Linux kernel vulnerabilities

In the Linux kernel, the fbdev i740fb driver has a potential memory leak in i740fb_probe(). Memory allocated in fb_videomode_to_modelist() for modelist is not freed in error paths. The fix is to call fb_destroy_modelist().

In the Linux kernel, the fbdev s3fb driver has a potential memory leak in s3_pci_probe(). Memory allocated for modelist using fb_videomode_to_modelist() is not freed in subsequent error paths. The fix is to call fb_destroy_modelist().

In the Linux kernel, the fbdev uvesafb driver has a potential memory leak in uvesafb_probe(). Due to an incorrect goto label, memory allocated for modedb and modelist in uvesafb_vbe_init() is not freed in some error paths. The fix is to update the goto label.

In the Linux kernel, the fbdev tdfxfb driver has a potential memory leak in tdfxfb_probe(). Memory allocated for modelist using fb_videomode_to_modelist() when CONFIG_FB_3DFX_I2C is defined is not freed in subsequent error paths. The fix is to call fb_destroy_modelist().

In the Linux kernel, the fbdev carminefb driver has a potential memory leak in alloc_carmine_fb(). Memory allocated for modelist in fb_videomode_to_modelist() is not freed in the subsequent error path. The fix is to call fb_destroy_modelist().

In the Linux kernel, the fbdev vesafb driver has a memory leak in vesafb_probe(). Since commit 73ce73c30ba9, the string returned from fb_get_options() is expected to be freed by the caller. But the string is not freed in vesafb_probe(). The fix is to free the option string after setup.

In the Linux kernel, the fbdev nvidia driver has a potential memory leak in nvidiafb_probe(). Memory allocated for modelist in nvidia_set_fbinfo() is not freed in subsequent error paths. The fix is to call fb_destroy_modelist().

In the tridentfb driver in the Linux kernel, a potential memory leak was detected in trident_pci_probe(). Memory allocated for the modelist using fb_videomode_to_modelist() is not freed in error paths. The issue is fixed by calling fb_destroy_modelist().

In the Linux kernel, a memory leak was found in ASoC SOF topology in snd_sof_load_topology. When the topology filename contains "dummy" and tplg_cnt is 0, the function returns -EINVAL without freeing the memory allocated by kcalloc() for tplg_files. The fix sets ret = -EINVAL and jumps to the out label, which handles kfree(tplg_files).

In the Linux kernel, a heap overflow was found in ASoC SOF ipc3-control in bytes_ext put/get. The ipc_control_data buffer is allocated as kzalloc(max_size), but bounds checks compared user data lengths directly against max_size, ignoring the offset of cdata->data. This allowed writing up to sizeof(struct sof_ipc_ctrl_data) bytes past the end of the heap buffer from unprivileged userspace via the ALSA TLV kcontrol interface, and similarly allowed over-reading adjacent heap data. The fix subtracts sizeof(*cdata) from max_size in all bounds checks.

In the Linux kernel, a missing size validation was found in ASoC SOF ipc3-control in snd_sof_update_control. The firmware-provided cdata->num_elems is checked against local_cdata->data->size but never against the actual allocation size. If local_cdata->data->size was previously set to an inconsistent value, the memcpy could write past the allocated buffer. The fix adds a bounds check to ensure num_elems fits within the available space in the ipc_control_data allocation.

In the Linux kernel, a missing check of pm_runtime_get_sync() return value was found in ASoC mediatek mt8192 during probe. If runtime resume fails, probe continues without the device necessarily being accessible, and the PM usage count may remain incremented. The regmap_reinit_cache() error path also returns before dropping the temporary PM reference and clearing pm_runtime_bypass_reg_ctl. The fix uses pm_runtime_resume_and_get() and clears the flag after dropping the PM reference.

In the Linux kernel, a missing release of reserved memory was found in ASoC mediatek mt8192 during cleanup. The probe calls of_reserved_mem_device_init() and falls back to preallocated buffers when no reserved memory region is available. When the reserved memory assignment succeeds, however, the driver never releases it. The fix registers a devm cleanup action after a successful assignment so the assignment is released on probe failure and driver unbind.

In the Linux kernel, a missing release of reserved memory was found in ASoC mediatek mt8183 during cleanup. The probe can assign reserved memory with of_reserved_mem_device_init(), but the assignment is never released on driver removal or later probe failures. The fix registers a devm cleanup action so the reserved memory assignment is released consistently, matching newer Mediatek AFE drivers.

In the Linux kernel, a NULL pointer dereference was found in ASoC qcom q6apm in graph_callback. When q6apm_free_fragments() is called, it frees rx_data.buf/tx_data.buf and sets them to NULL under graph->lock. A late DSP buffer-done response can race with this: graph_callback() passes the !graph->ar_graph guard (not yet NULL), acquires the lock, but then dereferences a now-NULL buf pointer, crashing. The fix adds a NULL check for buf inside the mutex-protected section in both write-done and read-done handlers.

In the Linux kernel, a bug was found in netfilter xt_cluster where template conntracks are treated as fully initialized in hash match. xt_cluster_mt() treats any non-NULL nf_ct_get() result as a fully initialized conntrack and passes it to xt_cluster_hash(). Templates carry IPS_TEMPLATE status but do not have a valid tuple for hashing yet, so xt_cluster_hash() can hit its WARN_ON() path on the zeroed l3num field. The fix rejects template conntracks before hashing them.

In the Linux kernel, an issue was found in netfilter nf_queue regarding pinning the bridge device while NFQUEUE holds a fake dst. The br_netfilter fake rtable is embedded in struct net_bridge and attached to bridged packets with skb_dst_set_noref(). If such a packet is queued to NFQUEUE, __nf_queue() upgrades that fake dst with skb_dst_force(). The fix keeps the bridge fake dst model unchanged and pins the bridge master device only while the packet sits in NFQUEUE, recording the bridge device in nf_queue_entry and taking a device reference for the queue lifetime.

In the Linux kernel, the nft_fib netfilter module has a NULL pointer dereference vulnerability when a fib expression is used in a netdev egress base chain. Validation incorrectly accepts the egress hook, leading to a system crash.

In the Linux kernel, the nf_conntrack_sip netfilter module lacks validation of skb_dst() before accessing it. When routing information is unavailable (e.g., in tc ingress or openvswitch), a crash may occur.

In the Linux kernel, the nft_set_pipapo netfilter module has a vulnerability that leaks a bad clone into a future transaction. Memory allocation failure can lead to out-of-bounds writes during subsequent operations.

In the Linux kernel, the nf_conntrack_reasm netfilter module has a vulnerability due to an incorrect mac_header adjustment after IPv6 defragmentation. This can lead to incorrect reporting of a MAC header presence.

In the Linux kernel, the netfilter nf_conncount module has a vulnerability in the tuple deduplication logic due to incorrect zone comparison. Passing the zone direction bitmask as the direction argument causes different zones to be treated as equal, leading to incorrect connection counting and bypass of connlimit limits.

In the Linux kernel, the gpu: host1x module has a device reference leak in the error path of host1x_device_parse_dt(). The object is freed directly with kfree instead of put_device(), leading to a leak.

In the Linux kernel GPU buddy subsystem, an alignment issue was found in the try_harder function. When a candidate was not aligned to min_block_size, the returned range could have an incorrect offset. The fix aligns candidates down to min_block_size instead of rejecting the request, ensuring correct operation.

In the Linux kernel SELinux module, connect-related permissions were not checked when using TCP Fast Open. The fix adds a call to selinux_socket_connect() in the socket_sendmsg() hook when MSG_FASTOPEN is used.

In the Linux kernel SELinux module, selinux_sctp_bind_connect() dereferenced sk->sk_socket, which could cause issues when the hook was invoked from the ASCONF softirq path. The fix refactors the code to use struct sock * directly and avoid sk_socket dereference.

In the Linux kernel uleds driver, a potential buffer overread was found due to lack of guaranteed null-termination of the name string from userspace. The fix uses strnchr() and checks proper string termination.

In the Linux kernel sm501 driver, a reference leak was found on failed device registration. The fix adds a call to platform_device_put() before returning the error.

In the Linux kernel x86 boot code, an issue was found with validation of the console=uart8250 parameter, where an invalid baud rate could cause a system hang during early boot due to division by zero. The fix adds a fallback to DEFAULT_BAUD when the rate is 0.

In the Linux kernel perf/x86/amd/brs subsystem, a kernel address leak to user space was found. Despite requesting PERF_SAMPLE_BRANCH_USER, branch records may contain kernel addresses. The fix extends the software filter to drop records with kernel branch-from addresses.

In the Linux kernel s390/perf_cpum_cf subsystem, a speculation barrier (array_index_nospec) was missing when using the ev variable as an array index. The fix adds a call to array_index_nospec() to prevent speculative execution.

In the Linux kernel batman-adv, a use-after-free issue was found due to potential buffer reallocation by pskb_may_pull() in batadv_interface_rx(). The fix reassigns the ethernet header pointer after reallocation.

In the Linux kernel's batman-adv module, after pskb_may_pull() is called by batadv_bla_is_backbone_gw(), the skb buffer may be reallocated. The gateway address pointer was not reassigned after this reallocation, potentially leading to a use-after-free.

In the Linux kernel's batman-adv module, the function batadv_interface_tx() assumes that at least ETH_HLEN bytes are available but does not check this itself. A local user with eBPF TC hook access can truncate the packet and redirect it to a batadv interface, potentially leading to an out-of-bounds read.

In the Linux kernel's batman-adv module, the function batadv_send_tt_request() checks for 'ret == true' instead of 'ret == false' after a failed send buffer allocation. This causes the TT request information not to be cleaned up, potentially leading to request storms.

In the Linux kernel's batman-adv module, the function batadv_frag_send_packet() does not properly handle errors during pre-checks for empty payload or zero fragment size. In such cases, the skb is not freed, leading to memory leaks.

In the Linux kernel's batman-adv module, during mesh interface registration, if another receiver of the NETDEV_REGISTER notification vetoes the registration, the batadv_meshif_vlan object is not cleaned up because .dellink is not called. This leads to a memory leak.

In the Linux kernel's batman-adv module, during fragmentation, if linearization of an skb with a frag_list fails, the reference to primary_if is not released, leading to a reference leak.

In the Linux kernel's batman-adv module, when checking data availability for the num_dests field in struct batadv_tvlv_mcast_tracker, offsetof() is used instead of offsetofend(), which always returns 0. This causes the check to always pass, even when only 0 or 1 bytes are available, leading to an out-of-bounds read.

In the Linux kernel's jbd2 module, the function jbd2_journal_initialize_fast_commit() validates journal capacity, but due to an integer underflow on unsigned numbers, the check can be bypassed. This leads to corruption of j_last, j_fc_first, and j_free, resulting in journal abort.

In the Linux kernel's nvdimm/btt subsystem, arenas allocated by discover_arenas() or create_arenas() are not freed on some error paths in btt_init(). This leaks memory when BTT initialization fails. The fix calls free_arenas() from the affected error paths.

In the Linux kernel's nvdimm/btt subsystem, memory allocated by btt_freelist_init(), btt_rtt_init(), and btt_maplocks_init() is not freed on some discover_arenas() error paths. This leaks memory when arena discovery fails. The fix adds missing kfree() calls before returning an error.

In the Linux kernel's lockd subsystem, when nlm_do_fopen() fails, the newly allocated nlm_file object is not freed because the error path goes to out_unlock instead of out_free. A client can repeatedly trigger nlm_do_fopen() failures, causing memory leaks. The fix routes the failure through out_free to call kfree().

In the Linux kernel's lockd module, there is an nlm_file refcount leak when the cached nlm_do_fopen() call fails. The cached path in nlm_lookup_file() always reaches the 'found' label even on error, leading to an unreleased reference and preventing proper file cleanup.

In the Linux kernel's remoteproc module for Qualcomm platforms, there is a memory leak when adding custom dump segments fails. The allocated minidump_region 'name' is not freed if the operation fails before adding the region to the list.

In the Linux kernel for MIPS DEC, in 64-bit configurations, calling the firmware entry point prom_printf() from a kernel thread other than the initial one can use a stack pointer in the XKPHYS 64-bit segment. This causes incorrect behavior of 32-bit ALU operations in firmware code, leading to a system hang. Only the prom_printf() entry point is affected; other entry points are safe.

In the Linux kernel's cpcap-battery driver, a missing nvmem_device_put() call causes a permanent reference leak to the nvmem device. The leak occurs on success and read-failure paths in cpcap_battery_detect_battery_type().

In the Linux kernel's hugetlb module, there is a mismatch between rsvd charge and uncharge in hugetlb cgroup. A single h_cg pointer is overwritten, leading to the wrong cgroup being used during uncharge, causing a page_counter underflow.

In the Linux kernel's memory_hotplug module, there is a bug where NULL is passed instead of altmap in the error path. When arch_add_memory() succeeds and create_memory_block_devices() fails, arch_remove_memory() is called with NULL altmap, leading to memory corruption.

In the Linux kernel, a memory leak was found in the NTFS filesystem during failed mount operations. The ntfs_fill_super() function did not release all volume-related resources, such as the NLS map, volume label, and empty bits page, leading to memory accumulation on each failed mount attempt.