Linux kernel vulnerabilities

In the Linux kernel's nvme-multipath subsystem, the number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log header and group descriptors independently supply the number of groups and namespace IDs to parse. Both bounds checks subtract an untrusted object size from ana_log_size before comparing the current offset, so an oversized object causes a size_t underflow and reads beyond ana_log_buf.

In the Linux kernel's nvmet_auth_challenge(), the output buffer is received as a void pointer, so sizeof(*d) evaluates to one with GCC and undercounts the fixed challenge header by 15 bytes. A short AUTH_RECEIVE buffer can pass the check before the challenge is copied past the end of its allocation.

In the Linux kernel's nvmet pci-epf subsystem, the host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nr_descs zero, so nvmet_pci_epf_get_sgl_segment() reads the type byte of sgls[-1] outside the allocated buffer. If that byte contains a segment descriptor type, the function also copies the preceding 16 bytes and returns a negative descriptor count.

A vulnerability was fixed in the Linux kernel's KVM module (x86 MMU handling). If memslot creation races with a stage-2 page fault (EPT violation or #NPF) from L2, KVM may attempt to walk shadow page tables using the zero page, leading to a NULL pointer dereference and kernel oops. The fix terminates such walks when the root is invalid or a dummy root.

In the Linux kernel, KVM on arm64 was fixed to apply fine-grained UNDEFs (FGUs) without requiring hardware FEAT_FGT support. Previously, FGT trap configuration was gated on FGT, causing a spurious WARN when a TLBI OS ran on a vEL1 guest without FEAT_TLBIOS on non-FEAT_FGT hardware.

In the Linux kernel, KVM/arm64 vgic was fixed to take a refcount on IRQs referenced by last_lr_irq. Previously, referencing the last interrupt inserted in an LR was fragile because the interrupt could vanish if a concurrently unmapped LPI occurred.

In the Linux kernel, the cw1200 wifi driver was fixed for an out-of-bounds read in the TX path that leaked kernel heap data to the device. The transfer size was rounded up to bus alignment (up to 511 bytes for SDIO), but the padding was sent straight from the frame buffer, which had no room reserved for it.

In the Linux kernel, the iwlegacy 3945 wifi driver was fixed for an EEPROM data memory leak on PCI device removal. il3945_pci_probe() allocates memory for EEPROM data, but the remove path did not free it after a successful probe.

In the Linux kernel, the mac80211 wifi module was fixed in ieee80211_vif_use_reserved_switch(), where reservations were counted too broadly, making a channel replacement appear complete too early. This could free the WILL_BE_REPLACED chanctx while an unmatched link and driver still used it.

In the Linux kernel, the mac80211 wifi module was fixed for premature freeing of the old WILL_BE_REPLACED chanctx during in-place replacement. Early free paths only considered assigned and reserved link users, so the old chanctx could be freed while the replacement partner still pointed back to it.

In the Linux kernel, the mac80211 wifi module was fixed for an RX BA session timer left queued on a freed tid_rx during teardown. Later timer-wheel processing and the timer callback then ran against freed memory.

In the Linux kernel, the mac80211 wifi module was fixed for draining PS delivery work during station teardown. A worker could be delayed while teardown set sta->dead and removed the station from the driver, then still run full delivery when it resumed.

In the Linux kernel, the mac80211 wifi module was fixed for accounting proxy paths against the mesh path limit. mpp_path_add() never reserved a slot in the counter, so removing or expiring a proxy path returned a slot that was never charged, potentially exceeding MESH_MAX_MPATHS.

In the Linux kernel, the mac80211 wifi module was fixed for reading freed memory when associating to a non-transmitted MBSSID profile. When an association response omitted WMM, HT, or VHT information, ieee80211_assoc_config_link() copied element pointers from parse-owned storage that was freed at the end of the fallback block.

In the Linux kernel mac80211 (minstrel_ht) module, the debugfs file fixed_rate_idx accepts any u32 value without validation. An oversized value causes out-of-bounds indexing into minstrel_mcs_groups[] and mi->groups[].rates[], corrupting adjacent kernel memory.

In the Linux kernel mac80211 module, the HT/VHT channel definition validator can receive a 320 MHz bandwidth indication from a received CSA frame on a non-6 GHz link. It warns but continues with an uninitialized vht_operation.chan_width, which with panic_on_warn enabled lets a received frame panic the kernel.

In the Linux kernel mac80211 module, mesh_path_add() reserves a slot before allocating and inserting a path but does not release it on failure. Repeated failed or duplicate mesh path additions can exhaust MESH_MAX_MPATHS, preventing new paths to reachable destinations from being created.

In the Linux kernel mac80211 module, ieee80211_8023_xmit() does not set info->band from the channel context on non-MLD interfaces, leaving it at 0. This causes ieee80211_get_tx_rates() to use the wrong band for these frames.

In the Linux kernel mac80211 module, mesh_fast_tx_cache() stores raw mesh_path pointers. Path deletion flushes the cache and frees the path with kfree_rcu(), but a lookup already holding the path can insert a new cache entry after the flush, pointing at freed memory (use-after-free).

In the Linux kernel mac80211 module, fils_encrypt_assoc_req() accepts a (Re)Association Request frame whose last element is the FILS Session element, making crypt_len zero and calling aes_siv_encrypt() with empty plaintext. kmemdup() returns ZERO_SIZE_PTR, so the unconditional sg_init_one() puts an invalid page into the scatterlist, triggering a kernel BUG with CONFIG_DEBUG_SG.

In the Linux kernel USB serial subsystem, there is a race in dynamic id driver deregistration. Dynamic ids are freed before the driver is deregistered and the "new_id" attribute removed, which can leak an id added by a racing write.

In the Linux kernel USB serial subsystem, there is an incorrect driver deregistration order. When unloading a driver module, the USB driver must be deregistered before the USB serial bus drivers so that I/O is stopped before unbinding the ports, avoiding use-after-free in completion handlers.

In the Linux kernel USB serial subsystem, tty ioctls can race with hangup and call into a tty driver for a device that is already gone or powered down. The lack of serialization and checks can lead to a NULL-pointer dereference, especially if a device is disconnected during lengthy break signalling.

In the Linux kernel, a use-after-free vulnerability exists in the Thunderbolt subsystem during control channel request cancellation. When tb_cfg_request_work() completes just before tb_cfg_request_cancel(), the same work is requeued and accesses already freed memory. The fix ensures that a cancelled request is not handed out or scheduled, and the request is released in tb_cfg_request_cancel().

In the Linux kernel, the Thunderbolt driver's tb_stop() drops references to DP tunnels without deactivating them, so dprx_work can still run after the router is removed. This leads to operations on freed IDA structures and warnings such as "ida_free called for id=8 which is not allocated". It can be triggered by unbinding the driver while a DP tunnel is still waiting for the DPRX capabilities read to finish.

In the Linux kernel, the Thunderbolt driver's tb_tunnel_alloc_dp() takes an optional callback run from dprx_work after the DPRX capabilities read completes. Without that callback, a tunnel reference is leaked because it is never dropped. This affects tunnels from tb_tunnel_discover_dp(), which are activated when restoring from hibernation.

In the Linux kernel, the Thunderbolt driver's tb_stop() only tears down DMA tunnels, so a DP tunnel still waiting for dprx_work keeps that work queued while routers are removed and the control channel is stopped. The flush_workqueue() in tb_domain_remove() does not wait for its final run, and the callback runs against an already torn-down domain, blocking unbind until the timeout is reached.

In the Linux kernel, the Thunderbolt driver's tb_tunnel_one_dp() takes a domain reference that is only dropped once tb_dp_tunnel_active() has run on the work queue. If that work is cancelled, the reference is leaked, and since commit f5cc545f5969 this also blocks forever in the completion wait when unbinding the driver.

In the Linux kernel, the Thunderbolt driver's tb_dp_dprx_work() checks the ->dprx_canceled flag before taking tb->lock, so it can miss a tb_dp_dprx_stop() that could not cancel already running work. As a result, it polls DPRX capabilities and runs the callback for a tunnel that has already been torn down while the domain is suspending or going away.

In the Linux kernel Thunderbolt subsystem, a race between tb_remove_work() and tb_domain_remove() leads to a NULL pointer dereference of tb->root_switch inside tb_free_unplugged_xdomains(). The issue stems from incorrectly moving the tb_free_unplugged_xdomains() call outside the tb->lock section without checking whether tb->root_switch is NULL.

In the Linux kernel, the Thunderbolt driver's tb_xdp_properties_request() allocates room for 45 data dwords in its 252-byte response buffer, but the six-bit XDomain length field can be set to 63 by a malicious peer, which is treated as 48 data dwords. This causes a 12-byte heap out-of-bounds read from the res->data array.

In the Linux kernel, the SMB client's smb3_zero_range() removed the pagecache only for the range being zeroed, so when extending a file the folio straddling the old EOF — which may hold data dirtied past EOF through an mmap — was never dropped and became visible as file content once the file was extended.

In the Linux kernel, the SMB client's cifs_remap_file_range() discarded the pagecache only for folios overlapping the destination region, so when a clone extends the file the folio straddling the old EOF — which may hold data dirtied past EOF through an mmap — was never dropped and became visible as file content once the file was extended.

In the Linux kernel SMB client, smb3_zero_range() zeroed a range without first flushing dirty data when the range did not reach EOF. Dirty folios could be written back to the server after FSCTL_SET_ZERO_DATA, refilling the just-zeroed range with stale data.

In the Linux kernel SMB client, the server-side copy path (cifs_file_copychunk_range) and the clone (FICLONE) path of cifs_remap_file_range did not serialise the destination page cache the way other server-side range operations do. As a result, an asynchronous destination writeback could complete after the server-side copy/clone and reinstate stale data over the region just written, corrupting the file.

In the Linux kernel SMB client's cifsFileInfo structure, several flags (invalidHandle, swapfile, oplock_break_cancelled, offload, status_file_deleted) shared the same bitfield byte and were updated in different code paths under different locks. Byte-level read-modify-write operations could overwrite concurrent modifications of other flags.

In the Linux kernel IIO kionix-kx022a driver, when a regmap operation fails in kx022a_fifo_enable(), the allocated sample memory is never freed and the state and previous hardware configuration are not reverted. This can leave WMI interrupts and buffers enabled or driver state flags incorrect.

In the Linux kernel IIO kxcjk-1013 driver, a repeated disable request calls kxcjk1013_set_power_state(data, false), dropping a runtime PM reference that was not acquired for this request. This can underflow the runtime PM usage count and trigger a "Runtime PM usage count underflow" warning.

In the Linux kernel IIO ad4030 driver, ad4030_set_avg_frame_len() computes the logarithm before validating the input. Passing zero or negative values leads to an undefined result from ilog2().

In the Linux kernel IIO ad_sigma_delta driver, samples_buf is allocated at runtime with devm_krealloc(), so its devres entry sits after all probe-time entries. On unbind, samples_buf is freed before iio_device_unregister() disables buffers, and the data ready IRQ is still enabled, allowing ad_sd_trigger_handler() to memcpy() samples into the freed buffer (use-after-free).

In the Linux kernel IIO ade9000 driver, ade9000_setup_clkout() passes NULL as the register address when registering a divider clock. The clock framework calls clk_divider_recalc_rate(), which dereferences the address via readl(), crashing when probing an ADE9000 configured as a clock provider with an external input clock.

In the Linux kernel IIO ade9000 driver, ADE9000_ST1_CROSSING_DEPTH was 25, the exclusive upper bound for scanning STATUS1 event bits, leaving out the highest bit ADE9000_ST1_DIPC_BIT (bit 25). Phase C dip events were never reported.

In the Linux kernel IIO adi-axi-adc driver, the AXI ADC register access paths serialize transactions with st->lock, but probe does not initialize this mutex before registering the backend.

In the Linux kernel, the iio: adc: pac1934 driver fails to check for ACPI label duplication. When label duplication fails, the code reaches the terminating-byte write, accessing a missing label. The issue was detected by static analysis.

In the Linux kernel, the iio: adc: stm32-adc driver has a possible division by zero in processed channel handling. If conversion fails or returns zero, processing the value can lead to division by zero. Errors or zero values must be checked before processing data.

In the Linux kernel, the iio: adc: sun4i-gpadc-iio driver fails to clean up on thermal zone registration failure. If devm_thermal_of_zone_register() fails, probe returns without unregistering the IIO map array or disabling runtime PM. It should jump to err_map to release them.

In the Linux kernel, the iio: adc: xilinx-xadc driver has an issue with resource release ordering on unbind. The ZYNQ XADC alarm IRQ handler queues zynq_unmask_work, which is cleared by a devm callback. The devm callback must be registered before devm_request_irq() so the IRQ is freed first. Otherwise the handler could re-arm the work and run it after the xadc structure has been freed.

In the Linux kernel, the iio: buffer subsystem has an issue with serializing buffer teardown with mode claims. Buffer-mode claims hold mlock to guarantee the device remains in buffer mode until the claim is released. However, iio_device_unregister() disables and deactivates all buffers without taking mlock, which can invalidate buffer state, including active_scan_mask, while a buffer-mode claim is held. mlock should be taken in iio_disable_all_buffers().

In the Linux kernel, the iio: buffer subsystem leaks uninitialized heap memory to userspace. The iio_push_to_buffers_with_ts_unaligned() function exposes uninitialized data when the passed data is not a multiple of 8 bytes and the timestamp is enabled. __GFP_ZERO should be used in devm_krealloc() to clear extra space.

In the Linux kernel, the iio: frequency: adf4377 driver has an issue with incomplete initialization of clk_init_data and clk_parent_data structures. The clk_init_data structure contains mutually exclusive members, and incomplete initialization may cause subtle issues exposed when CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is enabled. adf4377_clk_register() assumes init.parent_names is NULL, but it is uninitialized, which may cause a crash.