Linux kernel vulnerabilities

In the Linux kernel, the CXL region subsystem resolves region deletion races. Instead of installing new devres actions per region, the existing root decoder unregistration event is used to remove all remaining regions. An xarray of regions replaces the devres list, addressing three issues: sysfs users racing to delete the same region, multiple actions triggering deletion, and userspace racing devres_release_all().

In the Linux kernel, the power supply core fixes an allocation issue for the supplied_from property. When the dts property power-supplies has multiple values, accessing psy->supplied_from[i-1] in __power_supply_populate_supplied_from can overrun the supplied_from array.

In the Linux kernel, the handshake subsystem now requires admin permission for the DONE command. Previously, DONE had no privilege check, allowing an unprivileged process to send a forged DONE with status 0, causing the kernel to treat the handshake as successful, or with a non-zero status, tearing down a legitimate in-flight handshake.

In the Linux kernel, the net/sched/sch_dualpi2 module has a vulnerability leading to a null-pointer dereference. During peek, when dualpi2 drops packets, it calls qdisc_tree_reduce_backlog before restoring the qlen counter, which can mistakenly deactivate the parent class and cause a system crash.

In the Linux kernel, the net: mana subsystem initializes the gdma queue id to INVALID_QUEUE_ID. Previously, the id remained 0, which could lead to deleting an incorrect queue during cleanup after a failed creation, potentially corrupting gc->cq_table[0] and affecting another queue.

A vulnerability in the Linux kernel's network watchdog code (net/sched/sch_generic.c) involves races in reference tracking. Lack of synchronization between netdev_watchdog_up() and dev_watchdog() can lead to list corruption and system crash.

In the Linux kernel, the t7xx WWAN driver's t7xx_port_ctrl_tx() function clones each skb fragment before passing it to the transmit path. The lack of a check on skb_clone() results in a NULL pointer dereference when cloning fails.

In the Linux kernel, the KCM module's kcm_attach() and kcm_unattach() functions replace callback pointers (sk_data_ready, sk_write_space) on a live TCP socket without using WRITE_ONCE(). This can lead to inconsistent observations of these fields on other CPUs and incorrect callback invocations.

A vulnerability in the Linux kernel's ALSA sequencer subsystem related to FIFO resize operation (snd_seq_fifo_resize) has been identified. The issue involves stale cells remaining in the FIFO during resize, leading to a deadlock in snd_seq_pool_done when deleting the old pool. An attacker can trigger this via ioctl calls, causing a thread to block indefinitely.

In the Linux kernel, the netfilter nf_dup_netdev module's nft_dup and nft_fwd functions have been updated to use the nf_dev_xmit_recursion() helpers. Additionally, bottom halves (BH) are disabled during skb transmission to prevent migration to a different CPU and imbalanced decrementation of recursion counters.

In the Linux kernel, the CIFS module has a vulnerability causing a NULL pointer dereference during unmounting of a CIFS filesystem. The issue occurs when CIFS files are queued in fileinfo_put_wq during unmount, and after unmount completes, cifsFileInfo_put_final is called, leading to a kernel BUG.

In the Linux kernel, the BPF mechanism for uprobe_multi data lacked an access_ok check before using __get_user, potentially allowing unauthorized access to user memory. The fix adds proper bounds checking.

A use-after-free vulnerability was found in the Linux kernel's udp_bpf_recvmsg() function for sockmap. The issue stems from missing serialization of access to the sk_msg structure, which can lead to use of freed memory during concurrent reads. The fix restores lock_sock() in this function.

A vulnerability was found in the Linux kernel's BPF sockmap mechanism, involving an integer overflow in the bpf_msg_pop_data() function. The addition of start + len is performed in 32-bit arithmetic, allowing the bounds check to be bypassed and leading to an out-of-bounds access on the scatterlist, resulting in a general protection fault and potential system crash.

In the Linux kernel's TCP for IPv6, the ip6_default_advmss() function can return IPV6_MAXPLEN (65535), which is interpreted as mss_clamp, allowing MSS to reach 65535. However, 0xFFFF is also used as a magic value GSO_BY_FRAGS, which can lead to a NULL pointer dereference during TCP packet segmentation.

In the Linux kernel's RDMA bnxt_re driver, the dpi variable is initialized only for the BNXT_RE_ALLOC_WC_PAGE case, but it is copied for all cases. Lack of initialization may lead to use of an uninitialized value.

In the Linux kernel's RDMA bnxt_re driver, the toggle page for SRQ is freed before firmware teardown completes, which could allow an NQ interrupt to write to an already-freed page. The fix moves the page free after bnxt_qplib_destroy_srq().

In the Linux kernel's RDMA bnxt_re driver, the toggle page for CQ is freed before firmware teardown completes, which could allow an NQ interrupt to write to an already-freed page. The fix moves the page free after bnxt_qplib_destroy_cq().

In the Linux kernel's RDMA bnxt_re driver, when dumping MR info using the rdma tool, the kernel pointer mr_hwq is displayed. There is no need to expose this value to the end user, so it has been removed.

In the Linux kernel's RDMA bnxt_re driver, there is a missing max slot check for SQ. The WQE mode variable must be validated against the maximum slots supported by HW (max 64K). Added max and min checks to fail if user supplied value is more than max or zero.

In the Linux kernel, in the ksmbd module, same_client_has_lease() returns an opinfo pointer from ci->m_op_list after dropping ci->m_lock without taking a reference. This can lead to use-after-free during concurrent close. A reference is now taken and released after copying the lease state.

In the Linux kernel, in the staging rtl8723bs driver, the rtw_aes_decrypt function had an incorrect stainfo pointer check that returned _FAIL on a valid pointer. The guard is inverted to return _FAIL only on an invalid pointer.

In the Linux kernel, in the staging nvec driver, nvec_rx_completed() has a use-after-free bug. After calling nvec_msg_free(), the code still reads nvec->rx->data[0], which may be overwritten by a concurrent nvec_msg_alloc() call. The fix saves the message type byte before freeing and uses the saved value.

In the Linux kernel, in the soundwire subsystem, the sdw_add_element_group_count function had an out-of-bounds memory access in the for-loop when i == num. The fix adds a check for existing rate/lane entries before adding them, with no functional changes apart from this fix.

In the Linux kernel, in the PCI subsystem, pci_get_rom_size can crash due to out-of-bounds access to ROM space or misaligned data structure address. Added checks for image header and data structure address, and alignment checking, to prevent crashes on x86_64 and arm64.

In the Linux kernel, the mtk-adsp mailbox driver has a use-after-free vulnerability during device teardown. When SOF audio driver initialization fails, the snd_sof_dev object is freed, and a late interrupt can trigger a handler after the channel is freed, leading to access of freed memory. The fix uses disable_irq() and IRQF_NO_AUTOEN to prevent interrupts from firing at inappropriate times.

In the Linux kernel, the coresight platform subsystem has an issue where connection counters are incremented before successful memory allocation. If allocation fails, the counter remains incremented, and cleanup functions may dereference invalid pointers, causing a kernel panic. The fix moves counter increments after all allocations succeed.

In the Linux kernel, the most: video driver has a double free vulnerability during failed video device registration. The function comp_register_videodev() frees the video_device, but the error path in __video_register_device() also frees it, leading to a double free. The fix uses video_device_release_empty() during registration to avoid double freeing.

In the Linux kernel, the USB host max3421 driver has a shift-out-of-bounds vulnerability in max3421_hub_control(). An untrusted userspace process can send a USBDEVFS_CONTROL request with wValue greater than or equal to 32, causing an out-of-bounds bit shift and corrupting port_status, including immutable bits. The fix rejects requests with a value exceeding the shift width.

In the Linux kernel, the gpib driver has a double decrement of the descriptor_busy counter in command_ioctl(). The error path inside the loop decrements the counter and breaks, but then an unconditional decrement after the loop occurs, causing an underflow. This re-enables the use-after-free that the original fix intended to prevent. The fix removes the early decrement from the error path.

In the Linux kernel, the iio: magnetometer ak8975 driver has a potential kernel stack memory leak. If i2c_smbus_read_i2c_block_data_or_emulated() returns fewer bytes than the buffer size, uninitialized bytes remain in the buffer and are passed to IIO buffers, potentially leaking kernel memory to userspace. The fix adds a check that the return value equals the buffer size.

In the Linux kernel, the iio: adc xilinx-ams driver has an out-of-bounds read vulnerability in ams_event_to_channel(). The function may return a pointer past the end of dev->channels when no matching scan_index is found, leading to invalid memory access in ams_handle_event(). The fix adds a bounds check and returns NULL when no channel is found.

In the Linux kernel, the iio: accel mma8452 driver has an issue with handling I2C read errors in mma8452_read(). If the I2C read fails but mma8452_set_runtime_pm_state() succeeds, the function returns 0, causing the caller to use uninitialized stack memory. The fix adds proper checking of the I2C read return value and propagates errors to the caller.

In the Linux kernel, the NTFS3 filesystem has an out-of-bounds read vulnerability in run_get_highest_vcn(). The function parses a packed mapping-pairs buffer without any length bound, relying solely on a 0x00 terminator. A crafted $LogFile UpdateMappingPairs record can cause a read past the slab allocation, triggering a KASAN error during mount. The fix adds a run_buf_size parameter and rejects run headers whose payload would extend past the buffer end.

In the Linux kernel, the dma_release_channel() function has a use-after-free vulnerability. The privatecnt check occurs after calling dma_chan_put(), which may release the last reference to the device if the DMA provider is already gone, leading to memory free. The fix moves dma_chan_put() before the check.

In the Linux kernel, the dma-axi-dmac driver has an issue with incomplete freeing of the axi_dmac_desc structure. In the error path after calling axi_dmac_alloc_desc() in axi_dmac_prep_peripheral_dma_vec(), the axi_dmac_free_desc() function is not used, leading to memory leak or incomplete release.

In the Linux kernel, the dma-axi-dmac driver has an issue with DMA descriptor management. Using dma_alloc_coherent() may cause memory remapping (vmalloc) on architectures like Microblaze or arm64, leading to a BUG() when calling dma_free_coherent() from softirq context. The fix uses a DMA pool to manage descriptors, avoiding direct dma_free_coherent() calls in interrupt context.

In the Linux kernel, the NTFS3 filesystem has a vulnerability involving the use of an uninitialized variable lcn. When the sought VCN is not found in runs[0], run_lookup() returns false, leading to premature exit from attr_data_get_block_locked() without initializing lcn, triggering a KMSAN bug. The fix moves the clen check before the lcn check in ni_seek_data_or_hole().

In the Linux kernel's NTFS3 filesystem (fs/ntfs3), there is a buffer overflow vulnerability. During mounting of a dirty NTFS volume, log_replay() allocates one_page_buf using the host page size, then may adopt a larger on-disk page size from the restart area. If the on-disk page size is larger than the initial allocation, the buffer remains undersized, and a subsequent read of log->page_size bytes into it causes an overflow.

In the Linux kernel's xprtrdma subsystem, a vulnerability was found due to a kref imbalance when handling the ADDR_CHANGE event. If this event arrives before ESTABLISHED, an ep_put is called without a matching ep_get, leading to a kref underflow and use-after-free during disconnect.

In the Linux kernel, the xprtrdma module has a race condition during re_id initialization. rpcrdma_create_id() registers ep->re_rn before rpcrdma_ep_create() assigns ep->re_id, allowing a local administrator to trigger RDMA device removal in that window, leading to NULL pointer dereference in trace_xprtrdma_device_removal(). The fix assigns re_id before publishing re_rn.

In the Linux kernel, the xprtrdma module has a vulnerability where the return value of frwr_wp_create() is ignored during connection setup. If the function fails, ep->re_write_pad_mr remains NULL, and the connection is still considered successful, leading to NULL pointer dereference when encoding the write list. The fix checks the return value and fails the connection with -ENOTCONN.

In the Linux kernel's xprtrdma subsystem, a vulnerability exists where the reply credit grant is not sanitized before use. A malicious peer can send a reply with an unknown XID and an inflated credit, causing excessive allocation and posting of Receive WRs, exceeding the re_max_requests limit.

In the Linux kernel's xprtrdma subsystem, a vulnerability allows a remote peer to drain the client's posted Receive queue by sending a sustained stream of malformed replies (too short or with an unrecognized RPC/RDMA version). Each such reply consumes a posted Receive without replacing it, eventually stalling the transport until reconnect.

In the Linux kernel's AppArmor module, a race condition exists in Unix socket mediation when peer_path is used. Accessing the path outside the state lock allows a race with unix_release_sock(), potentially leading to use-after-free.

In the Linux kernel's AppArmor module, a refcount leak exists when updating sk_ctx. update_sk_ctx() transfers the plabel reference, but the caller unconditionally puts it, leading to a refcount imbalance.

In the Linux kernel's AppArmor module, a vulnerability exists where the label build is checked before the no_new_privs test. aa_change_profile() builds a replacement label that can return NULL or ERR_PTR, but the result is passed to aa_label_is_unconfined_subset() before the IS_ERR_OR_NULL() check, potentially dereferencing an invalid label.

In the Linux kernel's AppArmor module, a resource leak exists in aa_label_alloc(). The function allocates a secid before allocating or taking the label proxy. If the later proxy step fails, the error path only frees the label memory, leaking resources initialized by aa_label_init().

In the Linux kernel's AppArmor module, a NULL pointer dereference vulnerability exists in unpack_pdb. If unpack_dfa fails, pdb->dfa could be NULL, causing a NULL pointer dereference.

In the Linux kernel's AppArmor module, a vulnerability exists in unpack_pdb where a failed ACCEPT2 allocation is not handled correctly. If the allocation fails, it sets an error message but jumps to the success path, returning a policydb missing the required table.