux kernel that may lead to a memory overflow in the static_command_line variable. The issue arises from incorrect memory size calculation, which can result in memory corruption when the length of command_line exceeds that of boot_command_line.

A vulnerability has been identified in the Linux kernel that involves a lack of validation for the inode number, leading to out of bounds access in the fill_meta_index() function. This issue arises when the inode number is set to zero, which is an invalid value.

A vulnerability has been identified in the Linux kernel leading to a deadlock in the usb_deauthorize_interface() function. The issue occurs when a process attempts to remove a USB interface while another process holds a lock on the parent device.

A vulnerability related to hashtab overflow on 32-bit architectures has been fixed in the Linux kernel. The issue stemmed from improper overflow checking, which could lead to undefined behavior.

A use-after-free vulnerability has been identified in the Linux kernel within the ip6_route_mpath_notify() function. The previous fix did not address the root cause, leading to potential memory management errors.

The Linux kernel before version 6.5.4 has a use-after-free vulnerability in fs/ext4/extents_status.c, related to the ext4_es_insert_extent function.

In the Linux kernel before version 5.13.4, a vulnerability exists that may allow remote attackers to cause a denial of service through out-of-bounds reads in strlen when the trace event framework is used for nfsd.

The check_stack_boundary function in the Linux kernel through version 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by mishandling invalid variable stack read operations.

The Linux kernel through version 4.14.8 contains a vulnerability that allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact due to the lack of stack-pointer alignment enforcement.

The Linux kernel up to version 4.14.8 has a vulnerability that allows local users to cause a denial of service (memory corruption) by improperly using pointers instead of scalars.

The Linux kernel through version 4.14.8 has a vulnerability that allows local users to cause a denial of service through integer overflow and memory corruption by leveraging unrestricted integer values for pointer arithmetic.