Linux kernel vulnerabilities

In the Linux kernel's arm_ffa driver, there is an error in calculating the Endpoint Memory Access descriptor offset, which uses sizeof(struct ffa_mem_region) instead of ep_mem_offset, potentially leading to incorrect memory access. There is also a lack of sanity checks for offsets.

A use-after-free (UAF) vulnerability was found in the Linux kernel's sk_clone() function for BPF sockets. On early bailout, the pointer to the parent socket's BPF storage remains in the cloned socket, leading to its deallocation when the clone is freed and subsequent use of freed memory by the parent socket.

A use-after-free vulnerability exists in the Linux kernel's PPP subsystem, specifically in the pppol2tp receive path. The issue arises from missing RCU grace period before freeing the internal PPP channel, potentially leading to memory corruption. The bug is reachable by an unprivileged user.

A vulnerability was found in the Linux kernel's net/iucv subsystem where a socket found in afiucv_hs_rcv() is not properly referenced. After releasing the lock, the socket can be closed and freed before the event handler uses it, leading to use-after-free.

In the Linux kernel's SCSI subsystem, there is an issue with waking the error handler thread when using scsi_schedule_eh. Lack of enforced memory ordering can cause the thread to never wake up when all commands are inactive or timed out.

In the Linux kernel's ata: sata_dwc_460ex driver, there is an issue where SATA interrupts are enabled before the interrupt handler is registered. If a later initialization step fails, an interrupt storm may occur.

In the Linux kernel Bluetooth MGMT subsystem, a use-after-free vulnerability exists. The MGMT_OP_LOAD_CONN_PARAM operation stores a pointer to an hci_conn_params entry that can be freed by a subsequent request before the queued work executes. The fix stores a reference to hci_conn and revalidates parameters when the work runs.

In the Linux kernel's Bluetooth subsystem (hci_sync), a vulnerability was found where RCU-protected pointers are used outside critical sections without proper refcounting, potentially leading to use-after-free. The fix extends critical sections and adds rcu_read_lock() where needed.

In the Linux kernel's Bluetooth subsystem (mgmt), a locking issue was found in unpair_device and disconnect_sync. Dereferencing RCU-protected pointers outside critical sections can lead to use-after-free. The fix adds hdev->lock for hci_conn lookup and hci_abort_conn().

In the Linux kernel's Bluetooth subsystem (mgmt), a vulnerability was found where hci_conn is not properly referenced in mgmt_pending_cmds. Dereferencing RCU-protected pointers outside critical sections can lead to use-after-free. The fix adds appropriate locks and refcounting.

In the Linux kernel's Bluetooth subsystem (hci_sync), an issue was found where hdev->lock is not held during hci_conn_params lookups. Without this lock, list iteration or parameter access is not safe. The fix adds hdev->lock for parameter lookups.

In the Linux kernel, the Bluetooth hci_qca driver has a use-after-free vulnerability when handling an invalid dump size from the controller. When the controller reports a zero dump size, the error path frees the local object but does not clear the pointer in the qca structure, leading to later access to freed memory.

In the Linux kernel, the CAN raw subsystem has a race condition when modifying bitfield flags in the raw_sock structure. Read-modify-write operations in raw_setsockopt() can be executed concurrently, leading to unpredictable behavior.

A vulnerability in the Linux kernel's BPF sockmap mechanism allows a memory leak. Unbound UDP sockets are accepted by sockmap, and a BPF program can increment their refcount. After the socket is subsequently bound, bpf_sk_release() skips the refcount decrement, causing a permanent memory leak.

In the Linux kernel, a vulnerability was found in the DRM/XE driver related to VF (Virtual Function) CCS attach/detach operations during BO (Buffer Object) moves. The issue is a race condition where CCS batch buffers are attached or detached without proper synchronization with the copy fence, leading to potential data corruption or incorrect behavior during VF migration.

In the Linux kernel, the DRM xe driver (drm/xe/guc) has a use-after-free vulnerability in the scheduler. The pointer to the queue name (q->name) is freed with the queue, while the scheduler may still reference it.

A vulnerability was found in the Linux kernel DRM/XE driver for Intel GPUs, related to the GuC execution queue. Queue destruction can run asynchronously, risking a deadlock during resource cleanup. The fix holds a device reference for the queue lifetime and moves destroy work to a dedicated workqueue.

In the Linux kernel, the accel/amdxdna driver has a use-after-free vulnerability of the mm_struct in the job scheduler. The pointer to mm_struct is stored without holding a reference, which can lead to access to freed memory during job execution.

In the Linux kernel, a TIME_WAIT socket reference leak was found on PSP policy failure in IPv4 and IPv6 receive paths. The missing release leads to memory leak of tcp_tw_bucket structures.

A vulnerability in the Linux kernel causes a NULL pointer dereference in dpll_msg_add_pin_ref_sync(). The issue occurs when a pin shared between multiple dpll devices is unregistered while a ref_sync partner has already been removed from one device but remains registered with another. This can lead to a kernel panic during driver module removal.

A use-after-free vulnerability was found in the Linux kernel's net/sched/act_tunnel_key module. The tunnel_key_release_params() function releases the metadata_dst of old parameters synchronously via dst_release(), while the params structure is freed asynchronously via kfree_rcu(). A concurrent reader in tunnel_key_act() may still hold a pointer to the old parameters and call dst_clone() after dst_release() has marked the dst as RCUREF_DEAD, leading to access to freed memory.

In the Linux kernel, the auth_hmacs array size in struct sctp_cookie is miscalculated, causing out-of-bounds copy during SCTP association initialization. This can corrupt the adjacent auth_chunks field, accept an invalid HMAC identifier, and lead to out-of-bounds read in sctp_auth_get_hmac().

In the Linux kernel, the bnxt_en driver has an issue with partially initialized auxiliary devices. bnxt_aux_devices_init() calls auxiliary_device_init() before all fields used by the release callback are initialized, which can lead to dereferencing or clearing partially initialized state during error handling.

In the Linux kernel, the USB subsystem lacks synchronization in bos_descriptors_read(), which accesses udev->bos. This field can be concurrently freed in usb_reset_and_verify_device(), leading to a race condition.

In the Linux kernel, the at76c50x-usb driver has a length underflow vulnerability in at76_guess_freq(). If a frame is shorter than the expected offset, the calculated IE length wraps, leading to an out-of-bounds read during scanning.

A vulnerability in the Linux kernel USB Type-C subsystem where connector_unbind() lacks the symmetric typec_deattach() call, causing a race during Thunderbolt dock unplug. This leaves dangling pointers in typec_port, potentially leading to use-after-free and corrupted UCSI partner state.

In the Linux kernel, the usb: musb: omap2430 driver's omap2430_probe() calls of_node_put() on a borrowed of_node pointer, leading to an unbalanced reference count for the platform device node.

In the Linux kernel, the USB gadget dummy_hcd driver has a vulnerability involving reuse of a shared USB request (fifo_req) during request giveback. An attacker can exploit a race condition between threads, leading to overwriting a callback function pointer and causing a page fault or general protection fault (GPF) in the kernel.

In the Linux kernel, the usb: gadget: printer driver's printer_read() can enter an infinite loop when copy_to_user() fails to copy any data and the length variable remains unchanged.

In the Linux kernel, the usb: gadget: f_ncm driver's ncm_unwrap_ntb() does not verify that a datagram fits within the declared block length, allowing a malicious USB host to cause an out-of-bounds read of kernel memory.

A use-after-free vulnerability was found in the Linux kernel's USB gadget f_tcm driver, where delayed work in tcm_delayed_set_alt can execute after disconnect or function teardown. This can lead to memory corruption and a kernel crash.

In the Linux kernel, the usb: gadget: uvc driver's uvc_send_response() does not clamp the response length to the source buffer size, potentially leading to an out-of-bounds read.

In the Linux kernel, the USB: serial: io_edgeport driver's edge_interrupt_callback() adds a 16-bit transmit credit value to txCredits without checking maxTxCredits, potentially leading to an out-of-bounds write in the ring buffer.

In the Linux kernel, the drm/amd/display driver has a deadlock during system suspend when amdgpu_dm_ism_disable() is called under dc_lock and waits for delayed work that also requires dc_lock.

In the Linux kernel, the ath9k_hif_usb driver has a use-after-free vulnerability. After re-arming the firmware request via request_firmware_nowait(), the ath9k_hif_request_firmware() function still dereferences hif_dev, which can lead to reading freed memory when the device is disconnected concurrently.

In the Linux kernel, the ath11k WiFi driver has a NULL pointer dereference vulnerability. The ATH11K_FLAG_REGISTERED flag is set unconditionally even when FW_READY handling fails, leading to an inconsistent driver state. During subsequent SSR, the driver dereferences uninitialized srng members, causing a NULL pointer dereference.

In the Linux kernel's hwmon corsair-psu driver, a use-after-free vulnerability was found due to calling hid_hw_stop() without stopping device I/O first. This creates a race condition between HID report handling and driver teardown. The fix calls hid_device_io_stop() before hid_hw_stop().

In the Linux kernel, the corsair-cpro hwmon driver has a use-after-free (UAF) vulnerability. Calling hid_hw_stop() does not stop device I/O, leading to a race condition between hid_input_report() and the point after hid_device_io_start() in the probe function. If probe fails after I/O start, UAF can occur.

In the Linux kernel, the nzxt-smart2 hwmon driver has a use-after-free (UAF) vulnerability. Calling hid_hw_stop() does not stop device I/O, leading to a race condition between hid_input_report() and the point after hid_device_io_start() in the probe function. If probe fails after I/O start, UAF can occur.

In the Linux kernel, the nzxt-kraken3 hwmon driver has a use-after-free (UAF) vulnerability. Calling hid_hw_stop() does not stop device I/O, leading to a race condition between hid_input_report() and the point after hid_device_io_start() in the probe function. If probe fails after I/O start, UAF can occur.

In the Linux kernel, the watchdog pretimeout subsystem has a use-after-free (UAF) vulnerability. When unregistering a watchdog governor, if the governor is set as default_gov, the default_gov pointer is not cleared, leaving a dangling pointer. New watchdog devices may inherit this dangling pointer, and existing devices may be reassigned to it, leading to UAF.

In the Linux kernel, the airoha watchdog driver has a division by zero vulnerability. The clk_get_rate() function can return 0 when the clock provider is not properly configured or the clock is unmanaged. The driver uses wdt_freq as a divisor in airoha_wdt_probe() and airoha_wdt_get_timeleft(), leading to division by zero.

In the Linux kernel, the ath11k WiFi driver has a buffer underflow vulnerability in ath11k_hal_rx_msdu_list_get(). When the first entry in msdu_details has a zero buffer address, the code accesses msdu_details[i - 1] with i == 0, causing an out-of-bounds access.

In the Linux kernel, the firewire net driver has a vulnerability in fragmented datagram reassembly. The fwnet_frag_new() function keeps a sorted list of received fragments. When checking adjacency, the code assumes the current fragment always has a real next or previous fragment, but at list edges it may be the list head, leading to incorrect merging of ranges. As a result, fwnet_pd_is_complete() may miss a complete datagram.

In the Linux kernel, the ath6kl driver has an out-of-bounds read vulnerability in the TX complete event handler. The firmware-controlled num_msg field (u8, 0-255) drives the loop without validation against buffer length, allowing reads up to 1020 bytes past the WMI event buffer.

In the Linux kernel, the ath6kl driver has an out-of-bounds read vulnerability in the connect event handler. The firmware-controlled fields beacon_ie_len, assoc_req_len, and assoc_resp_len are not validated against buffer length, potentially causing OOB reads during IE parsing and corruption of wmi->is_wmm_enabled state.

In the Linux kernel, the carl9170 driver has an out-of-bounds read vulnerability in carl9170_cmd_callback. When the firmware sends a response with a length mismatch, memcpy copies len - 4 bytes, which can exceed the readbuf size, causing an overread.

In the Linux kernel, the carl9170 driver has an out-of-bounds read vulnerability in the TX status handler. The bounds check uses `i > ((cmd->hdr.len / 2) + 1)` which is off by two, allowing 2 extra iterations past valid _tx_status entries when firmware-controlled hdr.ext exceeds hdr.len/2.

In the Linux kernel, the carl9170 driver has a buffer overflow vulnerability in the rx_stream failover path. Copying the full tlen from the second USB transfer instead of capping at rx_failover_missing can exceed the 65535-byte failover SKB, triggering skb_over_panic.

In the Linux kernel, the ASoC tas2781 driver has an out-of-bounds read vulnerability when parsing firmware description strings. The parser uses strlen() without checking if the NUL terminator is present in the firmware buffer, which can cause reads past the end of the buffer with a malformed firmware image.