Linux kernel vulnerabilities

In the Linux kernel RDMA/mad subsystem, a receive buffer leak was found when PKey enforcement fails. ib_mad_complete_recv() initializes rmpp_list but calls ib_mad_enforce_security() before linking the buffer, and on failure nothing is freed. A remote node can repeatedly send MADs with wrong PKey, causing memory leak.

In the Linux kernel RDMA/erdma subsystem, IRQ-safe XArray helpers are now used for QP and CQ tables. Previously, operations from EQ interrupts could deadlock with create-path updates when an interrupt arrived while holding the plain xa_lock.

In the Linux kernel RDMA/rtrs-clt subsystem, a CQ pool leak was fixed when connect is interrupted. The client borrows CQ credits in the ADDR_RESOLVED handler before connection, and on error create_cm() may not release them, leading to leak and potential WARN_ON during pool cleanup.

In the Linux kernel wifi virt_wifi driver, an skb leak was fixed when the simulated link is disconnected. virt_wifi_start_xmit() returned NET_XMIT_DROP without freeing the skb, causing memory leak for every packet sent while disconnected.

In the Linux kernel wifi brcmfmac (cyw) driver, a fix was made to pass PMKID to firmware if present. Previously, auth_status was not zeroed, causing stack data leak to firmware, and missing PMKID caused firmware to cache garbage PMKID and deny subsequent association requests with correct PMKID.

In the Linux kernel wifi libipw subsystem, a vulnerability was fixed by rejecting too-short beacon and probe responses. Parsing functions assumed a full 36-byte prefix, but receive paths only guarantee a 24-byte header. Length calculation wrapped and caused out-of-bounds read.

In the Linux kernel wifi libipw subsystem, a vulnerability was fixed by rejecting too-short association responses. libipw_handle_assoc_resp() reads fields from a 30-byte prefix, but receive paths only guarantee a 24-byte header. Length calculation wraps and causes out-of-bounds read.

In the Linux kernel IB/IPoIB subsystem, a fix was made to avoid restoring OPER_UP after multicast flush. Previously, the flag was temporarily cleared and restored, causing a race with ipoib_ib_dev_down(). After interface down, the flag could be set again, leading to deadlock in destroy_workqueue(). A dedicated IPOIB_FLAG_MCAST_FLUSH flag was introduced.

In the Linux kernel wifi cfg80211 subsystem, a fix was made to not get the radio mask for netdev-less wdevs. cfg80211_calculate_bi_data() calls rdev_get_radio_mask() with wdev->netdev, which can be NULL and crashes in mac80211. The order of checks was inverted to avoid this.

In the Linux kernel, cfg80211_classify8021d() did not check the IP header size before reading the DS field. A frame that looks like IP but is too short caused a read of uninitialized memory (detected by KMSAN).

In the Linux kernel, dma_chan_put() unconditionally dropped the device reference while dma_chan_get() only took it on the slow path. This caused a kref underflow on every fast-path get/put pair.

In the Linux kernel, dma_chan_put() and dma_release_channel() contained a use-after-free. When dma_device_put() dropped the last reference, dma_device_release() could free the dma_device and its channels while dma_chan_put() still read chan->device->owner.

In the Linux kernel, dma_device_release() unlinked the device and freed it without an RCU grace period. Concurrent RCU readers in dma_issue_pending_all() could access the device after it was freed.

In the Linux kernel, cfg80211 freed a driver-owned scan request when an interface went down during a scan. The driver still believed it owned the request, leading to a use-after-free in scan_done().

In the Linux kernel, __cfg80211_bss_update() grouped hidden BSS entries with entries from probe responses lacking beacon elements. A later beacon with a hidden SSID triggered WARN_ON_ONCE in cfg80211_combine_bsses().

In the Linux kernel, cfg80211_update_assoc_bss_entry() filtered entries by BSS type when removing stale entries. An entry with a different capability bit (e.g. IBSS) remained, causing WARN_ON(!cmp) in cfg80211_rehash_bss().

In the Linux kernel, when joining an IBSS only the BSSID/channel was recorded in the event and the BSS entry was looked up during processing. This was racy (e.g. a new scan with NL80211_SCAN_FLAG_FLUSH could remove it), causing a warning in __cfg80211_ibss_joined().

In the Linux kernel, mac80211 could start a ROC (remain-on-channel) while a scan was in progress. This led to a warning in ieee80211_start_next_roc() during scan completion.

In the Linux kernel, mac80211 tried to offload TC setup on AP_VLAN interfaces, which are purely virtual. Since the AP interface may not always be known and could change, offload should not be performed.

In the Linux kernel's mac80211 subsystem, leaving a mesh network does not abort an ongoing channel switch (CSA), leading to a crash due to invalid memory access. The issue occurs when the channel context is released while the CSA finalize work is still running.

In the Linux kernel's mac80211 subsystem, when starting an access point (AP) fails, the interface state is not reset, leading to divide errors and warnings during scanning. The issue involves leaving beaconing enabled after a failed AP start.

In the Linux kernel's mac80211 subsystem, when bringing up an interface fails, the LED state is not reset, causing a timer to remain active and potentially be freed, leading to warnings and possible crashes. The issue involves the TPT trigger timer.

In the Linux kernel's mac80211 subsystem, the ieee80211_tdls_oper() function can operate on the AP station, leading to warnings when the AP station is removed or later confused for a TDLS peer. There is no check that the station is actually a TDLS peer.

In the Linux kernel's mac80211 subsystem, interfaces are not removed from the local->interfaces list when their netdev is unregistered without going through ieee80211_if_remove(). This can lead to a BUG in wiphy_to_rdev() during interface removal.

In the Linux kernel's cfg80211 subsystem, when a network namespace is destroyed, moving the wiphy to the initial namespace can fail, leaving a garbage netns pointer. This leads to a kernel fault when notifying about the wiphy.

In the Linux kernel's mac80211 subsystem, frames injected on a monitor interface can carry a radiotap field requesting a bandwidth wider than the actual channel bandwidth, leading to a warning in hwsim. Such frames should be dropped.

In the Linux kernel's mac80211 subsystem, the scan elements length (scan_ies_len) does not account for the HE 6 GHz Band Capability element, which can lead to failure in building probe requests and trigger a WARN_ON during scanning.

In the Linux kernel's mac80211 subsystem for mesh networks, the CSA state (ifmsh->csa) is not reset when leaving the mesh, leading to memory leaks and incorrect state (csa_role, chsw_ttl). The fix resets the state when leaving the mesh.

In the Linux kernel's mac80211 subsystem for mesh networks, if starting the mesh fails, the channel context is not released, leading to warnings and potential crashes during interface removal. The fix correctly releases the channel on start failures.

In the Linux kernel, the mac80211 subsystem had an issue with early TX info initialization, leading to improper error reporting to userspace. The fix initializes skb->cb[] earlier, enabling the use of ieee80211_free_txskb() and unifying the error handling path.

In the Linux kernel, the pxa DMA engine driver had a double counting issue of hardware descriptors after conversion to kzalloc_flex(). The fix explicitly sets the nb_desc counter and removes the increment to avoid errors in processing loops.

In the Linux kernel, the netfilter nft_nat module has an uninitialized memory issue in nft_nat_setup_netmap() for IPv4 mapping. The fix zero-initializes the entire new_addr structure to avoid using uninitialized data.

In the Linux kernel, the netfilter nf_nat module has a memory leak when hook registration fails. The fix postpones setting nat_hook_ops and simplifies the error path to ensure hooks are released.

In the Linux kernel, the netfilter flowtable module has an issue with premature release of conntrack reference, potentially leading to use of an invalid object. The fix holds the reference until flow release after RCU grace period and adds rcu_barrier() on module exit.

In the Linux kernel, the DRM subsystem has a leak of drm_pending_vblank_event in the error path for out_fence_ptr. The fix releases the event and sets crtc_state->event to NULL to avoid memory leak.

In the Linux kernel, the SMB client has a buffer overflow vulnerability when processing absolute native symlink targets. The fix validates the NT drive prefix before accessing fixed offsets to prevent memory overwrites.

A vulnerability in the Linux kernel was found in the validation of the NDTPA_INTERVAL_PROBE_TIME_MS parameter for neighbor tables (e.g., ARP). Missing validation allows setting 0 or very large values (e.g., 4294967296), leading to incorrect timer behavior and potential security bypass.

In the Linux kernel, the ALSA bcd2000 driver has a race between rawmidi operations and USB disconnect, potentially leading to use-after-free (UAF). The fix introduces a spinlock covering rawmidi operations and handling in the callback to ensure safety.

In the Linux kernel, the NTFS ntfs_non_resident_attr_shrink() function called runlist helpers requiring the runlist write lock without holding it while freeing clusters and truncating the runlist, creating a race. Additionally, ntfs_attr_map_cluster() could leave inconsistent state if a mapping update failed. The fix serializes these operations with the runlist lock and adds rollback handling.

In the Linux kernel ALSA subsystem, snd_pcm_timer_init() registered the PCM timer before setting timer->private_data. During a brief window, a concurrent reader could reach the timer via /proc/asound/timers or snd_timer_open() and invoke callbacks that dereference a NULL pointer. The fix moves the private_data assignment before registration.

In the Linux kernel virt_wifi driver, virt_wifi_newlink() transferred operstate before registering the network device. If registration failed (e.g. due to an invalid name), free_netdev() freed the object while it remained on lweventlist, causing a use-after-free in a later linkwatch_fire_event(). The fix moves the transfer after netdev_upper_dev_link().

In the Linux kernel DRM vc4 driver, vc4_kms_load() called drm_kms_helper_poll_init() without a matching fini. After driver unbind, the scheduled output poll work ran on the freed drm_device, causing a use-after-free. The fix uses the managed drmm_kms_helper_poll_init().

In the Linux kernel ALSA HDA subsystem, the PCM open tracepoint was invoked before a stream was assigned. When stream assignment failed due to exhausted hardware streams, the tracepoint payload accessed an unassigned stream tag. The fix moves the tracepoint after the NULL check.

In the Linux kernel seg6, decap_and_validate() did not set the IPSKB_L3SLAVE flag in IPCB for IPv4 during IPIP decapsulation, although it did so for IPv6. As a result, SRv6 packets decapsulated on a VRF-enslaved interface did not reach local sockets as expected. The fix sets IPSKB_L3SLAVE for IPv4.

In the Linux kernel DSA driver mxl862xx, there is an issue with stats polling during teardown. The poll may run on freed port memory, and a re-arm after cancellation can queue work after sync has completed.

In the Linux kernel bcmgenet driver, configured hardware filter rules are lost on every interface up because list initialization in bcmgenet_hfb_init() drops all rules.

In the Linux kernel IPv4 ICMP, icmp_route_lookup() does not reject RTN_UNREACHABLE input routes, which can trigger a WARN_ON_ONCE() in ip_rt_bug() when sending ICMP packets.

In the Linux kernel, the skfp FDDI network driver has a NULL pointer dereference vulnerability when setting the MAC address on a down interface. skfp_ctl_set_mac_address() calls ResetAdapter() without checking netif_running(), leading to access to uninitialized transmit queues and a kernel oops.

In the Linux kernel network bridge, br_mst_set_state() calls switchdev_port_attr_set() while holding rcu_read_lock(), which may sleep in RCU context and cause potential issues.

A race condition exists in the Linux kernel's tcp_v6_do_rcv() function between checking the TCP_LISTEN socket state and calling skb_clone_and_charge_r(). A concurrent close() can change the state from TCP_LISTEN to TCP_CLOSE, causing the function to be called without locking and triggering a warning in inet_sock_destruct(). The issue affects IPv6 TCP listening sockets being closed concurrently.