Linux kernel vulnerabilities

In the Linux kernel, the AppArmor module's get_current_exe_path() leaks exe file and path references when aa_path_name() fails. The fix routes error handling through the common cleanup path to always release resources.

In the Linux kernel, the AppArmor module has a bug where an uninitialized pointer is passed to audit_log_untrustedstring(). The bug was introduced by commit 4a134723f9f1 and can lead to a page fault during file operations when the path is replaced by aa_null.dentry. The issue was observed on kernel 7.0.2 openSUSE Tumbleweed.

In the Linux kernel, the MIPI I3C HCI driver has a race in i3c_hci_addr_to_dev() that traverses the I3C device list without proper locking. The fix introduces a dedicated lookup table and synchronization via hci->lock.

In the Linux kernel's regcache mechanism, when the populate() callback returns an error and cache operations include an exit callback, the error code is overwritten with the return value of exit(). This hides the error from the caller of regcache_init() and can lead to NULL pointer dereferences.

In the Linux kernel's i915 (drm) driver, intel_crtc_put_color_blobs() releases CRTC color blob references but does not clear the pointers. This can lead to double-free when the CRTC state is cleaned up again.

In the Linux kernel's xfrm module, xfrm_selector_match() can perform a shift-out-of-bounds for an AF_UNSPEC selector with a large prefixlen. The fix adds validation of families and prefix lengths.

In the Linux kernel's amdkfd (drm) driver, kfd_criu_resume_svm() does not remove elements from the list before freeing memory, leading to use-after-free and double-free. The fix adds list_del() before kfree().

In the Linux kernel's octeontx2-pf driver, otx2_free_sq_res() does not free the SQ timestamp buffer (sq->timestamps), leading to memory leak during interface teardown or device removal.

In the Linux kernel's SCTP_DIAG module, endpoint dumping does not hold the socket lock, leading to a race and potential leak of uninitialized memory to userspace. The fix adds proper locking and serialization.

In the Linux kernel, the ALSA USB-audio driver for Qualcomm platforms has a vulnerability due to missing validation of the interface index in the stream disable path. A disable request with an invalid interface can lead to NULL pointer dereference or out-of-bounds memory access, potentially causing a system crash or memory corruption.

In the Linux kernel, the ALSA USB-audio driver for Qualcomm platforms has a vulnerability where the 'opened' flag is not cleared when stream enable fails. If service interval validation fails, the substream remains in a blocked state, preventing its reuse.

A vulnerability in the Linux kernel's flow_dissector mechanism unconditionally reads Ethernet addresses (ETH_ADDRS) from the packet header, even when the device has no link-layer header (e.g., TUN in L3 mode). This leads to reading uninitialized skb memory, which can be used as a key in a rhashtable, potentially causing unpredictable TC filter matching. The fix adds checks for device type (ARPHRD_ETHER) and whether the MAC header is set.

A vulnerability was found in the Linux kernel's ALSA USB-audio driver related to MIDI 2.0. During a configuration error, MIDI 2.0 input URBs are not stopped before freeing endpoint memory, leading to a use-after-free in input_urb_complete(). The issue was observed as a KASAN error.

A vulnerability in the Linux kernel causes a kernel-infoleak in dgram_recvmsg() for IEEE 802.15.4 protocol. The issue stems from an uninitialized pan_id field in the address structure when the address mode is IEEE802154_ADDR_NONE, leading to disclosure of kernel stack memory to user space.

In the Linux kernel, the md/raid1 module has a vulnerability involving writes_pending and barrier reference leaks on write failures. Some error paths in raid1_write_request() complete the bio without calling md_write_end(), leading to unbalanced counters.

In the Linux kernel, the md/raid10 module has a vulnerability involving writes_pending reference leak on write request failures. Some error paths in raid10_write_request() complete the bio without calling md_write_end(), leading to unbalanced counters.

In the Linux kernel, the md/raid10 module has a vulnerability involving writes_pending and barrier reference leaks on discard failures. Some error paths in raid10_handle_discard() complete the bio without calling md_write_end() or allow_barrier(), leading to unbalanced counters.

In the Linux kernel, the md/raid1 module has a vulnerability involving a leak of the r1_bio structure when a read with REQ_NOWAIT encounters a block during retry. When wait_read_barrier() fails, the bio is completed, but the pre-allocated r1_bio is not freed.

In the Linux kernel, in the netfilter/ipset module, kfree_rcu() was called before rcu_assign_pointer() when handling the comment extension, which is incorrect order. The order was fixed so that rcu_assign_pointer() is called first.

In the Linux kernel, in the netfilter/ipset module, when destroying a set, cancel_delayed_work_sync() was called while gc unconditionally calls queue_delayed_work(), which can prevent proper shutdown of gc. This was fixed.

In the Linux kernel, in the nft_meta_bridge module, there is a stack leak in NFT_META_BRI_IIFPVID. The fix requires checking for nonzero retval.

In the Linux kernel, the tpm_crb driver lacked a check of ACPI_COMPANION() against NULL during probe. This check was added to prevent issues when a device has no ACPI companion object.

In the Linux kernel, in the alloc_tag mechanism, there is a use-after-free in /proc/allocinfo after module unload. The iterator is not properly reinitialized, leading to references to freed module memory.

In the Linux kernel, in the net/sched: act_ct module, there is an nf_connlabels leak on two error paths. tcf_ct_fill_params() calls nf_connlabels_get(), but two later error sites use a bare return instead of goto err, skipping the nf_connlabels_put() cleanup.

In the Linux kernel, in BPF, there is a stack slot index error in nospec checks. check_stack_write_fixed_off() computes the byte slot as -off - 1, but the Spectre v4 sanitization pre-check uses slot_type[i] instead, which can lead to missing sanitization for some writes.

In the Linux kernel, in BPF, there is an effective prog array index error with BPF_F_PREORDER. replace_effective_prog() and purge_effective_progs() located the slot in the effective array by walking the program hlist and counting entries linearly, which does not match the array layout when a preorder program is present.

In the Linux kernel BPF mechanism, during cleanup of dead stack slots in 4-byte halves, when the high half of a STACK_SPILL slot is dead and the low half remains live, converting the low half to STACK_MISC or STACK_ZERO clears the spilled_ptr metadata. This is safe only for scalar spills, but for pointer spills it allows a later 32-bit fill from the live half to bypass the normal non-scalar register-fill check and be treated as an ordinary scalar stack read. The fix leaves non-scalar spill slots intact in this half-live shape, which is conservative for pruning and preserves the existing rejection path for partial fills from pointer spills.

In the Linux kernel ice driver, there is a resource leak of CTRL VSI when resetting all VFs with FDIR filters enabled. The ice_reset_all_vfs() function only invalidates CTRL VSIs but does not free them, leading to resource leak. The fix uses ice_vf_ctrl_vsi_release() instead of ice_vf_ctrl_invalidate_vsi(), aligning with the behavior of ice_reset_vf().

In the Linux kernel msc313 RTC driver, there is a NULL pointer dereference in the shared IRQ handler during probe. msc313_rtc_probe() calls devm_request_irq() with IRQF_SHARED and passes &pdev->dev as the cookie, but platform_set_drvdata() is called later. If another device on the same IRQ line triggers the handler in that window, the handler does dev_get_drvdata() on the cookie, gets NULL, and dereferences priv->rtc_base in interrupt context. The fix passes priv as the cookie directly so the handler reads it from dev_id without the lookup.

In the Linux kernel BPF mechanism, conntrack lookup and allocation kfuncs take an opts pointer and an opts__sz argument. The verifier checks only the memory range described by opts__sz, but the wrappers unconditionally write opts->error whenever the internal helper returns an error. For an invalid size smaller than the end of opts->error, that write can land outside the verifier-checked range. The fix keeps returning NULL for invalid arguments, but only reports the error through opts->error when the supplied size includes the field.

A race condition was found in the Linux kernel's md/raid5 subsystem during stripe batch breaking. The issue involves R5_Overlap flag operations, potentially causing a process to hang (wait_on_bit) due to a missed wake-up. The fix expands the protected zone and reorders batch_head pointer updates to prevent concurrent access.

A vulnerability was found in the Linux kernel's netfilter nf_nat module, involving the use of an invalid nat_net pointer after a failed nf_nat_init(). This leads to an out-of-bounds read (slab-out-of-bounds), which could be exploited by a local user to cause a system crash or potentially escalate privileges.

A vulnerability in the Linux kernel's netfilter (nf_conncount) causes incorrect packet drops for valid connections when using connlimit in soft-limiting scenarios. The issue occurs when a new connection reuses a socket in TIME_WAIT state, where the connection tracking entry is mistakenly treated as confirmed, leading to a zeroed active connection count and false rejection of traffic. The fix replaces the loopback interface check with protocol-agnostic state checks (IPS_ASSURED), allowing early-confirmed setup packets to be properly evaluated and counted.

In the Linux kernel, the nft_compat layer fails to reject non-bridge targets in ebtables emulation. xtables targets return verdicts incompatible with ebtables, which may lead to incorrect behavior.

In the Linux kernel, the ge_put_enum_double() function in ASoC SDCA lacks validation of the index value before use. This may lead to an out-of-bounds read of the values buffer.

In the Linux kernel, the DSA driver sja1105 rounds up the PTP perout pin duration to at least 1 tick to avoid division by zero in future_base_time().

In the Linux kernel, the SCTP protocol has memory leaks of err_chunk in INIT handling. In several code paths, the allocated chunk is not freed, leading to memory leaks.

In the Linux kernel, the DSA driver mxl862xx has a use-after-free of DSA ports in crc_err_work. The work may run after ports are freed, leading to dereferencing freed memory.

In the Linux kernel, in the octeontx2-af subsystem, an incorrect condition checking whether any LFs (Logical Functions) have been assigned to a PF/VF was fixed. The patch addresses validation of the maximum number of LFs set via the devlink command.

In the Linux kernel, the mvneta driver (Marvell Armada 370/XP/38x) has a vulnerability causing permanent masking of per-CPU interrupts after resume from suspend. If suspend occurs while NAPI poll is pending, the interrupt is never re-enabled, leading to complete loss of network connectivity.

In the Linux kernel, in the sungem subsystem, a double-free of resources during error handling in gem_init_one() was fixed. Previously, when register_netdev() failed, gem_remove_one() was called, and then the same resources were freed again, leading to a double-free.

In the Linux kernel, in the udp_tunnel subsystem, a vulnerability was fixed involving double queueing of work in udp_tunnel_nic_device_sync, leading to a use-after-free. The fix involves returning early if the work_pending flag is already set.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's TIPC UDP media bearer. The cleanup_bearer() function destroys the dst_cache before synchronizing with RCU readers, which can lead to system crashes or rcuref warnings. Additionally, freeing the ub structure after synchronize_net() without closing the socket first leaves a window for UAF for concurrent receivers.

In the Linux kernel, in the ALSA FCP subsystem, a NULL pointer dereference vulnerability was fixed during interface lookup. A malicious USB device can provide an interface without endpoint descriptors, leading to memory safety issues.

In the Linux kernel, in the BPF subsystem, a vulnerability was fixed where BPF verifier logs did not mask pointer values for certain pseudo-source types, potentially leaking kernel addresses. The fix extends masking to all pseudo types.

In the Linux kernel, in the BPF subsystem, a memory leak in the verifier error handling path was fixed. When allocation of env->succ fails, freeing of env->insn_aux_data is skipped, leading to a memory leak. The fix moves the freeing to the err_free_env label.

In the Linux kernel, seg6_validate_srh() lacks a minimum length check before reading fixed SRH fields. The BPF SEG6 encap path can supply a too-short buffer, leading to an out-of-bounds read.

In the Linux kernel's hwmon subsystem (pmbus/core), pmbus_data2reg_vid() always uses VR11 encoding, ignoring the configured vrm_version. This can lead to sending wrong codes to PMBUS_VOUT_COMMAND, resulting in incorrect voltage.

In the Linux kernel's adm1275 hwmon driver, i2c_smbus_read_block_data() reads up to 32 bytes into an uninitialized stack array without appending a null terminator. The strncasecmp() comparison may read beyond the returned length, leading to an uninitialized stack memory read.

In the Linux kernel's hwmon subsystem (pmbus), regulator events are passed to the regulator core as a combined bitmask. If multiple distinct faults occur, the mask does not match any case in regulator_handle_critical(), bypassing the critical hardware protection trigger.