Linux kernel vulnerabilities

In the Linux kernel intel/tpmi driver, the mem_write() function did not release the temporary array returned by parse_int_array_user() on all exit paths. The fix uses cleanup.h scope-based cleanup to free it automatically.

In the Linux kernel dell-laptop driver, dell_init() does not clean up all resources if LED or backlight registration fails. The fix adds missing cleanup calls before returning an error.

In the Linux kernel ISST driver, after resume, SST-PP control is only restored to power domain 0, even though values are stored for all domains. The fix uses pd_info->sst_base instead of power_domain_info->sst_base.

In the Linux kernel i2c-imx driver, the atomic (polling) path rejects an SMBus block read with a byte count of 0 as -EPROTO, but does not send NACK+STOP, causing the I2C bus to lock up. The fix handles count 0 as a valid empty block read and releases the bus.

In the Linux kernel i2c-imx driver, the interrupt-driven path rejects an SMBus block read with a byte count of 0 as -EPROTO, but does not send NACK+STOP, causing the I2C bus to lock up. The fix accepts count=0 and sends NACK and STOP.

In the Linux kernel i2c-mlxbf driver, mlxbf_i2c_init_resource() frees tmp_res before reading tmp_res->io, leading to a use-after-free. The fix saves the error code before freeing.

In the Linux kernel, the xen/gntdev driver has an error handling issue in the ioctl function. When copying the result to userspace fails, the reference to the mapping is not released, causing a memory leak and a dangling list entry. Additionally, the mapping index may be modified, so it must be retrieved after gntdev_add_map() completes.

In the Linux kernel, the xfrm_interface module lacks a CAP_NET_ADMIN requirement in the interface's network namespace during changelink operations. A caller privileged only in one namespace can modify an interface in another namespace, breaking isolation.

A vulnerability was discovered in the Linux kernel TPM character device drivers. Due to FMODE_PREAD and FMODE_PWRITE flags being left enabled, positional read/write operations (pread/pwrite) could lead to out-of-bounds heap reads and out-of-bounds zero writes. The issue is fixed by calling nonseekable_open(), which causes positional operations to fail with -ESPIPE.

A vulnerability in the Linux kernel's SPI driver for i.MX devices (spi-imx) was found. When DMA is selected but the DMA descriptor cannot be prepared, the driver falls back to PIO without undoing DMA configuration, leading to corrupted data transfers. This affects e.g. i.MX8MP boards with Infineon SLB9670 TPM, where data is shifted and the device fails.

In the Linux kernel, the spi-uniphier driver has an initialization order issue: devm_request_irq() is called before initializing the completion used by the interrupt handler. This can lead to calling complete() on an uninitialized completion, causing undefined behavior (observed with KASAN).

In the Linux kernel, the NFS module has an issue with charging unstable writes: nfs_folio_mark_unstable() and nfs_folio_clear_commit() charge NR_WRITEBACK/WB_WRITEBACK by folio size, not request size. When a folio is split into multiple requests, each request charges the whole folio size, inflating counters and potentially forcing hard throttling for all writers.

In the Linux kernel, the nvme-apple driver on Apple A11 has an issue with command tags: tags of pending commands must be unique across admin and IO queues, otherwise the firmware crashes with "duplicate tag error". The workaround for M1 is missing for A11.

In the Linux kernel, the nvmet_sq_create() function has a reference leak. It takes a reference on the ctrl structure, but on error from nvmet_check_sqid() it returns without releasing the reference. The fix jumps to the 'ctrl_put' label to properly release it.

In the Linux kernel, netdev_nl_napi_fill_one() reports the NAPI thread PID in the initial PID namespace instead of the caller's namespace. Since NETDEV_CMD_NAPI_GET lacks admin permission and is netnsok, a caller in a child PID namespace sees the global PID, which should be 0. The fix translates the PID through the caller's namespace.

In the Linux kernel, the CAN ISO-TP module has an RCU synchronization issue in isotp_release(). When NETDEV_UNREGISTER runs first, the function skips synchronization, potentially cancelling a timer while isotp_rcv() is still executing and about to re-arm it, leading to a use-after-free. The fix makes isotp_release() always call synchronize_rcu() before cancelling timers.

A use-after-free vulnerability was found in the Linux kernel's CAN ISO-TP module (can/isotp). The issue occurs during concurrent network device unregistration (NETDEV_UNREGISTER) and socket release (isotp_release), potentially leading to use of freed memory.

In the Linux kernel, a vulnerability in the CAN ISO-TP subsystem was fixed regarding unsynchronized TX state machine transitions. Different contexts (sendmsg, RX path, timers) could act on stale state, corrupting unrelated transfers. The fix serializes the full TX claim lifecycle under so->rx_lock.

A use-after-free (UAF) vulnerability was found in the Linux kernel's CAN BCM (Broadcast Manager) module, specifically in the hrtimer. The issue stems from a missing RX_NO_AUTOTIMER flag check in the packet RX fast-path, allowing the timer to be re-armed after call_rcu() has scheduled memory deallocation. The fix defers timer cancellation and memory freeing to a dedicated workqueue and holds a socket reference until the deferred work completes.

In the Linux kernel, the CAN BCM module has a race condition between lockless reads of bo->ifindex and bo->bound and their locked modifications. This can cause a socket bound to a specific CAN interface to also match 'any' interface. Additionally, bcm_rx_setup() may silently return success when the device disappears concurrently instead of reporting -ENODEV.

A vulnerability in the Linux kernel's CAN BCM (Broadcast Manager) module was found, caused by missing synchronization when updating timer and filter values. Concurrent access from CAN traffic handling threads can lead to a race condition, resulting in incorrect behavior or potential privilege escalation.

In the Linux kernel, the CAN BCM module lacks proper RCU list operations. bcm_rx_setup() and bcm_tx_setup() do not use list_add_rcu(), which can lead to improper initialization of the bcm_op structure during traversal by bcm_proc_show(). Also, bcm_release() removes operations without list_del_rcu(), potentially causing synchronization issues.

In the Linux kernel, the CAN BCM module extends the use of bcm_tx_lock for data and timer updates. New frame data is first validated in a separate buffer and then copied under the lock, preventing observation of partially updated frames. Error handling for memcpy_from_msg() was added, and timer updates were moved under the lock, eliminating torn 64-bit reads on 32-bit platforms.

A data race was detected in the Linux kernel's CAN BCM (Broadcast Manager) module when CAN frames are processed concurrently on different CPUs. The issue affects RX/TX statistics updates, potentially leading to inconsistent data in procfs. The fix introduces atomic operations and synchronization in critical sections.

In the Linux kernel, the CAN BCM module has a data race on rx_stamp and rx_ifindex fields in bcm_rx_handler(). For RX ops subscribed on all interfaces, the function can run concurrently on different CPUs, leading to inconsistent writes, including torn 64-bit timestamps on 32-bit platforms. The patch places the assignment of these fields in the same lock section as the content comparison.

In the Linux kernel, the CAN BCM module has an issue with stale RX/TX ops after device removal. For RX, an RX_SETUP update could skip re-registering the filter when the device was removed, leaving the filter inactive. For TX, bcm_notify() did not handle tx_ops, leading to an endless timer re-arming and potential injection into a later reused ifindex.

In the Linux kernel, the CAN BCM module adds tracking of a single source interface for ANYDEV ops with timeout or throttle. Previously, when frames matched from different interfaces, races and data corruption could occur. Now the first interface that delivers a matching frame is remembered, and frames from other interfaces are rejected.

In the Linux kernel, the CAN BCM module lacks frame length validation in bcm_rx_setup() for RTR replies. bcm_tx_setup() validates frame length, but bcm_rx_setup() does not, which can lead to incorrect data.

In the Linux kernel, the CAN BCM module lacks proper device refcounting during CAN filter removal. Functions bcm_release(), bcm_delete_rx_op(), and bcm_notifier() relied on re-looking up the device by ifindex, which could fail during concurrent unregistration, leaving a stale filter. The patch adds holding a reference on op->rx_reg_dev from filter registration to unregistration.

A vulnerability in the Linux kernel's io_uring/bpf-ops mechanism allows re-registration of an already-bound BPF ops set. An attacker with CAP_BPF and CAP_PERFMON can trigger a use-after-free in io_uring context, potentially leading to privilege escalation or system crash.

In the Linux kernel, the BPF verifier fails to reset register bounds before narrowing the return value range of an LSM hook, leading to a verifier/runtime mismatch. An attacker could exploit this to bypass BPF memory safety checks.

In the Linux kernel, during fork(), the bpf_storage field in the task structure may not be initialized before certain error paths, leading to use of an uninitialized pointer. This can cause system hangs or use-after-free (UAF).

In the Linux kernel's sparx5 network driver, if workqueue allocation fails, the blocking notifier registration is not undone, leading to resource leak. This can cause system instability or crash.

In the Linux kernel, the dm thin metadata module has a vulnerability causing metadata inconsistency when a metadata snapshot reservation or release operation fails during commit. Direct modifications to the held_root field in the superblock are flushed to disk on transaction abort, corrupting metadata.

In the Linux kernel's dm-era module, there is an out-of-bounds memory access when the start sector is non-zero. The writeset block calculation does not apply the target offset, potentially leading to out-of-bounds read (detected by KASAN).

In the Linux kernel's dm-ioctl module, there is a potential buffer overflow in list_version_get_info. The code writes 16 bytes into a 12-byte buffer, which can lead to buffer overflow.

In the Linux kernel's dm-log module, there is a bitset_size overflow on 32-bit machines. Rounding region_count to a multiple of BITS_PER_LONG can cause wrap to zero, leading to incorrect memory allocation.

In the Linux kernel's dm-pcache module, the option parser does not check that each option has a value, which can lead to NULL pointer dereference. A malformed table can cause a system crash.

In the Linux kernel's dm module, there is a leak of the caller's thread keyring via the table device file. This causes the LUKS volume key to remain in memory after luksSuspend, potentially allowing its recovery.

In the Linux kernel, the dm_early_create function has a bug where it attempts to free an already used table when dm_resume fails. The table was already instantiated with dm_swap_table, and the code tries to destroy it again, which may lead to incorrect behavior. The fix skips the dm_table_destroy call in this case.

In the Linux kernel, the dm-integrity module has a bug that causes a leak of uninitialized kernel memory. When the hash size is less than the device's tuple size, dm-integrity is supposed to zero the remaining space, but due to a bug the zeroing does not work. The fix addresses this issue.

In the Linux kernel, the dm-integrity module has a bug that can lead to a deadlock. When dm_integrity_check_limits fails, the code exits with DM_MAPIO_KILL, but the range is already locked and not unlocked. The fix moves the limit check earlier to avoid resource leaks.

In the Linux kernel, the dm-integrity module has a bug where the hash_offset variable is incremented twice. The variable is already incremented in the loop, and the code increments it again, leading to incorrect behavior. The fix removes the extra increment.

In the Linux kernel, the dm-verity module has a possible NULL pointer dereference in dm_verity_loadpin_is_bdev_trusted when the device has no table. The fix addresses this issue.

In the Linux kernel, the dm-verity module's error counter was not atomic, which could lead to race conditions. As a result, the call to dm_audit_log_target("max-corrupted-errors") may be skipped. The fix makes the counter atomic.

In the Linux kernel, the dma_fence_dedup_array() function returns 1 when called with a count of 0, which contradicts the documentation and may lead to dereferencing an uninitialized pointer in amdgpu_userq_wait_*(). The fix makes the function return 0 for an empty array.

In the Linux kernel, the dma-buf/dma-fence module has a potential NULL pointer dereference due to incorrect ordering of operations on weakly ordered platforms. The fix replaces the signaled-bit check with synchronization on the ops pointer.

In the Linux kernel, the accel/amdxdna module has a use-after-free bug in amdxdna_gem_dmabuf_mmap(). When vm_insert_pages() fails, the error path calls close, which releases the GEM object, and then the code releases it again, leading to access to freed memory. The fix returns directly from close_vma.

In the Linux kernel accel/amdxdna driver, amdxdna_cmd_submit() calls the cmd_submit pointer without checking if it is defined. For AIE4 devices (aie4_vf_ops) this pointer is NULL, leading to a NULL function-pointer call via the AMDXDNA_EXEC_CMD ioctl and a kernel oops. The fix rejects the submission with -EOPNOTSUPP when the device provides no cmd_submit op.

In the Linux kernel accel/amdxdna driver, amdxdna_drm_submit_execbuf() passes the user-supplied command BO handle without validating it. When the handle is AMDXDNA_INVALID_BO_HANDLE (0), the command is submitted with a NULL cmd_bo, leading to a NULL pointer dereference in the DRM scheduler worker and a kernel oops. The fix rejects the invalid handle for user submissions.