Linux kernel vulnerabilities

A use-after-free vulnerability was found in the Linux kernel's Bluetooth 6LoWPAN module, caused by missing L2CAP connection reference during debugfs write operations. This allows a race condition where a concurrent disconnect can free the connection object while it is still being accessed.

In the Linux kernel Bluetooth (MGMT) subsystem, a use-after-free vulnerability exists during advertisement monitor addition. Improper ownership handling between the MSFT add path and management command completion can lead to use of freed memory, as shown by a KASAN report.

In the Linux kernel's Bluetooth ISO subsystem, there is a vulnerability related to improper handling of ISO_END/CONT packets. Incorrect handling can lead to memory leak of conn->rx_skb, kernel panic on skb_put, or acceptance of too short ISO_END packets.

A vulnerability in the Linux kernel Bluetooth L2CAP subsystem causes an identifier (ident) leak for commands without a response. Specifically, repeated L2CAP_LE_CREDITS packets exhaust the 1-255 ident range, leading to packets with invalid ident 0 and permanent channel stall for LE CoC.

In the Linux kernel's accel/amdxdna driver, there is a vulnerability leading to a deadlock during PM resume in hwctx_sync_debug_bo(). The function invokes a hardware callback while holding xdna->dev_lock, which can cause a deadlock when the device is suspended.

In the Linux kernel's accel/amdxdna driver, there is a use-after-free vulnerability due to a race in VMA access. The functions aie2_populate_range() and amdxdna_umap_release() access a saved VMA pointer that may have already been freed, leading to potential use-after-free.

In the Linux kernel's net/tls module, there is an issue in tls_sw_read_sock() that causes empty TLS application data records to block subsequent data records. Empty records (allowed in TLS 1.3) are not consumed, leading to an infinite loop and connection stall.

In the Linux kernel's accel/amdxdna module, there is a race condition in amdxdna_umap_release() that can lead to use-after-free when aie2_populate_range() runs concurrently.

In the Linux kernel's v3d graphics driver, there is a missing validation of the indirect buffer handle in v3d_get_cpu_indirect_csd_params(), which can lead to NULL pointer dereference when the CSD job runs.

In the Linux kernel's net/sched cake module, there is an issue with handling negative overhead values that can cause packet length to wrap to a large value, disrupting rate accounting.

A vulnerability was found in the Linux kernel's perf subsystem for AMD processors. During SVM (virtualization) toggling on PerfMonV2-capable CPUs, amd_pmu_enable_all() incorrectly enables Branch Sampling (BRS) even when not supported by hardware, leading to a #GP fault and potential system crash.

In the Linux kernel's mvebu GPIO driver, there is a memory leak during unbind because generic chips are not freed by mvebu_gpio_remove_irq_domain().

In the Linux kernel's IPv4 IGMP module, there are potential memory leaks in igmp_mod_timer() and igmp_stop_timer() due to incorrect reference counting, leading to the multicast group structure not being freed.

In the Linux kernel, the dm era module has a bug where metadata_open() returning NULL is not handled properly. The era_ctr() function only checks IS_ERR(md), and since IS_ERR(NULL) returns false, NULL is treated as a valid result, leading to a NULL pointer dereference when accessing metadata.

In the Linux kernel, a vulnerability in the CIFS/SMB client causes a busy dentry warning during unmount after direct I/O (DIO) operations. The issue stems from delayed dentry reference release via workqueues, potentially leading to improper unmount. The fix adds a per-superblock outstanding request counter and waits for it to reach zero before unmounting.

In the Linux kernel, the regulator_lock_two() function compares the error code against -EDEADLOCK instead of -EDEADLK. On MIPS, SPARC, and PowerPC architectures these values differ, causing the code to fall into WARN_ON and return with only one regulator locked when a real deadlock backoff occurs. In practice, the bug only affects MIPS because the regulator core is not built or used on the other platforms.

In the Linux kernel DRM fb-helper, the fbdev output is now synchronized to the vblank of an active CRTC only. Previously, the first CRTC was chosen, causing warnings about vblank wait timeouts when the fbdev output was not on CRTC 0. The fix selects the first active CRTC and supports both atomic and non-atomic drivers.

In the Linux kernel octeontx2-af driver, mbox handling for a VF with promiscuous and all_multi flags set to false causes deletion of the PF's promiscuous and allmulti MCAM rules. This occurs because the APIs that enable/disable these rules operate only on the PF, even when the request comes via a VF interface. The fix adds an is_vf() check in the disable paths to prevent a VF from inadvertently clearing the PF's MCAM rules.

In the Linux kernel drm/xe driver, xe_vm_madvise_ioctl() allocates a VMA array in get_vmas(). On error in the L2 flush validation path for PAT madvise, the array is not freed, leading to a memory leak on each failed ioctl. The fix jumps to free_vmas instead of directly to madv_fini.

In the Linux kernel SMB client, smb2_ioctl_query_info() validates the PASSTHRU_FSCTL response payload before copying it to userspace. The addition of OutputOffset and qi.input_buffer_length can wrap in 32-bit arithmetic, allowing a malicious server to bypass the bounds check and read outside the response buffer. The fix uses size_add() for safe addition.

In the Linux kernel trace_remote_alloc_buffer(), if page allocation fails, desc->nr_cpus is not yet incremented for the current CPU, causing a partially allocated rb_desc to not be freed in trace_remote_free_buffer(). The fix increments desc->nr_cpus as soon as the first allocation for the current CPU succeeds.

In the Linux kernel mlxsw driver, mlxsw_sp_port_lag_join() does not release the LAG reference when mlxsw_sp_port_lag_index_get() fails. Other error paths jump to a cleanup label that calls mlxsw_sp_lag_put(), but this path returns an error without releasing. The fix replaces 'return err' with a goto to the cleanup label.

In the Linux kernel mlxsw driver, mlxsw_sp_vrs_lpm_tree_replace() in the error rollback loop does not update the vr pointer, causing the loop to operate on the same VR and not roll back earlier replacements. This leads to a reference leak to new_tree. The fix reinitializes vr inside the loop with the updated index.

In the Linux kernel vduse driver, there is a race between vduse_dev_msg_sync and vduse_dev_read_iter that can lead to a double list_del() crash. The fix ensures that vduse_msg is on send_list or recv_list outside the msg_lock critical section.

In the Linux kernel VDUSE driver, mapping bounce pages to userspace can leak kernel information because the pages are not necessarily page aligned. The fix allocates bounce pages with __GFP_ZERO to avoid leaking information to userspace.

In the Linux kernel, the sof_ipc4_bytes_put() function has a TOCTOU vulnerability where the copy size is derived from the old buffer instead of the new data. This can lead to truncation of valid data or copying stale bytes.

In the Linux kernel, there is a missing validation of the MODULE_NOTIFICATION payload size before reading bytes/channel data in control update handling.

In the Linux kernel, the sof_ipc3_control_update() function calculates expected_size using firmware-provided num_elems, which can overflow on 32-bit platforms. This could allow size comparison to pass with mismatched sizes, potentially leading to out-of-bounds access.

In the Linux kernel, the sof_ipc3_bytes_put() and sof_ipc3_bytes_get() functions have TOCTOU vulnerabilities and incorrect bounds checking. In bytes_put, the copy size is derived from the old buffer, and in bytes_get, the flex array offset is not accounted for.

In the Linux kernel, the sof_parse_token_sets() function lacks validation of the vendor array size before reading it. A malformed topology with a truncated trailing array can cause out-of-bounds read. Additionally, comparison with negative size can pass due to unsigned promotion.

In the Linux kernel, the qrtr_endpoint_post() function has a 32-bit integer overflow in the ALIGN(size, 4) calculation, which can lead to out-of-bounds write and kernel oops on 32-bit platforms.

In the Linux kernel, the check_tp() function does not reject ATM traffic classes above ATM_ANYCLASS, which can lead to out-of-bounds read when reading /proc/net/atm/pvc.

In the Linux kernel for LoongArch, KVM lacks validation of the irqchip index in irqfd routing, which can lead to out-of-bounds access past the routing table's chip array.

In the Linux kernel for LoongArch, the kvm_vcpu_ioctl_interrupt() function did not validate the IRQ number passed from userspace. Validation has been added to prevent potential issues.

In the Linux kernel for KVM on s390, the _gaccess_shadow_fault() function was missing a radix_tree_preload() call, which could prevent forward progress. The missing call was added and the function was split to simplify locking.

In the Linux kernel for KVM on s390, kvm_s390_get_cmma_bits() used vmalloc() for its output buffer, which does not zero the pages. Under certain conditions, uninitialized bytes could be copied to user space, disclosing stale kernel memory. The fix changes the allocation to vzalloc() to zero the buffer.

In the Linux kernel for KVM on s390, kvm_s390_gisc_register() had a GISC refcount leak on AIF enable failure. After registering GISC, if later steps failed, kvm_s390_gisc_unregister() was not called. The fix adds the missing call in the error unwind path.

In the Linux kernel for KVM nVMX, the consistency check for vTPR vs. TPR threshold was moved into normal controls checks. Previously, the check was done late, which could lead to running L1 with an incorrect CR3. The fix simplifies vTPR access and skips the check in some cases.

In the Linux kernel for KVM SEV, intra-host migration/mirroring of SNP VMs has been disallowed because the feature is not fully implemented. Proper migration requires additional SNP-specific state to be transferred. The fix rejects SNP source VMs in migration/mirroring.

In the Linux kernel for KVM TDX, concurrent change to CPUID entry count during initialization is now rejected. Previously, a user could change cpuid.nent between read and copy, potentially leading to out-of-bounds access. The fix requires the copied count to match the value used for allocation.

In the Linux kernel, KVM x86 has a bug where the internal request to service a pending PV EOI is not ignored if the vCPU has disabled PV EOIs since the request was made. This can lead to a kernel BUG in kvm_lapic_sync_from_vapic.

In the Linux kernel, KVM x86 has a vulnerability where the irqfd->producer pointer is not nullified if updating the IRTE for bypass fails. Leaving a dangling pointer can lead to a use-after-free if the irqfd is reachable through KVM's routing, but the producer is freed separately.

In the Linux kernel, KVM's kvm_io_bus_get_dev() returns a device matched only by address, which can cause lifetime issues if the device is not of the expected type. The fix moves the srcu lock responsibility to the caller to avoid use-after-free.

In the Linux kernel, KVM arm64 has an issue with accounting long-term memory pins for protected guests (pKVM). The fix moves the charge from the current process to the kvm's mm to avoid errors during teardown.

In the Linux kernel, KVM arm64 (nested mode) has a bogus WARN when a guest writes to the ZCR_EL2 sysreg alias in a nested context. The fix removes this warning, which could cause a hypervisor panic.

In the Linux kernel, the fbdev metronomefb driver has a potential memory leak in metronomefb_probe(). Memory allocated for pagerefs in fb_deferred_io_init() is not freed on the error path. The fix adds a call to fb_deferred_io_cleanup().

In the Linux kernel, the fbdev broadsheetfb driver has a potential memory leak in broadsheetfb_probe(). Memory allocated for pagerefs in fb_deferred_io_init() is not freed on the error path. The fix adds a call to fb_deferred_io_cleanup().

In the Linux kernel, the fbdev hecubafb driver has a potential memory leak in hecubafb_probe(). Memory allocated for pagerefs in fb_deferred_io_init() is not freed on the error path. The fix is to call fb_deferred_io_cleanup().

In the Linux kernel, the fbdev efifb driver has a memory leak in efifb_probe(). Since commit 73ce73c30ba9, the string returned from fb_get_options() is expected to be freed by the caller, but it is not freed in efifb_probe(). The fix is to free the option string after setup.

In the Linux kernel, the fbdev radeon driver has a potential memory leak in radeonfb_pci_register(). The function allocates memory for modelist (via radeon_check_modes() which calls fb_add_videomode()). The memory is appended to info->modelist, but is not freed in subsequent error paths. The fix is to call fb_destroy_modelist().