Linux kernel vulnerabilities

In the Linux kernel, the iommufd subsystem has an ordering issue when detaching from dmabuf. The mutex could still be in use through the dmabuf invalidation callbacks, so the pages content should not be destroyed until the dmabuf is fully detached.

In the Linux kernel, the is_vm_area_hugepages() function has a bug where it does not check the return value of find_vm_area(), which can return NULL for an invalid address. This leads to a NULL pointer dereference and kernel crash.

In the Linux kernel, the mt76 WiFi driver (model mt7921) has a resource leak in the probe error path. When pcim_iomap_region() or devm_kmemdup() fails, the code returns directly without cleaning up previously allocated resources, such as mt76_device and PCI IRQ vectors.

In the Linux kernel, the mt76 WiFi driver has a use-after-free issue in mt76_put_vif_phy_link(). The function frees the offchannel mlink with kfree(), but rcu_assign_pointer does not wait for existing RCU readers who may still hold the pointer. The TX path can dereference freed memory.

In the Linux kernel, the mt7925 driver's mt7925_tm_query() function copies data from the firmware response without checking its length. If the response is shorter than the expected 520 bytes, an out-of-bounds read occurs, and the extra data is returned to userspace. A length check was added before the copy.

In the Linux kernel, the mt7996 driver's mt7996_tx_prepare_skb() function may leak transmission tokens if the link_conf or link_sta lookup fails. The token is allocated before the check and is not released on error. The fix releases the token in case of error.

In the Linux kernel, the mt7996 driver's mt7996_mac_write_txwi_80211() function may dereference a NULL pointer when a frame is injected (e.g., via radiotap), because mac80211 can pass info->control.vif = NULL. A check for the vif pointer was added before calling ieee80211_vif_is_mld().

In the Linux kernel, the __btrfs_run_delayed_refs() function of the Btrfs filesystem has an invalid pointer dereference. When btrfs_select_ref_head() returns -EAGAIN, the locked_ref variable remains an error pointer and is then used in spin_lock(), leading to dereferencing an invalid address. The fix resets locked_ref to NULL and increments the counter to avoid looping.

In the Linux kernel, the sm501fb driver has errors in the OF binding code: use-after-free, buffer overrun, and memory leaks. EDID data is not freed on error, and when both CRT and PANEL are enabled, data is used after being freed and freed twice. Additionally, the string from of_get_property is copied without length checking. The fix uses kstrdup() and frees memory before freeing info.

In the Linux kernel, the Btrfs filesystem on zoned disks has a deadlock during data relocation. The relocation process waits on a space reservation ticket that can never be fulfilled because the relocation itself is responsible for freeing that space. The fix introduces a new flush state that uses priority_reclaim_data_space() instead of the normal path to avoid the deadlock.

A vulnerability in the Linux kernel's Btrfs filesystem causes a deadlock when cloning inline extents while the filesystem is mounted with the flushoncommit option. The previous fix only covered the case where the destination offset is 0, missing offsets greater than zero. The issue was reported by syzbot and manifests as processes blocked for over 143 seconds.

In the Linux kernel, the ixgbe driver vulnerability involves calling netif_set_xps_queue() for XDP Tx queues that are not netdev-exposed. On systems with >=64 CPUs and E610 adapter, XDP configuration results in 64 XDP queues while max queue pairs is 63, causing a warning and KASAN report (slab-out-of-bounds). The fix skips XPS configuration for XDP Tx queues.

In the Linux kernel, the NFSD server's nfsd4_drop_revoked_stid() function does not handle the SC_TYPE_LAYOUT case, causing that when a client sends FREE_STATEID for an admin-revoked layout stid, the stid is not removed from the list or freed. The fix removes the layout stid from the list and calls nfs4_put_stid() to drop the reference.

A vulnerability in the Linux kernel's BPF mechanism related to map value recycling has been discovered. During map update or delete, special fields (e.g., timers, workqueues) were freed in the operation context, which could be unsafe in NMI context. A new cancel function has been introduced that performs only NMI-safe cleanup, leaving full destruction to the final cleanup path.

In the Linux kernel, vduse_dev_open() has a race condition between IDR lookup and acquiring the device lock. An attacker can exploit the window where VDUSE_DESTROY_DEV removes and frees the object before the open path locks it, leading to use-after-free.

In the Linux kernel, vhost_vdpa_mmap() and vhost_vdpa_fault() do not properly validate the virtqueue index before using it in get_vq_notification(). Missing check that the index is less than v->nvqs allows an out-of-range index to reach the driver, potentially leading to out-of-bounds access and system crash.

In the Linux kernel, the virtio:rtc driver does not delete old virtqueues before reinitializing them during device restore. If reinitialization fails, a NULL pointer dereference can occur in vp_del_vq(), crashing the guest kernel.

In the Linux kernel, when the data=journal mount option is used, ext4_journalled_write_end() incorrectly calls ext4_write_inline_data_end() without checking the EXT4_STATE_MAY_INLINE_DATA flag. This can trigger a BUG_ON in ext4_write_inline_data(), causing a kernel crash.

A vulnerability was found in the Linux kernel's ext4 filesystem related to the EXT4_IOC_MOVE_EXT operation. The donor file validation was performed too late, after acquiring locks, which could lead to a deadlock when combined with a concurrent filesystem freeze. The fix moves the superblock check before any locking operations.

In the Linux kernel, the vfio/qat driver's qat_vf_resume_write() checks the file position before taking the migf->lock, but copies data after taking the lock and re-reading the position. Two concurrent writers can bypass the bounds check and write past the end of the migration-state buffer.

In the Linux kernel, the BPF cookie compatibility check for program arrays is insufficient. A program without cgroup storage can be considered compatible with any storage cookie, allowing a bridge in a tail call chain between an entry program and a storage-using callee, leading to incorrect access to cgroup local storage.

In the Linux kernel, the Bluetooth hci_qca driver has a NULL pointer dereference in qca_setup() for non-serdev devices. hu->serdev is NULL, and the function unconditionally calls serdev_device_get_drvdata(hu->serdev), causing a crash. The fix adds a NULL check before dereferencing.

In the Linux kernel, the Bluetooth hci_qca driver has a NULL pointer dereference in qca_dmp_hdr() for non-serdev devices. hu->serdev is NULL, and the function unconditionally dereferences hu->serdev->dev.driver->name, causing a crash. The fix adds a NULL check and falls back to "hci_ldisc_qca".

In the Linux kernel, the Bluetooth hci_core subsystem has a use-after-free vulnerability in hci_unregister_dev(). The function does not disable cmd_timer and ncmd_timer before freeing the hci_dev structure. If a timer fires during device teardown, the callback dereferences freed memory, leading to use-after-free. The fix adds disable_delayed_work_sync() calls alongside existing disable_work_sync().

In the Linux kernel, the Bluetooth btmtk driver has a URB leak in the error path of alloc_mtk_intr_urb. When btmtk_isopkt_pad() fails, the previously allocated URB is not freed, leading to memory leak. The fix adds usb_free_urb() before returning the error.

In the Linux kernel, the Bluetooth hci subsystem has a vulnerability due to improper validation of the capability element length in controller responses. hci_read_codec_capabilities() only checks the payload length but does not account for the length byte, allowing out-of-bounds read. The fix validates the full element size including the length byte.

In the Linux kernel, the RDMA/core subsystem has an error in the flow of moving FRMR handles between queues. When moving to a non-empty inactive queue fails due to page allocation failure, the handle is not handled and mkey leaks. The fix introduces push_queue_to_queue_locked() that performs no allocation and simplifies error handling.

In the Linux kernel, the RDMA/core subsystem has an error in the error path when setting FRMR as pinned. When the push to the pool fails, FRMR handles are not destroyed, leading to resource leak. The fix adds destruction of FRMR handles in case of push failure.

In the Linux kernel, the RDMA/mlx5 driver has an undefined shift of user RQ WQE size. set_rq_size() computes the size as "1 << rq_wqe_shift" based on user-provided value, which is only checked to be greater than 32, so shifts of 32 are still accepted. A shift of 31 also overflows a signed integer, leading to undefined behavior. The fix uses check_shl_overflow() to compute the size and rejects invalid values.

In the Linux kernel, the RDMA/mlx5 driver has a bug where it frees the software-provided UAR index instead of the hardware-provided one. The fix is to free the UAR index returned by the hardware.

In the Linux kernel, the ASoC codec driver hdac_hdmi has a vulnerability due to lack of validation of the enum value before using it as an index into the texts array. hdac_hdmi_set_pin_port_mux() uses the enum value to index the array before calling snd_soc_dapm_put_enum_double(), which validates the range. An out-of-range value can cause an out-of-bounds read. The fix moves the lookup after the helper has accepted the value.

In the Linux kernel, the ASoC driver for Meson AIU has put callbacks for HDMI and internal codec muxes that use the written enum value before checking its validity. This can lead to improper behavior or potential errors.

In the Linux kernel, the ASoC driver for Freescale fsl_audmix has functions fsl_audmix_put_mix_clk_src() and fsl_audmix_put_out_src() that convert the user-provided enum value before checking if it is within range. This can lead to incorrect memory access or errors.

In the Linux kernel, the ASoC driver for Tegra210 AHUB has function tegra_ahub_put_value_enum() that reads e->values[item[0]] before checking if item[0] is within range. This allows an out-of-range read of the values array.

In the Linux kernel, the ASoC topology parser does not validate PCM and DAI name strings stored in fixed-size arrays for NUL termination before using them as C strings. A malformed topology blob can cause reads past the end of the field.

In the Linux kernel, the flow classifier cls_flow in map mode allows userspace to control parameters and observe the resulting classid, enabling recovery of the folded value of kernel pointers like skb->sk, skb_dst(), or skb_nfct(). The fix replaces XOR folding with a keyed siphash.

A use-after-free vulnerability was found in the Linux kernel's fib_leaf_notify() function for IPv4. During dumping of fib_info under RCU, functions like nsim_fib4_prepare_event() call fib_info_hold() without checking if the object still exists, leading to use-after-free. The issue was reported by syzbot.

In the Linux kernel, fib_rules_dump() calls fib_rule_get() during RCU dump, which can cause refcount issues if the rule is dying. The fix uses refcount_inc_not_zero().

In the Linux kernel, PFCP network devices do not allocate per-CPU stats, leaving dev->tstats NULL. Creating a PFCP device can cause a NULL dereference when building RTM_NEWLINK notification.

In the Linux kernel, netif_rxq_cleanup_unlease() has reversed order: DMA mappings are revoked before stopping the queue. This can allow the device to DMA to a stale address. The fix swaps the calls.

A vulnerability was found in the Linux kernel's HFSC network scheduler (sch_hfsc). During a single dequeue, a class can be marked passive twice, leading to incorrect decrementing of the parent's active class counter. As a result, a parent with active child classes is removed from the vttree, and queues stop being processed (stall).

In the Linux kernel, TIPCv2 mutating netlink operations lacked admin permission checks, allowing unprivileged local processes to change TIPC state. The fix adds CAP_NET_ADMIN requirement.

In the Linux kernel TIPC subsystem, the CONN_ACK handler did not validate the ack count, allowing an oversized ack to underflow snt_unacked and permanently stall the connection's send side.

In the Linux kernel TIPC subsystem, peer-advertised service ranges were not validated for lower <= upper, allowing inverted ranges to leak memory in the binding table.

A vulnerability in the Linux kernel ALSA SEQ subsystem leaks a kernel heap address to userspace. The bounce_error_event() function sent SNDRV_SEQ_EVENT_KERNEL_ERROR with a raw pointer to all clients, including user clients, exposing the address via copy_to_user(). The issue affects the fixed-length branch not covered by a previous fix.

In the Linux kernel IOMMU DMA subsystem, the P2PDMA path incorrectly assigned the DMA length from the head segment instead of the current segment, corrupting lengths for multi-segment scatterlists.

A vulnerability was found in the Linux kernel's SPI driver for Xilinx devices. The driver incorrectly determines the FIFO buffer size, not accounting for the shift register, which leads to data loss and driver looping during SPI transfers in interrupt mode.

In the Linux kernel CXL region subsystem, cxl_cancel_auto_attach() used cxled->pos as an index into p->targets[], but it could be a negative errno, causing out-of-bounds access.

In the Linux kernel CXL region subsystem, a vulnerability exists where NULL pointer holes can remain in the target array of an active region after removing endpoint decoders. This leads to NULL pointer dereference (general protection fault) and incorrect counting of attached decoders, potentially causing malfunction. The fix fills the first free target slot during auto-discovery.

In the Linux kernel, the CXL region subsystem now blocks region deletion during region creation. The lock scope was expanded to prevent deletion in the critical period between construction and target attachment, and between device registration and removal action registration. Without this, userspace could confuse the kernel and violate assumptions about region lifetime.