Linux kernel vulnerabilities

A use-after-free vulnerability was found in the Linux kernel's x86/mm/pat subsystem. A race condition exists between attribute changes and CPA collapse, potentially leading to a write to freed memory. The issue is resolved by acquiring an mmap read lock on init_mm during attribute change operations.

In the Linux kernel, the PMU PAI support for s390 lacked allocation of per-CPU data structures for CPUs added via hotplug. Running 'perf stat -e pai_crypto/CRYPTO_ALL/ -- <command>' while a CPU was being brought online caused pai_add() to dereference a NULL pointer and panic the kernel. CPU hotplug support (add and remove) was added to create the required per-CPU infrastructure.

In the Linux kernel, the x86/mm/pat code allocated a page table directly when splitting a large page (__split_large_page()), bypassing the standard page table allocation API. As a result, the page table was never marked as a kernel page table (ptdesc_set_kernel() was not called), so freeing such page tables did not invalidate their IOTLB entries. This can leave stale IOTLB entries for kernel page tables.

In the Linux kernel, the error path of device_register() in i3c_master_register_new_i3c_devs() fails to clear desc->dev->desc and desc->dev before releasing the device. This triggers a WARN_ON and leaves a dangling pointer to freed memory, potentially causing a use-after-free.

In the Linux kernel, rtw89_mac_check_he_obss_narrow_bw_ru_iter() reads extended capability byte 10 but only rejects datalen values below 10, while reading byte 10 requires at least 11 bytes. The missing length check can lead to an out-of-bounds read.

In the Linux kernel, the staging octeon driver's cvm_oct_tx_shutdown does not call tasklet_kill, so the TX cleanup tasklet can be scheduled by the watchdog IRQ handler and run after cvm_oct_remove() frees net_device structures. This causes a use-after-free in cvm_oct_tx_do_cleanup() while iterating the cvm_oct_device[] array.

In the Linux kernel, the staging octeon driver's cvm_oct_rx_shutdown calls free_irq and netif_napi_del without disabling the NAPI instance first. Since free_irq only waits for hard interrupt handlers to complete, the NAPI poll function may still be active, and if cvm_oct_remove frees the plat structure holding the NAPI instances, the active poll function accesses freed memory.

In the Linux kernel, the phy-rcar-gen3-usb2 driver's devm_regulator_get_exclusive() initializes the regulator with enable_count = 1, requiring the consumer to disable it before release. The devm disable action was only registered when the caller explicitly requested enable, so when the regulator was left in its initial enabled state without an explicit enable call, the cleanup path skipped decrementing enable_count, triggering a WARN_ON during regulator release on device removal.

In the Linux kernel, the bcm2835 pinctrl driver's bcm2835_pinctrl_probe() calls gpiochip_remove() before the GPIO chip is registered by gpiochip_add_data() when devm_pinctrl_register() fails. This leaves gpio_chip.gpiodev as NULL, resulting in a null pointer dereference inside gpiochip_remove().

In the Linux kernel, the tps6594_regulator_probe() multiphase configuration loop failed to release device node references (np, np_parent, np_pmic_parent) obtained via of_find_node_by_name() and of_get_parent(), causing a reference leak on every iteration. Additionally, a missing NULL check after of_find_node_by_name() could lead to a NULL pointer dereference.

In the Linux kernel, the qcom_wcnss remoteproc driver changed the info pointer increment from num_pd_vregs to num_pds, which for the pronto-v3 platform (no power domain regulators in vregs) shifted the pointer past the end of the array. This manifested as a "regulator request with no identifier" error on SDM632 devices with LLVM-compiled kernels.

In the Linux kernel, the ath11k Wi-Fi driver could receive HT/VHT/HE frames with an MCS above the maximum expressible in the mac80211 rate space (e.g., HE with MCS 12). The ath11k_dp_rx_h_rate() function left an out-of-range rate_idx and never set encoding, causing mac80211 to drop the frame with a warning and discard otherwise valid data.

In the Linux kernel, the BPF interpreter ignored the 'off' field of the BPF_MOV64_PERCPU_REG (BPF_ADDR_PERCPU) instruction, which requires JIT compilation to native code. As a result, loading memory from such a register triggered a page fault and a kernel oops.

In the Linux kernel, ext4_ext_migrate() had a circular lock dependency between s_writepages_rwsem and sb_internal (freeze protection). Calling iput(tmp_inode) before releasing ext4_writepages_up_write() caused a deadlock with concurrent orphan inode cleanup during mount.

In the Linux kernel, ext4_try_to_expand_extra_isize() called during mount (!SB_ACTIVE) could move xattrs to external blocks and release ea_inodes via iput(), creating a circular lock dependency: s_writepages_rwsem -> jbd2_handle -> xattr_sem -> s_writepages_rwsem.

In the Linux kernel, the RDMA/core uverbs_free_dmah() function called rdma_restrack_del() too late, after vendor-specific resources associated with the dmah had already been freed. This left a short window where the dmah remained accessible through restrack, potentially leading to a use-after-free.

In the Linux kernel on arm64, the rsi_attestation_token_init function copying the challenge to &regs.a1 triggered a FORTIFY field-spanning write warning, because register a1 is treated as a single 8-byte field while 64 bytes were copied.

In the Linux kernel, the RDMA/efa driver, when registering an MR and creating an indirect PBL, wrongly computed the last chunk length as 0 if the PBL page count was a multiple of EFA_PTRS_PER_CHUNK. This caused the device to see the chunk as empty and reject the memory registration.

In the Linux kernel, the eswin driver for EIC7700 chips has functions eswin_clk_register_pll() and eswin_register_clkdiv() that do not initialize all fields of a stack-allocated clk_init_data structure. Uninitialized stack data causes incorrect clock parent resolution and leads to a NULL pointer dereference during clock registration.

In the Linux kernel, in the lockdep module, the __lock_set_class() function does not check if register_lock_class() returned NULL. When the lock class pool is exhausted or validation fails, an invalid class index is computed, leading to a NULL or out-of-bounds pointer dereference.

In the Linux kernel with CONFIG_PPC_KERNEL_PCREL enabled on PowerPC, call_do_irq() and call_do_softirq() use inline assembly without listing r2 as clobbered. This causes the compiler to assume r2 is preserved, leading to register corruption and kernel crashes during interrupt handling, preventing boot.

In the Linux kernel, in the OCFS2 filesystem, the function ocfs2_read_inode_block_full() used make_bad_inode(), which changes the inode type to S_IFREG. For a directory inode during active VFS lookup, this can lead to errors, including triggering VFS_BUG_ON_INODE().

In the Linux kernel, in the fs-integrity (block) subsystem, there is a missing check of BIP_CHECK flags before generating or verifying PI information. This can lead to incorrect invocation for non-PI metadata, generating incorrect metadata and crashes in the verification handler.

In the Linux kernel, the arm64 hibernation code manages exception masking incorrectly, leading to potential crashes or warnings during resume. When restoring a hibernated image, only interrupts are masked, not all DAIF exceptions, which may cause unexpected exceptions in an inconsistent state.

In the Linux kernel for ARM64, an issue was found in the kernel exit path where local_irq_disable() was unnecessarily called in contexts where interrupts were already disabled or in NMI contexts. This confused the pNMI state tracking and caused warnings when CONFIG_ARM64_DEBUG_PRIORITY_MASKING is enabled. The fix splits arm64_exit_to_kernel_mode() into parts to avoid extra work and preserve correct logic.

A vulnerability in the Linux kernel's CPU isolation (housekeeping) mechanism was found, where memblock-allocated memory for the CPU mask was freed too early during boot, before the memory map was fully initialized. This caused a warning and potential system malfunction when using the 'nohz_full' boot parameter. The fix defers freeing this memory until initcall processing.

A vulnerability was found in the OCFS2 filesystem in the Linux kernel, involving a circular locking dependency between the ip_xattr_sem semaphore and the transaction barrier j_trans_barrier. This can lead to a deadlock during concurrent setxattr and mkdir/mknod operations. The fix precomputes the ACL state before starting the transaction and removes unnecessary semaphore acquisition.

In the spi: amlogic-spisg driver, the clk_init_data structure is not fully initialized, which may cause a crash when CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is enabled. The issue involves the uninitialized parent_names field.

In the drm/xe driver, there is an issue with a WARN warning during kernel job timeout when the device is already wedged. The fix honors the wedged state even for killed queues to avoid false warnings.

A race condition exists in the Linux kernel Bluetooth mgmt subsystem where the 'uuid_count' and 'uuids' fields of the discovery_state structure are accessed without proper locking. This can lead to a state where 'uuid_count' is non-zero but 'uuids' is NULL, causing a NULL pointer dereference and kernel panic. The fix adds discovery.lock around all reads/writes of these fields and ensures 'uuid_count' is set only after a successful kmemdup allocation.

In the octeontx2-af driver, there is an out-of-bounds read vulnerability when setting MSI-X IRQ affinity. The strstr() function may read beyond the buffer when the field is uninitialized, potentially triggering a KASAN error.

In the Linux kernel, a vulnerability in AppArmor was found where list heads are not properly initialized if profile creation fails before policy_init completes. This triggers warnings and a potential crash in aa_policy_destroy during profile free.

A flaw was found in the Linux kernel's secretmem mechanism (mm/secretmem) regarding accounting of locked pages. secretmem folios are not properly charged against RLIMIT_MEMLOCK or the process's RSS, so a user can repeatedly map and unmap (or fork) to bypass the limit and exhaust all available system memory with unevictable folios. This leads to system instability, and the OOM killer will not target the process because the memory usage is not accounted.

In the Linux kernel, the scsi: qla2xxx driver's __qla_consume_iocb() function consumed one too many response queue entries. This caused the wrong IOCB to be marked as processed and a legitimate firmware response to be silently dropped. The fix marks the head IOCB as processed and consumes only entry_count - 1 continuation IOCBs.

In the Linux kernel on arm64, show_pte() performs a lockless page-table walk that can dereference a freed table page or derive a bogus pointer during concurrent teardown. The fix uses lockless offset helpers with saved parent entries and disables local interrupts around the walk.

In the Linux kernel's s390/vfio-ap module, the apm_filtered bitmap is stack-allocated without zero-initialization. When a hot plug change adds only control domains, the filtering function is bypassed and the uninitialized bitmap is passed to reset_queues_for_apids(), potentially causing unintended guest hardware queue resets. The fix zero-initializes the bitmap at the start of the function.

In the Linux kernel's media: meson: vdec driver, vdec_try_fmt_common() falls back to V4L2_PIX_FMT_MPEG2 for unsupported pixel formats. If a distro has patched out MPEG2 support, find_format() returns NULL, causing a NULL pointer dereference and crash. The fix uses the first format in the platform's format array instead of hardcoding MPEG2.

In the Linux kernel's drm/gud driver, gud_connector_add_tv_mode() passes fixed-size TV mode names directly to the DRM property code. If a device returns an entry without a NUL terminator, strlen() reads past the buffer, causing an out-of-bounds read. The fix validates the NUL terminator and rejects malformed responses with -EIO.

Vulnerability in the Nouveau driver (drm/nouveau/dmem) causes an underflow of the callocated counter when a large folio is split. The counter is not updated on split, leading to memory leak and warnings. The fix accounts for new sub-folios in the split hook.

A vulnerability in the Linux kernel causes a boot panic on CONFIG_DEBUG_VM kernels when hugetlb_free_vmemmap is enabled. The issue is due to late initialization of shared tail pages (zone->vmemmap_tails[]) used by HVO, leading to dereferencing an uninitialized page during bootmem HugeTLB folio preparation. The fix moves initialization to gather_bootmem_prealloc() before bootmem HugeTLB folios are processed.

Vulnerability in the HugeTLB mechanism for gigantic bootmem pages involves late initialization of struct pages. This can cause incorrect zone contiguity or kernel panic during boot. The fix moves initialization to an earlier phase.

In the Linux kernel, a vulnerability was found in the deferred struct page initialization mechanism (CONFIG_DEFERRED_STRUCT_PAGE_INIT). When large CMA reservations are used, deferred_grow_zone() may improperly update the first_deferred_pfn pointer, leading to an overflow and triggering a BUG_ON in deferred_init_memmap(), causing a system crash during boot.

In the Linux kernel, rt6_nh_dump_exceptions() iterated over RCU-protected IPv6 route exception lists using hlist_for_each_entry() without holding rt6_exception_lock, while rt6_insert_exception() could concurrently add entries. This caused a data race reported by KCSAN. The fix switches to hlist_for_each_entry_rcu() for safe iteration.

In the Linux kernel, the tegra-video driver (staging/media) has a bug where tegra_vip_channel_of_parse() drops a reference to the OF node in its error paths without ever taking one, underflowing the refcount. This occurs when endpoint parsing fails on a malformed device tree.

In the Linux kernel, send_signal_locked() rewrites sender IDs for the target namespace, and group sends reuse the same siginfo, so one recipient can affect the next. This allows cross-recipient influence over signal data.

In the Linux kernel's sched_ext scheduler, kick_sync_wait_bal_cb() assumes it runs on the rq's CPU, but due to changes in rq lock dropping it can run on a foreign CPU. This leads to comparisons against unrelated snapshots and potential deadlock.

In the Linux kernel, the timer-sun4i clock driver advertises TIMER_SYNC_TICKS as the minimum delta, allowing the clockevents core to call set_next_event() with a value that programs a zero-tick interval. This can leave the next event stuck and cause a boot hang on Allwinner D1.

In the Linux kernel's mm/huge_memory, madvise_free_huge_pmd() can encounter a device-private PMD and enter the !pmd_present() branch, leading to pmd_folio() being called on an unexpected PMD. This can occur when an HMM-based GPU driver races with madvise(MADV_FREE).

In the Linux kernel's mm/madvise, madvise_cold_or_pageout_pte_range() can encounter a device-private PMD and enter the !pmd_present() branch, triggering a VM_BUG_ON(). This can occur when an HMM-based GPU driver races with madvise(MADV_COLD)/MADV_PAGEOUT).

In the Linux kernel's mm/page_owner, print_page_owner_memcg() re-reads page->memcg_data locklessly in two places, creating a TOCTOU condition. If the page is concurrently freed and reallocated as a THP tail page or slab page, VM_BUG_ON assertions can crash the kernel.