Linux kernel vulnerabilities

In the Linux kernel's libata-core subsystem, there is a vulnerability due to improper validation of the concurrent positioning ranges count. A device can report a count larger than its actual log size, leading to read buffer overflow (up to 7704 bytes past a 512-byte slab) and response buffer overflow for VPD B9h when count exceeds 62. The fix bounds the count during probe and rejects out-of-range values.

In the Linux kernel, the iosm driver for WWAN modems has a vulnerability due to missing validation of modem-supplied offsets and lengths in the MUX downlink decoder. A malicious modem can cause out-of-bounds reads and infinite loops in the decoder, leading to system crashes or memory disclosure.

In the Linux kernel for RISC-V architecture, there is a bug in the rethook trampoline that causes a crash when reading a word from the stack in a kretprobe. The sp register is not saved in struct pt_regs, leading to an invalid address and kernel panic. The fix saves the original sp along with other registers, using a0 as a temporary register.

In the Linux kernel's memory compaction module (mm/compaction), the compaction_free() function does not properly handle the failure case of free_pages_prepare(). Failed pages should not be added back to cc->freepages for future use, as they can be either PageHWPoison or free_page_is_bad() and might cause data corruption.

In the Linux kernel, in the irqchip/irq-riscv-imsic-early subsystem, there is a fwnode leak on IMSIC state setup failure. The function imsic_early_acpi_init() allocates a firmware node before setup, and on error it is not freed. The fix adds a common cleanup path to free the fwnode and clear the global pointer.

In the Linux kernel, in the s390/monwriter driver, there is a missing check for changed data length when reusing buffers. A malicious user could change the length, leading to out-of-bounds write to kernel buffer and memory corruption. By default, the monwriter misc device is root-only, so practical impact is low.

In the Linux kernel, in the mac802154 subsystem, interface removal does not use RCU, which can lead to use-after-free during asynchronous transmit completion. The fix changes list_del() to list_del_rcu() to ensure safe removal in RCU context.

In the Linux kernel, in the octeontx2-pf driver, there is a memory leak of SQB pointers on init failure. The function otx2_init_hw_resources() does not free sqb_ptrs arrays on error, leading to memory leak. The fix uses otx2_free_sq_res() to properly free resources.

In the Linux kernel, in the llc_ui_autobind() function, there is a SAP refcount leak. After successful autobind, the caller's reference is not dropped, leading to exhaustion of dynamic SAP values and -EUSERS errors on subsequent autobinds. The fix drops the reference after successful autobind, matching llc_ui_bind()'s model.

In the Linux kernel, in the IPVS subsystem, the set_sctp_state() function incorrectly calculates the offset for IPv6 SCTP packets with extension headers, leading to incorrect state machine behavior. The fix uses the parsed transport offset passed from ip_vs_set_state() to correctly read the SCTP header.

In the Linux kernel, in the macsec_encrypt() function, an unset MAC header is read, leading to an out-of-bounds read (12-byte over-read) and data leak to the wire. The fix uses skb_eth_hdr() instead of eth_hdr() to correctly obtain the L2 header.

In the Linux kernel, in the dibs loopback driver, the move_data() function does not validate that offset and size do not exceed the DMB length, which can lead to out-of-bounds write. The fix adds an explicit bounds check before memcpy, returning -EINVAL for invalid requests.

In the Linux kernel, in the net: macb driver, there is a memory leak for outgoing SKBs that have not been marked as completed. The function macb_free_consistent() does not free these packets, leading to memory leak. The fix adds freeing of these packets during interface close.

A vulnerability in the Linux kernel's cpuhp_smt_enable() function causes a NULL kobject warning when calling sysfs_create_group(). The issue occurs on arm64 when booting with maxcpus greater than the number of physically present CPUs, where CPUs marked as 'present' are not yet registered. The fix involves checking the ACPI_MADT_ENABLED flag before setting a CPU as present and properly managing the present mask in acpi_map_cpu() and acpi_unmap_cpu().

In the Linux kernel's resctrl module, there is a double-free of the RMID for a pseudo-locked group. During unmount, rmdir_all_sub() unconditionally frees all RMIDs, leading to the same RMID being added to the free list twice.

In the Linux kernel for RISC-V, there is a NULL pointer dereference vulnerability in machine_kexec_prepare(). The pointer image->segment[i].buf can be NULL and is copied without a check, potentially causing a system crash.

In the Linux kernel's tracing/osnoise module, there is a missing synchronize_rcu() call during unregistering. This can lead to use-after-free when RCU readers are still traversing the instance list.

In the Linux kernel for s390, the function memtop_get_page_count() lacks an array_index_nospec() call, allowing speculative execution with a user-controlled 'level' value used to read from an array.

In the Linux kernel's cgroup/cpuset module, there is a divide-by-zero error when rebinding a memory policy with MPOL_F_RELATIVE_NODES in response to a CPU hotplug event. The issue arises from using cs->mems_allowed instead of cs->effective_mems.

In the Linux kernel's pmdomain module for i.MX93, there is an issue with shared control bits for clock and reset between DSI and CSI domains. This can lead to incorrect behavior if one domain disables shared resources while the other is still active.

In the Linux kernel's pmdomain module for MediaTek, there is a potential NULL pointer dereference during cleanup or on-check of HW_VOTER type power domains. Functions are called without checking the domain type, which can lead to a system crash.

In the Linux kernel's pmdomain module for i.MX8MP, there is an issue with the VC8000E power up sequence. According to the errata, it is necessary to gate off the clock before powering up and enable it after, to avoid handshake hang.

In the Linux kernel's mlx5 driver, there is a memory leak when repeatedly allocating and freeing mkeys with TPH hints. After removing the entry from idx_xa, the mlx5_st_idx_data structure was never freed, causing the leak to grow.

In the rt2x00 driver in the Linux kernel, rt2x00lib_probe_dev() uses the full teardown path for all probe failures, even when work structures are not yet initialized. This can lead to invalid work drains and DEBUG_OBJECTS reports.

In the Linux kernel's ieee80211_register_hw(), there is a memory leak when kmemdup() fails while copying band structures. The error path skips rate_control_deinitialize(), leaking local->rate_ctrl.

In the brcmfmac driver in the Linux kernel, there is a heap overflow when processing short authentication frames. The frame length can be less than the management header, causing arithmetic wrap and copying a huge amount of data beyond the buffer.

In the Linux kernel's Bluetooth btrtl driver, there is a vulnerability due to improper bounds checking of firmware patches. A too-short patch can cause arithmetic underflow and lead to oversized read/write during Bluetooth setup.

In the Linux kernel's memstick ms_block driver, there is an out-of-bounds write vulnerability when a card reports too many blocks. This can corrupt the data structure and potentially lead to code execution.

In the Linux kernel's sunxi reset driver, there is a resource leak when ioremap() fails. The memory region obtained via request_mem_region() is not released.

In the Linux kernel's powerpc/spufs driver, there is an out-of-bounds access in spufs_mem_mmap_access(). The offset is checked against vm_end instead of the local store size, allowing access beyond the buffer.

In the Linux kernel, the mask_user_address() function incorrectly checks for CONFIG_E500 instead of CONFIG_PPC_E500, preventing mask_user_address_isel() from being used on E500 hardware. The fix corrects the check to use the proper name.

In the Linux kernel's cfg80211 subsystem, a vulnerability exists due to missing validation of the EHT MLE type and size before reading the MLD ID. A malicious access point can send a short EHT MLE in an MBSSID beacon, leading to an out-of-bounds read by ieee80211_mle_get_mld_id(). The fix adds validation before the read.

In the Linux kernel, the ieee80211_mle_common_size() function has an issue with validating the common info length in MLE elements. For Reconfiguration and Priority Access types, the length is not correctly checked, potentially leading to improper reads. The fix accounts for the Reconfiguration length and validates the length for all known MLE types.

In the Linux kernel's mac80211 subsystem, a vulnerability exists due to missing validation of extension frame layout before processing. Unsupported extension subtypes can reach code that reads regular headers, potentially leading to improper reads. The fix adds validation and appropriate processing paths for S1G beacon frames.

In the Linux kernel, the mwifiex driver has a vulnerability causing permanently busy Wi-Fi scans after multiple roam iterations. The issue stems from incorrect power-save state (ps_state) handling during association response processing, leading to a missing sleep confirmation and blocking subsequent scans.

In the Linux kernel's MTD subsystem (virt-concat), a memory leak exists: the mtd_virt_concat_create_join() function creates a new name on every MTD registration, and when the name already exists, it does not free the newly allocated string. The fix adds freeing the temporary name before continuing.

In the Linux kernel's mchp23k256 driver for MTD, there is an issue with selecting chip capacity data: the driver uses of_device_get_match_data(), which when matched via SPI id table leads to using default data instead of the correct one. The fix changes to spi_get_device_match_data() to use SPI table data when OF data is absent.

In the Linux kernel's NAND driver lpc32xx_slc, there is an issue with DMA timeout handling: lpc32xx_xmit_dma() ignores the result of wait_for_completion_timeout(), causing a timed-out DMA transfer to be reported as successful. The fix returns -ETIMEDOUT and terminates the DMA channel before unmapping the scatterlist.

In the Linux kernel's sdhci-esdhc-imx driver, there is an issue in esdhc_change_pinstate(): it checks for pins_100mhz and pins_200mhz at the top and returns an error if either is missing, preventing the default pin state from being restored. The fix moves the checks into their respective switch cases.

In the Linux kernel's sdhci-esdhc-imx driver, there is an issue with unhandled interrupt during system suspend: the usdhc interrupt is not disabled during suspend when device_may_wakeup() returns false, leading to a "nobody cared" warning. The fix unconditionally disables the usdhc interrupt during suspend and re-enables it during resume.

In the Linux kernel, the sdhci-esdhc-imx MMC driver replaces pm_runtime_get_sync() with pm_runtime_resume_and_get() in the suspend path. The new function automatically drops the usage counter on failure, simplifying error handling. If it fails, the device is unclocked and accessing hardware registers would cause a kernel panic, so the error is returned immediately.

In the Linux kernel BPF subsystem, the verifier rejects variable offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. The issue arises because constant offsets were moved to reg->var_off, while __check_buffer_access() only checks the instruction offset. For writable raw tracepoints, an access with a negative offset can wrap the calculated end, allowing a program to bypass validation.

In the Linux kernel, the fwnode_init() function did not initialize all fields of the fwnode_handle structure. If a firmware node is allocated on the stack or heap without zeroing, the secondary pointer may contain uninitialized memory, potentially leading to dereferencing. The fix sets fwnode->secondary to NULL and initializes the remaining fields of the structure.

A vulnerability in the Linux kernel's f2fs filesystem can cause a deadlock in f2fs_balance_fs() when the filesystem space is nearly exhausted. This results in processes and writeback workers being blocked for over 120 seconds, indicating a severe system hang.

In the Linux kernel f2fs filesystem, a potential deadlock was found in the gc_merge path of f2fs_balance_fs(). When the device is mounted with the gc_merge mount option, a deadlock can occur between the write thread, garbage collector thread, and truncate process. The fix calls f2fs_submit_merged_write() and f2fs_submit_all_merged_ipu_writes() in the GC_MERGE path to commit cached writes, similar to the NOGC_MERGE path.

In the Linux kernel binder module, a vulnerability exists where the LSM context size field is read after being zeroed by release. This inflates the scatter-gather buffer end offset, allowing copies to overwrite the secctx area.

In the Linux kernel, the ueagle-atm driver (USB ATM) has a vulnerability due to not waiting for the completion of asynchronous firmware loading in the .disconnect() function. This can lead to a race condition when the device is unplugged, potentially causing kernfs errors and system crashes.

In the Linux kernel liveupdate (luo) mechanism, there is a lack of session type validation before performing ioctl operations. Some operations, such as PRESERVE_FD, are only applicable to outgoing sessions, while RETRIEVE_FD and FINISH are only valid for incoming sessions. Calling an invalid ioctl on a session can cause handlers to run in an unexpected context, leading to errors and WARN() warnings. The fix adds session type validation before dispatching the ioctl handler.

In the Linux kernel, in the KVM subsystem for s390 PCI handling, a bug was found: when a guest registers IRQs without a summary bit, the associated GAITE entry stores an incorrect value (physical address instead of zero) in the guest AISB location. The fix ensures zero is stored there.

In the Linux kernel, in the s390/zcrypt subsystem, a buffer over-read vulnerability was found in cca_cipher2protkey. User-controlled length fields in CCA token structures were used without proper validation against buffer size and minimum token size, potentially leading to out-of-bounds reads or buffer underruns, causing kernel crashes or memory exposure.