Linux kernel vulnerabilities

In the Linux kernel, the SCTP function sctp_assoc_update_retran_path() could loop forever when every remaining transport, including retran_path, was SCTP_UNCONFIRMED, because the state check ran before the wraparound test. The fix considers a transport only when it is not UNCONFIRMED and checks whether the walk returned to retran_path, also restoring the NULL guard.

A vulnerability in the Linux kernel BPF subsystem related to ownership tracking of local objects through referenced kptrs has been fixed. Self-referential or long acyclic local kptr type chains could cause kernel stack exhaustion when dropping the head object. The fix bounds ownership depth to eight record-bearing types and rejects cycles.

In the Linux kernel, the USB catc driver's catc_rx_done() bounded packet length against the whole transfer (urb->actual_length) instead of the bytes left from pkt_start, so a crafted packet header made skb_copy_to_linear_data() read past the buffer. Lengths below ETH_HLEN, including zero, were also accepted, causing eth_type_trans() to read a MAC header from uninitialised tailroom.

In the Linux kernel, the kfunc bpf_crypto_ctx_create() read params->reserved[0] and params->reserved[1] before comparing params__sz against the size of struct bpf_crypto_params, even though the verifier only guarantees params__sz bytes are valid. A BPF program could pass a shorter buffer and cause the kernel to read past the validated region.

In the Linux kernel, hfsc_classify() (net/sched: sch_hfsc) applies the level check only when the filter result carries no bound class; a filter created with a flowid gets res.class set once at bind time, so the check never runs during classification. When hfsc_adjust_levels() later raises a class's level without revalidating existing bindings, two binds that were each legal at bind time can point at each other, causing the classify walk to bounce between two interior classes forever with the qdisc lock held and BH disabled — a soft lockup from a single packet. The issue is reachable from an unprivileged user via unshare -Urn (CAP_NET_ADMIN).

In the Linux kernel, the drm/virtio driver's virtio_gpu_gem_create() called drm_gem_object_release() on the drm_gem_handle_create() error path instead of dropping the reference, leaving the bo at refcount 1 with no remaining reference. As a result virtio_gpu_free_object() never ran, leaking shmem pages, the sg table, the virtio_gpu_object, and the host-side resource and resource id.

In the Linux kernel, the drm/virtio driver's virtio_gpu_resource_create_ioctl() called drm_gem_object_release() on the drm_gem_handle_create() error path instead of dropping the reference it owns, so obj->funcs->free() never ran. This leaked the virtio_gpu_object, its pages and sg table, the resource id, and the host-side resource.

In the Linux kernel, virtio_gpu_resource_create_blob_ioctl() in the drm/virtio driver leaks objects. The error paths call drm_gem_object_release() instead of dropping the owned reference, so free() never runs and the virtio_gpu_object, resource id and host-side resource are leaked.

In the Linux kernel, virtio_gpu_vram_create() in the drm/virtio driver frees the object with a bare kfree(vram) on error paths after GEM initialization. The freed object remains in the VMA offset manager's interval tree, so later lookups or insertions walk freed memory, and the dma_resv and gpuva locks are never destroyed.

In the Linux kernel, the drm/bridge samsung-dsim driver has an incorrect TE GPIO lifetime for host attach. Switching to devm_gpiod_get_optional() while keeping matching gpiod_put() calls is wrong for a managed descriptor; dropping the puts is also wrong because TE IRQ registration runs from the host attach callback and detach/reattach can occur without destroying the owning device.

In the Linux kernel, the ovpn module publishes struct ovpn_bind through peer->bind with RCU, but local endpoint learning updates bind->local in place under peer->lock while the UDP TX path reads the field without that lock. A concurrent IPv6 update can therefore result in a torn address read.

In the Linux kernel, the ovpn module's UDP output fallback clears bind->local in place when the remembered source address is no longer usable. Because the bind is RCU-published and read locklessly by concurrent TX, an IPv6 reader can observe a torn address.

In the Linux kernel, Bluetooth BNEP frame processing contains multiple out-of-bounds reads. bnep_rx_frame() and bnep_ctrl_frame() do not verify the BNEP header, control type byte, filter count and extension headers exist before reading them, and bnep_net_xmit() reads the 14-byte Ethernet header without checking skb->len >= ETH_HLEN.

In the Linux kernel, the Bluetooth btintel_pcie driver does not validate device-supplied DMA indices. urbd1->frbd_tag is used directly as an array index into rxq->bufs[] (only 64 entries) without bounds checking, and cr_hia read from a DMA-shared index array can cause an infinite loop when it exceeds rxq->count.

In the Linux kernel, rfcomm_recv_frame() accepts too-short RFCOMM frames with an extended length field (EA=0). The length check passes a 4-byte frame, and after FCS trimming skb_pull() fails with its return value ignored, so the un-pulled 3-byte header is processed as application payload or a multiplexer command.

In the Linux kernel, stack_slot_obj_get_spi() does not reject non-negative offsets. For off == 0 the computed spi equals that of the valid stack slot at fp-8, so a PTR_TO_STACK register holding fp+0 can be validated against an iterator stored at fp-8, and an effectful iterator kfunc can interpret memory outside the BPF stack as iterator state.

A vulnerability exists in the Linux kernel's IPv6 routing exception handling. When a route (fib6_info) is being removed, rt6_insert_exception() can still create a new exception because the FIB6_EXCEPTION_BUCKET_FLUSHED flag is no longer set at the right time. This creates a reference cycle, leaks memory, and stalls network device unregistration.

In the Linux kernel, the sr9700 USB driver checked the packet payload length against the whole remaining receive buffer without accounting for the header and CRC overhead. This can lead to incorrect length calculations and improper data copying.

In the Linux kernel, a race condition in IPv6 route handling causes list_empty() to return true when list_del_init() runs concurrently, leading to a leak of dst structures and associated devices. The issue affects uncached routes.

A flaw was fixed in the Linux kernel's UDP socket handling where a disconnected socket remained in the 4-tuple hash table. This keeps hash4_cnt raised and forces packets for that address and port through the 4-tuple lookup first; on IPv6 it can also allow matching datagrams from the former peer with a zero source port. The fix removes the socket from the table before __udp_disconnect() runs.

In the Linux kernel, the tg3 driver fails to release PHYLIB resources (MDIO bus and PHY) when tg3_init_one() fails. This leads to resource leaks on initialization failure.

In the Linux kernel, the debug_info_copy() function in the s390/debug subsystem can dereference NULL pointers when debug_register_static() fails and leaves area bounds unchanged while clearing pointers. The issue occurs when copying such an area.

In the Linux kernel, the spacemit network driver fails to clear the TX descriptor on fragment mapping failure, leaving the TX_DESC_0_OWN flag and stale DMA addresses. This can lead to the DMA engine using freed memory.

In the Linux kernel, the skb_pointer_if_linear() function uses unsigned subtraction that can underflow, causing the bounds check to spuriously pass and generate an invalid pointer in skb-backed BPF dynptrs.

In the Linux kernel, the bpf_sock context access code generates incorrect register values when reading the rx_queue_mapping field, using sign-extending MOV64 instead of MOV32. This creates a mismatch between runtime values and verifier assumptions.

In the Linux kernel, the BPF verifier does not reject passing PTR_TO_PACKET pointers to subprograms that may mutate the packet. Since these pointers are passed as PTR_TO_MEM, invalid memory may be used.

In the Linux kernel, sock_map_alloc() did not validate the upper bound of max_entries, accepting values up to UINT_MAX. When a SOCKMAP is created with max_entries = 0xffffffff, the signed int iterator in sock_map_free() overflows to a negative value, causing an out-of-bounds write that can crash the kernel or corrupt memory.

In the Linux kernel, the firewire cdev driver has a back-transition bug in the iso_resource_auto client resource state. Concurrent access from the work item and the file descriptor release function can cause the state to transition backwards from ISO_RES_AUTO_DEALLOC to ISO_RES_AUTO_REALLOC. The fix checks the current state before updating it in the work item.

In the Linux kernel, the SCTP stack has a timer handling race. The code calls mod_timer() before taking the reference needed by the rearmed timer without holding the sock lock, which can lead to use-after-free and refcount underflow. The fix takes the reference before mod_timer() and drops it if the timer was already pending.

In the Linux kernel, the eth fbnic driver has an issue with rounding zero ring sizes. roundup_pow_of_two() is undefined for zero, and ethtool permits a zero ring size to reach the driver. The fix leaves zero unchanged so the minimum-size check rejects it deterministically.

In the Linux kernel, the net/sched em_text_dump() function allocates struct tcf_em_text on the stack without zeroing it. strscpy() writes the algorithm name and NUL terminator, leaving remaining bytes uninitialized, which are then copied to the netlink response. The fix zero-initialises the struct, closing the leak.

In the Linux kernel, the NFC nfcmrvl driver's firmware download receive path removes the NCI header and reads the helper command before validating the remaining packet length. A short frame can reach the data access before the malformed packet is rejected. The fix validates the complete helper command length before stripping the NCI header.

In the Linux kernel, the NFC st21nfca driver's st21nfca_hci_i2c_repack() trims a received frame at its EOF marker before removing byte stuffing, assuming the truncated frame contains the LLC header and two CRC bytes. A malformed frame can leave too few bytes for check_crc() or cause the unstuffing loop to read past the skb length. The fix requires minimum framing bytes before and after unstuffing and rejects an escape marker without its encoded byte.

A flaw exists in the Linux kernel's nfc_llcp_recv_dm() function handling NFC LLCP sockets. The function fails to take the socket lock and unlink the socket from the connecting_sockets list before setting its state to LLCP_CLOSED, causing list corruption and refcount desync. An unprivileged local process can trigger unbounded kernel socket leaks leading to memory exhaustion and DoS.

In the Linux kernel NFC LLCP subsystem, a race condition exists in the accept queue lifecycle. nfc_llcp_socket_release() uses bh_lock_sock(), which does not synchronize with process-context lock_sock() held by nfc_llcp_accept_dequeue() during accept(), leading to use-after-free or NULL pointer dereference in nfc_llcp_accept_unlink(). The fix changes synchronization and defers final release to a workqueue.

In the Linux kernel, the NFC llcp nfc_genl_llc_sdreq() function builds a list of TLV nodes, but three error paths (nested-attr parse failure, TLV alloc ENOMEM, nfc_llcp_send_snl_sdreq() failure) skip freeing already queued items. The fix routes them through a new free_list label, mirroring the SDRES path.

In the Linux kernel, the NFC st21nfca driver's ISO15693 inventory helper removes a two-byte prefix without checking that it exists, then accepts a one-byte remainder before reading data[1] as the DSFID. The fix requires the prefix and at least two remaining bytes before copying UID data and reading the DSFID.

In the Linux kernel, nfc_llcp_wks_sap() compared only service_name_len bytes, so a short service_name like "u" matched longer WKS strings such as "urn:nfc:sn:snep". The fix requires an exact length match before strncmp().

In the Linux kernel, nfc_llcp_wks_sap() and nfc_llcp_build_sdreq_tlv() passed non-null-terminated strings to pr_debug() using the %s format specifier. Buffers allocated via kmemdup() or coming from netlink attributes are not guaranteed to be null-terminated, causing reads beyond the allocated region (slab-out-of-bounds).

In the Linux kernel, the nfc pn533 driver in pn533_acr122_is_rx_frame_valid() read frame->ccid.datalen directly from the USB response frame and used it unchecked as an index into frame->data[]. A malicious or malfunctioning device can set this field to an arbitrary value, causing reads far outside the received buffer.

In the Linux kernel, bcmgenet_netif_stop() and the Wake-on-LAN branch of bcmgenet_suspend() disabled Tx queues before stopping Tx NAPI. An in-flight completion called netif_tx_wake_queue() in between, allowing a transmit to reach the rings after they had been freed, causing a use-after-free.

In the Linux kernel, skb_maybe_pull_tail() subtracted skb_headlen(skb) from the unsigned max argument and passed the result to __pskb_pull_tail() as a signed int. When an skb had a linear area larger than MAX_IPV6_HDR_LEN, the difference wrapped to a negative value, potentially causing a very large copy length in skb_copy_bits().

In the Linux kernel, the BPF JIT for MIPS32 emitted an addu instruction instead of addiu, causing the immediate value 1 to be interpreted as register $at. This made the comparison result invalid when the immediate operand was negative.

In the Linux kernel, in stmmac_rx(), when napi_build_skb() fails, the descriptor page is recycled back to the page pool via page_pool_recycle_direct(), but buf->page is left pointing at the recycled page. As a result, stmmac_rx_refill() skips the replacement allocation and programs the already-recycled page back into the RX descriptor.

In the Linux kernel, the seg6, ioam6 and rpl lwtunnels sized their skb_cow_head() request as the length of new headers plus dst_dev_overhead(), then rebuilt the MAC header via skb_mac_header_rebuild(). When the MAC header was longer than the reserved space (e.g., on ingress through a VLAN device with reorder_hdr off), the rebuild computed a negative offset and wrote about 64 KB past skb->head.

In the Linux kernel, ipgre_netlink_parms() can enable collect_md on an existing GRE, GRETAP or ERSPAN device. Unlike newlink, changelink does not enforce metadata tunnel uniqueness, so converting a non-metadata device can replace the metadata receive entry for another device in the same netns, and deleting either device clears the shared entry.

In the Linux kernel, vxlan_na_create() sampled LL_RESERVED_SPACE() to size the reply skb and then sampled it again to reserve headroom. A concurrent vxlan_changelink() could update needed_headroom between the two reads, creating a TOCTOU race where the second value could exceed the allocation and cause an out-of-bounds Ethernet header write.

A vulnerability was found in the Linux kernel's XPS (Transmit Packet Steering) networking code. When the number of traffic classes (num_tc) is lowered, e.g. via mqprio, stale entries remain in tc_to_txq[] and prio_tc_map[]. __netif_set_xps_queue() fails to reject a class outside the num_tc range, causing an out-of-bounds write past the XPS map and kernel memory corruption (slab-out-of-bounds).

In the Linux kernel, the drm/imagination driver did not bound the firmware reconstruction count to the size of the protocol arrays. An oversized count led to out-of-bounds access to the request's fixed freelist ID array and the copy into the fixed response array. The fix clamps the count to the request capacity and uses it consistently for reconstruction and response publication.

In the Linux kernel, the net: dsa: mt7530 driver's mt7530_remove() unconditionally disables the core and io regulators, even though they are only requested for the ID_MT7530 chip. On MT7621 and MT7531 the pointers remain NULL, so rmmod or a sysfs unbind calls regulator_disable() on NULL.