Linux kernel vulnerabilities

In the Linux kernel, the cls_bpf module has unbounded recursion in cls_bpf_offload_cmd, which can lead to stack overflow. The issue occurs when tc_setup_cb_replace() fails and the rollback attempt also fails, causing recursive calls.

In the Linux kernel, the host1x module has an issue where BO cache entries cannot be freed. Cached mappings hold a reference to the buffer object, preventing its release, leading to memory leak.

In the Linux kernel, the gpu: host1x driver has been fixed to correctly check the return value of iommu_map_sgtable(). The function now returns ssize_t with negative values on error, not size_t with zero. Additionally, pin_job() was incorrectly assigning to 'int', which could cause overflows into negative values.

In the Linux kernel, the dax/kmem subsystem has been fixed to handle partial discontiguous resources during removal. When dev_dax_kmem_probe() partially succeeds but a subsequent range fails, dev_dax_kmem_remove() may attempt to remove a non-existent resource, leading to NULL pointer dereference.

In the Linux kernel, the RDMA/rxe driver has been fixed for a TOCTOU heap overflow in get_srq_wqe(). The function reads num_sge from the shared receive queue buffer mapped into userspace, validates it, but then re-reads the same field to calculate memcpy size, allowing a concurrent thread to modify it and cause a heap buffer overflow.

In the Linux kernel, the RDMA/rxe driver has been fixed for the non-SRQ receive path, where WQE fields were read directly from the shared queue buffer mapped into userspace. This allowed a malicious user to modify fields during processing, leading to out-of-bounds reads.

In the Linux kernel, the md/raid1 and md/raid10 drivers have been fixed for a deadlock in the read error recovery path. Resubmitting a split md cloned bio can lead to a deadlock if the array is suspended, because trying to acquire another active_io reference via percpu_ref_tryget_live() may block.

In the Linux kernel, the md/raid1 and md/raid10 drivers have been fixed to detect the error path using md_cloned_bio() instead of relying on r1_bio or r10_bio->read_slot, which may be NULL or -1 after splitting and resubmitting a failed bio. The previous logic could lead to using GFP_NOIO instead of (GFP_NOIO | __GFP_HIGH), potentially causing a deadlock under memory pressure.

In the Linux kernel, the md/raid1 and md/raid10 drivers have been fixed for bio accounting of split md cloned bios. Instead of relying on r1bio_existed in raid1 or the io_accounting flag in raid10, md_cloned_bio() is used to control accounting, avoiding double accounting or missing accounting.

In the Linux kernel, the raid1 driver has been fixed for an nr_pending leak in the REQ_ATOMIC bad-block error path. In raid1_write_request(), each loop iteration increments rdev->nr_pending, but if a badblock is encountered, the code jumps to err_handle without decrementing the counter for the current mirror, leading to a permanent leak and preventing rdev removal.

A vulnerability in the Linux kernel's BPF_PROG_QUERY causes an out-of-bounds write when writing the 'query.revision' field to userspace. This occurs when userspace passes a smaller bpf_attr structure (e.g., 40 bytes, before the revision field was added), leading to a write beyond the allocated buffer. The fix propagates the user-provided attribute size to cgroup query handlers and conditionally skips writing the revision field when the buffer is too small.

In the Linux kernel, a TOCTOU race in luo_session_retrieve() of the liveupdate mechanism has been fixed. The rwsem_read lock scope was extended to overlap with the session mutex acquisition, preventing a concurrent thread from releasing and freeing the session between lookup and mutex lock.

In the Linux kernel, a use-after-free vulnerability in luo_file_unpreserve_files() and luo_file_finish() of the liveupdate mechanism has been fixed. The patch reorders module_put() and xa_erase() to ensure the file handler module remains pinned while its operations are accessed, preventing use of freed memory.

In the Linux kernel, a memory leak in the ath12k WiFi driver has been fixed in ath12k_wifi7_dp_rx_h_verify_tkip_mic(). When NWIFI header length validation fails, the function aborts with an error and the corresponding MSDU is never freed, leading to a memory leak.

In the Linux kernel, issues in ath12k_mac_vdev_create() of the ath12k WiFi driver have been fixed, which left the arvif object in an inconsistent state on error paths. The patch adjusts the control flow to ensure proper cleanup on vdev creation failures.

A vulnerability in the ath12k Wi-Fi driver causes a NULL pointer dereference during link operations when a channel validation fails and the driver is not properly initialized. This leads to a kernel crash when subsequent operations attempt to use uninitialized structures.

In the Linux kernel, a vulnerability in the BTT (Block Translation Table) mechanism for NVDIMM has been fixed, related to preemption during lane acquisition. The previous spinlock-based recursion model was invalid after lanes became preemptible, potentially leading to silent data corruption. The fix replaces the spinlock with a dynamically allocated per-lane mutex array.

In the Linux kernel, a vulnerability in the BPF mechanism has been fixed that allowed bypassing the exclusivity guarantee of BPF maps. Exclusive maps (created with excl_prog_hash) could be inserted into outer maps (map-of-maps) and mutated by unrelated programs, bypassing program compatibility checks.

In the Linux kernel, a use-after-free vulnerability in the bpffs filesystem has been fixed. A previous patch moved inode cleanup from free_inode() to destroy_inode(), removing the RCU delay and allowing access to freed memory during concurrent RCU pathwalk. The fix restores RCU-delayed freeing of the inode and the i_link buffer.

In the Linux kernel, a vulnerability in the ext2 filesystem has been fixed where the return value of generic_write_sync() was ignored in ext2_dio_write_iter(). The fix ensures error propagation, preventing write(2) from returning success when the sync failed.

In the Linux kernel, a vulnerability was found in the bpf_map_elem iterator mechanism. These iterators bind their target map at attach time, bypassing the exclusivity check for maps, allowing access to maps intended only for a single program. Additionally, the iterator exposes the map value as a writable buffer.

In the Linux kernel, configfs_lookup() has a bug that leaves a dangling ->s_dentry pointer when inode allocation fails. This leads to a use-after-free during subsequent getdents(2) operations in the directory.

In the Linux kernel, the ext4 filesystem has a bug in the wait/wake bit mapping for fast commit on 64-bit architectures. The wait and wake functions used raw EXT4_STATE_* values instead of the appropriate +32 offset, causing incorrect synchronization.

In the Linux kernel, a vulnerability in the amdgpu driver causes a slab-out-of-bounds write during coredump generation after a GPU reset. The issue stems from a race condition between two loops processing GPU rings, where the ring count can change between counting and copying.

In the Linux kernel, the vhost subsystem's vhost_get_avail_idx returns an incorrect value, indicating all entries consumed instead of an index update. This can lead to host livelock when the guest is not making progress, as vhost immediately disables notifications and retries.

In the Linux kernel, the iommu/vt-d subsystem has a bug causing RB-tree corruption in the probe error path. If a device does not support ATS, the RB node remains zeroed, and on a subsequent probe failure, the removal misinterprets it as a tree root, corrupting the tree.

In the Linux kernel, a vulnerability in the zap_pages() function in BPF was fixed, which required holding mmap_lock. Previously, improper locking could lead to synchronization issues and potential use-after-free during memory map operations.

In the Linux kernel, a problem in the amdkfd graphics driver was fixed where good queues were not properly restored after a failed suspend_all. Now resume_all is always executed after suspend_all, and remove_queue is performed even on failure.

In the Linux kernel, a use-after-free vulnerability in the reserved memory mechanism was fixed. When alloc_reserved_mem_array() fails, the global pointer reserved_mem still references memory in the __initdata section, which after initialization can lead to dereferencing freed memory.

In the Linux kernel, a use-after-free vulnerability was found in the OCFS2 debugfs locking_state iterator. The iterator copies the ocfs2_lock_res structure, but the LVB pointer (sb_lvbptr) still points to the original object, which can be freed before the data is read, leading to access to freed memory.

In the Linux kernel, a vulnerability in the OCFS2 filesystem was fixed where FITRIM accepted ranges shorter than the cluster size, leading to arithmetic underflow and potential trimming beyond the requested range. Now ranges shorter than the cluster size are rejected.

In the Linux kernel, a use-after-free vulnerability was found in the OCFS2 filesystem's debugfs locking_state mechanism. The debug_lockres_open() function ignores the return value of dlm_grab(), allowing a raw pointer to a freed dlm_ctxt structure to be stored and later used in debug_lockres_release() after domain unregistration. This leads to a slab-use-after-free condition reported by KASAN.

In the Linux kernel, a vulnerability in the netfilter cttimeout module was fixed by changing reference counting for timeout policies. Now the refcount is only used for conntrack entries, allowing immediate removal of policies from nfnetlink_cttimeout.

In the Linux kernel, a vulnerability in the RDMA/irdma driver was fixed that caused an out-of-bounds read during CQ memory registration. The issue was due to improper setting of the cqmr->split field, leading to an out-of-bounds read for GEN_2 and newer hardware.

In the Linux kernel BPF mechanism, when freeing bpf_rb_root, the red-black tree node pointers are not cleared. If the object survives the free, it may contain stale pointers to the freed structure, which upon address reuse can lead to incorrect tree removal.

In the Linux kernel kernfs mechanism, there is a race in xattr operations when multiple superblocks with different namespaces share the same kernfs_node. xattr operations are not properly serialized, which can lead to a race in simple_xattr_set().

A vulnerability in the Linux kernel's kernfs subsystem causes a NULL pointer dereference when a new node is created, because the parent and root pointers are not yet initialized when the LSM security hook runs. This leads to a kernel panic, reproducible deterministically on SELinux-enabled systems during the first cgroup mkdir by systemd.

In the Linux kernel wifi driver wcn36xx, there is a heap overflow due to lack of validation of the HAL response length from firmware. A response larger than 4096 bytes can overflow the hal_buf buffer.

In the Linux kernel wifi driver wcn36xx, there is an out-of-bounds read caused by lack of validation of the firmware-controlled count field in the PRINT_REG_INFO message. An overly large count can lead to reading beyond the buffer.

In the Linux kernel ALSA seq, snd_seq_read() copies a variable-length event header to userspace without clearing the data.ext.ptr pointer, which can leak the kernel address of the extension cell.

In the Linux kernel BPF mechanism, there is a lack of rejection of BPF_LSM_CGROUP programs marked as sleepable during load. This can lead to calling sleeping functions in a context where it is not allowed, causing a kernel error.

In the Linux kernel BPF mechanism, there is a deadlock on re-entry from NMI or tracepoint into LRU locks. BPF programs can re-enter a lock already held on the same CPU, causing AA-deadlock.

In the Linux kernel mac80211 mechanism, ieee80211_s1g_check_tim() passes an incorrect end pointer for the PVB walk, which can lead to an out-of-bounds read beyond the TIM element.

In the Linux kernel function bpf_task_from_vpid(), there is a NULL pointer dereference when the current task is in do_exit() and its PID namespace is already cleared. cgroup_skb programs running in softirq can call this function and cause a kernel error.

In the Linux kernel, the RDMA/nldev subsystem has a locking issue when accessing the mr->pd pointer, which can change during rereg_mr. The fix uses mr->device instead of mr->pd->device and adds an rdma_restrack_sync() operation to safely access the PD restrack ID.

In the Linux kernel, the ASoC driver for AMD (acp-sdw-legacy) has an out-of-bounds read in create_sdw_dailinks(). The loop iterates over the soc_dais array, which has exactly num_ends entries, but if all are initialized, the read goes past the end of the array, as reported by KASAN.

In the Linux kernel, the ASoC driver for AMD (acp-sdw-sof) has an out-of-bounds read in create_sdw_dailinks(). The loop iterates over the sof_dais array, which has exactly num_ends entries, but if all are initialized, the read goes past the end of the array.

In the Linux kernel, the firmware_loader module has a deadlock caused by recursive locking in device_cache_fw_images(). During suspend or hibernation preparation, fw_pm_notify() calls this function, which holds fw_lock while iterating over devices. If memory allocation for the async work fails, the work is executed synchronously, leading to a recursive acquisition of fw_lock and a deadlock.

In the Linux kernel, the configfs filesystem has an issue with lockless traversals of ->s_children. Having the parent directory locked protects entries from removal by another thread, but it does not protect cursors from being moved around by lseek() or freed.

In the Linux kernel, the watchdog subsystem has an issue with PM notifier registration. watchdog_register_device() registers wdd->pm_nb, but watchdog_unregister_device() does not remove it, leaving an embedded notifier block on the PM notifier chain. Later suspend/resume notifications can call watchdog_pm_notifier() with a stale watchdog_device pointer.