Linux kernel vulnerabilities

In the Linux kernel SMB client, smb2_parse_contexts() validates the complete create-context area but does not limit each record to its Next field before dispatching it to a handler. A malformed chain can expose bytes beyond the current context, and the lease parsers read fields at canonical offsets rather than at DataOffset.

In the Linux kernel SMB client, SMB2_open() accounts a successful CREATE response as a remote open before parsing its create contexts. If smb2_parse_contexts() rejects malformed context data, SMB2_open() returns without closing the handle, leaving the server-side handle open and num_remote_opens elevated.

In the Linux kernel SMB client, open_cached_dir() sends CREATE and QUERY_INFO as a compound request. If the CREATE succeeds but a later command returns an error, the function must retain the CREATE FID so common cleanup can issue SMB2_close(), and it must not treat a response error as a valid CREATE.

In the Linux kernel SMB client, an O_CREAT open can find an existing symlink or another non-regular inode. cifs_atomic_open() calls finish_open() on it and attaches a cifsFileInfo, but symlink inodes have no CIFS release operation, so the dentry reference held by cifsFileInfo is leaked, and FMODE_OPENED prevents the VFS from following the symlink.

In the Linux kernel SMB client, compound_send_recv() waits for responses in order. If a later wait is interrupted or a later MID fails during response synchronization, an earlier CREATE may already have opened a remote handle, and the earlier mid is released without invoking handle_cancelled_mid(), leaving the remote handle open because no FID was copied to the caller.

In the Linux kernel SMB client, when sending a compound request fails, smb_send_rqst() kicks off a reconnect, but compound_send_recv() still has those mids on pending_mid_q and unlocks the server without removing them first. During reconnect, cifs_abort_connection() runs each mid callback, which returns credits and drops in_flight, and then the send-error path returns the same credits again, causing in_flight to be decremented twice and smb2_add_credits() to WARN.

In the XFS file system in the Linux kernel, the igrab'd reference to the orphanage directory inode is leaked if chowning it fails.

In the XFS file system in the Linux kernel, the inode btree root formatting methods copy too many bytes — there is only one set of keys in node blocks, not two. This causes memory corruption of whatever is beyond the buffers.

In the XFS file system in the Linux kernel, if the amount of fdblocks that can be reserved for a metadata btree file goes below the space already used by that file, the hidden_space subtraction can underflow, causing xfs_dec_fdblocks to subtract a huge amount of space.

In the Linux kernel, a memory allocation failure in xrep_newbt_add_blocks (XFS subsystem) leaks blocks previously allocated for a new btree and can kill online repair. The fix uses a NOFAIL allocation for the small (~48-byte) space reservation object.

In the Linux kernel, xfs_qm_flush_one (XFS subsystem) fails to drop the dquot flush lock when it cannot grab the buffer associated with the dquot. Since no one else will release the dqflock, it remains held.

In the Linux kernel, xlog_recover_iunlink_bucket (XFS subsystem) has multiple bugs: it does not null out prev_ip after releasing it (use-after-free risk), leaks @ip on inodegc flush failure, and mis-sets prev_agino and i_prev_unlinked, introducing loops into the unlinked list.

In the Linux kernel, net/sched act_ct stores a raw pointer to the extensions area in the expectations list before the connection is confirmed. Later *_ext_add() calls reallocate that area, leaving an invalid pointer that is accessed when removing the expectation, causing a use-after-free.

A use-after-free vulnerability was found in the Linux kernel's net/sched act_ct module. When an skb with an unconfirmed conntrack entry is cloned, both clones may process the same shared entry, modifying expectation list pointers and causing a UAF on the destruction path. The issue primarily affects NAT without commit.

In the Linux kernel, KVM for arm64 (nv) frees shadow S2 structures in kvm_arch_flush_shadow_all(), which can free a container still referenced elsewhere. The fix delays freeing these structures until VM destruction.

In the Linux kernel, an async request may still be pending when an SMB server connection is closed, preventing the connection from closing. The fix cancels active async requests before waiting for them to finish.

In the Linux kernel, MPTCP's mptcp_write_data_fin requires adding a DSS mapping and computing a checksum when sending DATA_FIN without data, but the csum field is no longer zeroed by default since commit cfcceb7a39fc. This leads to use of an uninitialized value.

In the Linux kernel, the media qcom iris driver's iris_enable_power_domains() does not use pm_runtime_resume_and_get(), leaking a runtime PM usage count on failure. Also, iris_disable_power_domains() does not always call pm_runtime_put_sync() when iris_opp_set_rate() fails.

In the Linux kernel, the accel/amdxdna driver did not disable exporting of device buffers, which were never intended to be exported. The fix explicitly disables export support for these buffers.

In the Linux kernel, the altr_portb_setup() function in the EDAC/altera driver anchored the devres group and devm-managed IRQ requests to the embedded struct device instead of the actual parent device. This caused the devres group and its allocated resources to not be torn down together with the parent device.

In the Linux kernel, the proc_dointvec_ms_jiffies_minmax function was missing a range check that was incorrectly removed by an earlier commit replacing the SYSCTL_INT_CONV_CUSTOM macro with functions. The lack of range validation may allow setting values outside the permitted interval.

In the Linux kernel KVM module for PowerPC (Book3S HV), kvmppc_svm_page_in() failed to release the secure device page when uv_page_in() failed after kvmppc_uvmem_get_page() had succeeded. Each occurrence permanently consumed an entry from the firmware-bounded secure memory pool and left the GFN marked as secure, making it unusable for the lifetime of the VM.

When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep. This sequence number is only 15 bits wide. If enough semaphore sets are created and destroyed in the same table slot while a caller is blocked, the counter wraps around, and semop(2) may falsely conclude that the original set still exists. The subsequent access to a semaphore within the set may then be out of bounds.

The Linux kernel contains an ABBA deadlock between the mmap_lock and disassociation_lock in the RDMA/uverbs subsystem. A thread performing mmap/fork acquires locks in the order mmap_lock → disassociation_lock, while the thread executing uverbs_user_mmap_disassociate() acquires them in reverse order, leading to a potential deadlock. The issue was resolved by removing disassociation_lock and using the existing hw_destroy_rwsem instead.

In the Linux kernel, the RDMA/efa management IRQ handler accesses both the admin completion queue and the async event queue. The driver registered the IRQ before constructing these queues and destroyed them before freeing the IRQ, so the handler's lifetime was not contained by the resources it accesses. The fix initializes the queues with interrupts masked, requests the IRQ, then switches to interrupt mode, and on removal resets the device and frees the IRQ before destroying the queues.

In the Linux kernel, the RDMA/efa completion IRQ handler accesses the EQ state and DMA buffer. Its IRQ was registered before that state was initialized, while teardown released the buffer before free_irq() synchronized the handler. The fix initializes the EQ without arming it, registers the IRQ, then arms it, and reverses the resource order during teardown by freeing the IRQ before destroying the EQ.

In the Linux kernel, the USB 6fire driver uses URBs embedded in different structs for PCM, MIDI and communication, which is a buggy implementation nowadays; since a URB is managed with a refcount, this may lead to a UAF when the URB is released asynchronously. The fix converts those embedded URBs to ones properly allocated via usb_alloc_urb(), changing each embedded struct urb to a pointer and updating callers; resources are released in common destructors called at both the init error path and disconnect.

In the Linux kernel, the CoDel scheduler's dropping loop in codel_dequeue() could fail to advance with very small interval values, draining the entire backlog under the qdisc lock in a single call. An unprivileged user could trigger a soft lockup this way. The fix ensures the control-law step is at least 1 tick and caps the dropping loop at 256 drops per codel_dequeue() call.

In the Linux kernel, the mwifiex wifi driver's mwifiex_pcie_request_irq() registers each MSI-X vector with a per-index dev_id (&card->msix_ctx[i]). On a request_irq() failure the cleanup loop "for (j = 0; j < i; j++)" frees msix_entries[j].vector but passes the failed index's &card->msix_ctx[i] as the dev_id. Since free_irq() matches on (irq, dev_id), it fails to find the action registered with &card->msix_ctx[j]: the already-requested IRQ j is not freed (leaked) and free_irq() warns about freeing a non-existent IRQ. The fix uses &card->msix_ctx[j].

In the Linux kernel, ieee80211_request_ibss_scan() in mac80211 warns when the regulatory domain leaves no allowed channel to scan. This can happen because the regdomain can change while IBSS is operating, and IBSS can continue to operate briefly during the 60s grace period until it is shut down. The fix removes the warning in this case.

In the Linux kernel, cfg80211_switch_netns() in cfg80211 moves all interfaces, then moves the wiphy itself by setting its network namespace and renaming it, which makes sysfs move it. The rename can fail (only on allocation failures), leaving things mixed up and hitting a warning. The fix undoes the move and lets the change fail, and if undo fails it WARNs.

In the Linux kernel, mac80211_hwsim checks ->started for frames coming from wmediumd, but the radio can be stopped after the check and before frame delivery, causing mac80211 to hit WARN_ON(!local->started). The fix expands the mutex for this case and synchronizes against it when the radio is stopped, and drops an error print that complicated the error path.

In the Linux kernel, mac80211 AP_VLAN interfaces get crypto_tx_tailroom_needed_cnt from the AP interface on ifup, but it is never decremented unless the AP is also brought down. Bringing the same AP_VLAN up again increments the counter again and eventually hits the WARN_ON_ONCE sanity check. The fix resets it on ifdown.

In the Linux kernel, mac80211 requires that a TDLS setup confirm (WLAN_TDLS_SETUP_CONFIRM) be sent to an existing TDLS station. Otherwise, building the frame hits WARN_ON_ONCE(!sta || !ap_sta). The fix only accepts WLAN_TDLS_SETUP_CONFIRM when the station already exists as a TDLS station.

In the Linux kernel, reset_per_cpu_data() in drop_monitor computes al including sizeof(struct nlattr) (the 4-byte attribute header). It then calls memset(msg, 0, al), where msg points to nla_data(nla), which is sizeof(struct nlattr) bytes past nla, writing 4 bytes beyond the allocated buffer and corrupting skb_shared_info. The fix makes al represent only the payload length and uses genlmsg_new(nla_total_size(al), ...).

In the Linux kernel, the scheduler (sched/core) can move a blocked donor's scheduling context to the lock owner's CPU even when the donor is migration-disabled. set_task_cpu() warns unconditionally for migration-disabled tasks, causing a false positive. The fix excludes blocked proxy donors from the warning.

In the Linux kernel, ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates that offset and triggers the skb warning path. The fix uses the careful transport-header helper and drops the skb through the existing XFRM error path when the offset cannot be represented.

In the Linux kernel, the dmaengine ti k3-udma-glue driver has a bug in k3_udma_glue_release_rx_chn(). If devm_kcalloc() for rx_chn->flows fails in a channel request function, the error path calls k3_udma_glue_release_rx_chn(), which dereferences the NULL rx_chn->flows pointer in k3_udma_glue_release_rx_flow(). The fix skips the flow release loop when rx_chn->flows is not allocated.

In the Linux kernel, the soc: samsung: exynos-pmu driver has a use-after-free of the interrupt generator device tree node. setup_cpuhp_and_cpuidle() releases the node reference (of_node_put()) too early and then passes the intr_gen_node pointer to of_syscon_register_regmap().

In the Linux kernel, a bug in memcg causes obj_cgroup_charge_pages() to not short-circuit the root memcg, leading to a warning in refill_stock() and asymmetric page accounting. This can be triggered via zswap and cgroup operations, resulting in a page counter leak in the root memcg.

In the Linux kernel, the SELinux avc_has_perm_noaudit() function returns early for an empty requested permission set without filling the access decision buffer (@avd). All callers pass an uninitialized stack variable that is then fed to avc_audit(), and the inode hook even stores it in the per-task decision cache.

In the Linux kernel, the power: sequencing subsystem's pwrseq_unit_new() can dereference a NULL pointer. If memory allocation fails in pwrseq_unit_setup_deps(), pwrseq_unit_put() is called to release the partially initialized unit, but unit->list was never initialized and pwrseq_unit_release() unconditionally calls list_del() on it.

In the Linux kernel, the power: sequencing subsystem's pwrseq_device_register() can dereference a NULL pointer. If dev_set_name() fails, the code jumps to the err_put_pwrseq label before initializing pwrseq->targets, and pwrseq_release() unconditionally iterates over targets and dereferences an invalid pointer.

In the Linux kernel, the watchdog: da9063 driver's da9063_wdt_suspend() and da9063_wdt_resume() only check watchdog_active(). When the driver sets WDOG_HW_RUNNING in da9063_wdt_probe() but userspace never opens the device, WDOG_ACTIVE remains cleared and wdt_disable() is not executed during suspend, so the watchdog keeps counting and may reset the system.

In the Linux kernel, the watchdog: rtd119x driver's clk_get_rate() can return 0, leading to a division by zero. The vulnerability causes a kernel panic.

In the Linux kernel, the watchdog: rzv2h driver's clk_get_rate() can return 0, leading to a division by zero. The vulnerability causes a kernel panic.

In the Linux kernel, the wifi: rsi driver's rsi_hal_load_key() performs a memset with an incorrect offset when a key is removed (data == NULL). Since set_key is a struct rsi_set_key pointer, the subscript is scaled by sizeof(struct rsi_set_key) (160 bytes), so the memset writes 144 zero bytes about 2.4 KB past the end of the skb data buffer, corrupting unrelated heap objects.

In the Linux kernel, ieee80211_set_bitrate_mask() lacked a check for the IEEE80211_SDATA_IN_DRIVER flag before calling the driver. When the interface was running but not yet added to the driver (e.g., during bringup or teardown), an ioctl SIOCSIWRATE call triggered a WARN in driver-ops.h. The fix adds an IN_DRIVER check and returns -ENETDOWN.

In the Linux kernel SMB client, parse_posix_sids() computes sidsbuf_end using the server-supplied out_len without validating it against the actual received iov length. A malicious server can provide an inflated out_len, enabling out-of-bounds reads into adjacent kernel memory.

In the Linux kernel drm/virtio driver, virtio_gpu_user_framebuffer_create() returns NULL instead of an ERR_PTR() error pointer. This leads to a NULL pointer dereference in drm_mode_addfb2().