Linux kernel vulnerabilities

A vulnerability in the Linux kernel allows net.ipv4.tcp_rmem to be set below 4096, causing a divide-by-zero error in tcp_rcvbuf_grow() and tcp_rcv_space_adjust(). This can lead to a kernel crash. The issue is fixed by enforcing a minimum value of 4096 for tcp_rmem.

In the Linux kernel DMA driver mmp_pdma, mmp_pdma_prep_slave_sg() reads entry length from the list head instead of the current entry, causing errors with varying lengths.

In the Linux kernel Bluetooth (hci_core), hci_send_acl(), hci_send_sco(), and hci_send_iso() queue tx_work unconditionally, which during device shutdown can cause warnings and work loss.

In the Linux kernel Bluetooth driver btintel_pcie, btintel_pcie_send_sync() does not validate packet length before copying to DMA buffer, which can lead to buffer overflow.

In the Linux kernel, a vulnerability in the Bluetooth coredump subsystem allows dump work to remain active after device unregister, leading to a use-after-free condition.

In the Linux kernel, the hci_qca Bluetooth driver has a vulnerability where it writes to a closed serial port. If hci_dev_open_sync() fails after a successful qca_setup(), the port is closed but power->vregs_on remains true, leading to a write to the closed port during driver removal. This results in a NULL pointer dereference, potentially causing a system crash.

In the Linux kernel, a reference leak in the Bluetooth ISO subsystem occurs in iso_conn_ready() when child socket allocation fails, causing memory leak.

In the Linux kernel, the Bluetooth drivers btmtksdio and btmtkuart lack validation of WMT event length before accessing structure fields, leading to out-of-bounds read.

In the Linux kernel, the Bluetooth btintel_pcie driver has an off-by-one bounds check in RX submission, allowing access to an element past the end of the FRBD array.

In the Linux kernel, a potential socket lock inversion in the Bluetooth RFCOMM listener cleanup can lead to a deadlock.

A vulnerability in the Linux kernel's af_unix mechanism was found, related to incorrect assignment of SCC indices in Tarjan's algorithm. In certain cases, vertices within one SCC may have different scc_index values, leading to incorrect garbage collection and potential memory leaks.

In the Linux kernel, the stmmac network driver has a TSO header length truncation issue because it stores the length in a u8, causing wraparound for headers longer than 255 bytes.

In the Linux kernel, the pppoatm driver lacks ensuring a writable skb header and linear data, which can lead to out-of-bounds reads or unbalanced buffer operations.

In the Linux kernel, a vulnerability was found in the drop_monitor module where per-CPU timers are stopped using timer_delete_sync() during teardown, which does not prevent concurrent workers from re-arming the timer. Under memory pressure, a worker can re-arm the timer after timer_delete_sync() returns, and after module unload, the timer fires in freed memory, causing a kernel panic or use-after-free.

In the Linux kernel, a bug in the bridge VLAN deletion handling was found when switchdev blocks the operation. Allowing switchdev to prevent VLAN deletion leads to inconsistent state, memory leaks, and NULL pointer dereference. The fix logs the error and continues with software VLAN deletion, consistent with 8021q behavior.

In the Linux kernel, a vulnerability was found in the netlink subsystem where netlink_realloc_groups() can free the old group bitmap before lockless readers finish using it. Two read paths (sk_diag_dump_groups() and /proc/net/netlink) can access freed memory, leading to use-after-free or out-of-bounds read.

In the Linux kernel, KVM for PowerPC (Book3S HV) has a use-after-free vulnerability in kvmhv_emulate_tlbie_all_lpid(). The function iterates nested-guest IDs without holding a reference, allowing a race with a concurrent vCPU that can free the memory. The fix increments the reference count before dropping the lock and releases it after the work.

In the Linux kernel, the powerpc/iommu module has an overflow validation bug in iommu_tce_check_ioba. The unified IOBA checking ignored the npages argument, using a constant value of 1, potentially allowing overflow when npages > 1. The fix accounts for npages, checks arithmetic overflow, and verifies the entire range does not exceed table capacity.

In the Linux kernel, the futex mechanism lacks private hash allocation on vfork(). Since accessing mm via vfork() is feasible, a private hash must be allocated for vfork() and other CLONE_VM users. The fix ensures the private hash is allocated before any private futex waiters exist.

In the Linux kernel, the drm/xe/i2c driver has a use-after-free vulnerability during unbind. The xe_i2c structure is freed before the SGUnit IRQ is disabled, leaving a window where an I2C IRQ can hit freed memory. The fix explicitly disables the I2C IRQ in xe_i2c_remove().

In the Linux kernel, the btrfs filesystem has a vulnerability where cleaning up verity items (rollback_verity, drop_verity_items, btrfs_orphan_cleanup) lacks metadata reservation, causing the whole filesystem to be forced read-only when hitting qgroup limit or lack of space, even though the limit applies to one subvolume only. Leftover items are never removed, making the subvolume unreachable or causing mount failures.

In the Linux kernel, the dev_fill_forward_path() function contains a WARN_ON_ONCE that can be triggered by a routing loop in IPIP and IPv6 tunnels when the route to the tunnel's remote endpoint resolves back to the tunnel itself. This configuration is possible for users with CAP_NET_ADMIN and causes the function to make no progress, triggering the warning when a flowtable tries to offload a flow through the tunnel.

In the Linux kernel, the fbnic network driver has a vulnerability where fbnic_tx_map() skips the doorbell write and completion request for packets with xmit_more set, relying on the packet ending the burst to publish them all. If that packet is dropped (e.g., due to DMA error), no doorbell is written, and descriptors of preceding packets remain invisible to the hardware, potentially causing a transmit queue stall.

A vulnerability in the Linux kernel's sock_gettstamp() function changes socket sk_flags without holding the socket lock. This leads to a race condition between bind() and SIOCGSTAMPNS_NEW ioctl, potentially causing a use-after-free on UDP sockets. The fix locks the socket only when SOCK_TIMESTAMP needs to be set, keeping the common case lockless.

In the Linux kernel, the Cortina (gmac) network driver has a vulnerability where the RX overrun interrupt is reported in interrupt status register 4, but gmac_irq() acknowledges it using the RX descriptor error bit from status register 0. For GMAC0 this writes the GMAC1 overrun bit, while for GMAC1 the shift leaves no bit in the 32-bit register, leading to incorrect interrupt acknowledgment.

In the Linux kernel, the PSP (Packet Security Protocol) mechanism conflicts with TLS ULP in its usage of both skb->decrypted and sk->sk_validate_xmit_skb(). To avoid conflicts, PSP should be mutually exclusive with TLS ULP, the only other user of these fields. Additionally, for future proofing, it would make sense to assert that sk->sk_validate_xmit_skb() is also NULL in both setup paths.

A vulnerability in the Linux kernel's x86 kprobes implementation causes a kernel crash when probing CS CALL instructions using eBPF. The int3_emulate_call() function assumes the CALL instruction is 5 bytes long, but the CS-prefixed CALL instruction is 6 bytes, leading to an incorrect exception return address and a crash. The fix uses the actual instruction length from the instruction decoder instead of the hardcoded CALL_INSN_SIZE macro.

In the Linux kernel, the mvpp2 network driver has a vulnerability where mvpp2_change_mtu() may call mvpp2_bm_switch_buffers(priv, true) without checking whether the number of pools (nrxqs * 2) exceeds MVPP2_BM_MAX_POOLS (8). This can lead to an out-of-bounds access in the priv->page_pool array in mvpp2_bm_init(), as the array is sized to hold MVPP2_PORT_MAX_RXQ entries and the per-CPU scheme doubles the count.

In the Linux kernel, a vulnerability exists in pskb_carve_inside_header() and pskb_carve_inside_nonlinear(), which after removing initial packet bytes do not properly update header pointers (mac_header, network_header, transport_header, csum_start). Leftover stale values point beyond actual data, potentially causing kernel BUG during RDS TCP packet processing.

In the Linux kernel, the amdgpu graphics driver has a vulnerability where nbio_v7_9_handle_ras_controller_intr_no_bifring() dereferences ras and obj without checking for NULL. Both amdgpu_ras_get_context() and amdgpu_ras_find_obj() can return NULL, e.g., during the window between adev->nbio.ras being set and the PCIE_BIF ras object being created, which can cause a crash in hard-IRQ context.

In the Linux kernel's btrfs filesystem, during hole punching and reflinking operations, if inode update fails, the transaction is not aborted. This can lead to persistent inconsistency if the transaction is committed after the failure, as file extent items have been dropped from a range and either a hole was punched or a new file extent item was inserted.

In the Linux kernel, there is a null pointer access bug in the is_include_guest_event() function in the perf subsystem. During module unload with an active perf connection, the pmu pointer is freed, and later closing the connection leads to a null pointer dereference, causing a crash.

In the Linux kernel's 9p filesystem, the v9fs_issue_write() function does not correctly update the i_size and remote_i_size fields after a write if the file was enlarged. The fix updates these fields based on the start position and the count returned by p9_client_write(), assuming that the 9P server returns a reduced count on short writes (e.g., ENOSPC).

In the Linux kernel's ALSA core subsystem, there is a potential use-after-free (UAF) vulnerability after asynchronous sound card release. When the card is released asynchronously via snd_card_free_when_closed(), in-flight tasks may still access the card->dev device after disconnection, leading to UAF. The fix takes a refcount of card->dev at initialization and releases it at the destructor.

In the Linux kernel's ALSA usb-audio driver, a vulnerability was found that causes an out-of-bounds write when handling implicit feedback. The packet count for isochronous URBs is overwritten with a value from the sync source, leading to writes past the iso_frame_desc array. The fix clamps the packet count to the URB capacity.

In the Linux kernel's ALSA virtio driver, the virtsnd_remove() and virtsnd_freeze() functions delete the virtqueues before resetting the device. This allows the device to access freed vring memory. The fix resets the device before deleting the virtqueues to prevent access to freed memory.

In the Linux kernel's ASoC codec rt712-sdca-dmic, the stream_config structure is not initialized before being passed to sdw_stream_add_slave(). The type field may contain garbage, which is later copied to stream->type. The fix zero-initializes stream_config so type defaults to SDW_STREAM_PCM, and uses the snd_sdw_params_to_config() helper.

In the Linux kernel's AHCI driver (libahci), for controllers with the AHCI_HFLAG_32BIT_ONLY flag, the PxCLBU and PxFBU registers are not cleared, causing issues with JMicron JMB585 controllers. The fix explicitly clears these registers to ensure proper operation with 32-bit DMA.

In the Linux kernel's CIFS filesystem, the cifs_chan_skip_or_disable() function uses a server pointer after dropping the channel reference, leading to use-after-free. The fix signals the channel and primary server and captures the primary server pointer before dropping the channel reference.

A use-after-free vulnerability was found in the Linux kernel's POSIX timer cleanup mechanism during exec() by a non-leader thread. The bug occurs when operations after de_thread() (such as exec_mmap()) fail, leading to freeing a timer that is still queued, followed by a subsequent removal from the rbtree.

A vulnerability in the Linux kernel's fs/dax subsystem can cause a kernel panic during VM boot with DAX-enabled storage. The issue is the lack of a check for empty or zero entries in the xarray before calling dax_to_folio() in dax_associate_entry(), dax_disassociate_entry(), and dax_busy_page(). A previous fix (commit 98c183a4fccf) added guards but they still come after dax_to_folio(), leaving the problem unresolved.

In the Linux kernel, a race condition in POSIX CPU timers can lead to use-after-free (UAF). The issue stems from losing the distinction between 'timer on expiry list' and 'delivery canceled' after changing the 'firing' flag to boolean. The fix checks whether the timer is on the expiry list instead of relying on the flag.

In the Linux kernel, in RDS IB code, rds_ib_cm_connect_complete() calls rds_conn_destroy() on protocol version mismatch, leading to a deadlock in workqueue. The fix changes it to rds_conn_drop(), which schedules connection shutdown asynchronously.

A use-after-free vulnerability exists in the Linux kernel signal handling mechanism, caused by a race condition during exec() by a non-leader thread. A SIGEV_THREAD_ID timer created against the leader's tid may point to the thread calling execve() after tid exchange, leading to incorrect signal queueing and use of freed memory. The issue is fixed by flushing task pending signals earlier in exit_signals() and preventing signal queueing for tasks with PF_EXITING set.

In the Linux kernel, in TCP code, old ACKs (before SND.UNA) are excluded from the fast path and directed to the slow path, where they are properly validated according to RFC5961. This prevents acceptance of old ACKs and modification of connection state before validation.

In the Linux kernel, in swiotlb code, swiotlb_bounce() uses an incorrect address for highmem page lookup, which can lead to read/write from the wrong memory page. The fix uses the adjusted orig_addr for both operations.

In the Linux kernel, in RDMA/ucma code, there is a race between multicast join and leave operations that can lead to use-after-free (UAF). The fix holds the mutex throughout from join to copy_to_user to prevent leave from missing the join.

In the Linux kernel, in RDMA/core code, iwpm_get_nlmsg_request() initializes the refcount after adding to the global list, which can lead to a refcount bug. The fix initializes kref before list_add_tail() and initializes all fields before adding to the list.

In the Linux kernel, in openvswitch code, ovs_ct_get_conn_labels() may add a labels extension to a confirmed conntrack entry, which can lead to reallocation and freeing of the extension block during concurrent access. The fix adds the extension only for unconfirmed conntracks.

In the Linux kernel, in nfsd code, handling of NFSEXP_PNFS in the netlink codepath is incorrect because the move of the check to callers did not account for the new call in nfsd4_setup_layout_type(). The fix corrects this check.