Linux kernel vulnerabilities

A security issue was found in the Linux kernel's AMD IOMMU subsystem, involving unsafe locking in interrupt context during domain allocation. The bug triggers Lockdep warnings about potential deadlocks, which could lead to system instability.

In the Linux kernel, the ALSA hda cs35l41 driver has a vulnerability involving memory leak and potential invalid pointer access when handling the ACPI mute object. The function cs35l41_get_acpi_mute_state() does not free the ACPI object after use and assumes the returned object is a buffer with at least one byte, which can lead to memory leak or invalid pointer access with a malformed firmware response.

In the Linux kernel, the arm_mpam subsystem has a NULL pointer dereference vulnerability when destroying component configuration. The function __destroy_component_cfg() adds each mbwu_state object to the MPAM garbage list, but mbwu_state is allocated only for RISes with MBWU monitors, so some RISes may have a NULL pointer, leading to NULL dereference in the add_to_garbage() macro.

In the Linux kernel's ueagle-atm driver for USB ADSL modems, a vulnerability was found due to inconsistent criteria for distinguishing pre- and post-firmware devices between the probe and disconnect functions. A crafted USB device can exploit this mismatch, leading to an out-of-bounds read (slab-out-of-bounds) and potentially causing a system crash or privilege escalation.

In the Linux kernel's ovpn, ovpn_peer_release_p2p() may drop a reference to a new P2P peer instead of the one associated with the destroyed UDP socket. This leads to use-after-free in peer and socket cleanup paths.

In the Linux kernel's ovpn, unlock_ovpn() uses llist_for_each_entry() to iterate over the release_list, but after freeing a peer inside the loop, it reads peer->release_entry.next after the peer may have been freed, leading to use-after-free.

In the Linux kernel's hwmon occ, the poll response parser uses the static backing-array capacity as the parse boundary instead of data_length, allowing reads beyond the current response when data is truncated.

In the Linux kernel's Bluetooth btusb driver, btusb_recv_event_realtek() reads the Realtek subevent code at data[2] without checking if the event is long enough. Short events can be misclassified as coredump.

In the Linux kernel's net/packet, packet_set_ring() may re-register the fanout hook after device unregistration if po->ifindex == -1 is not treated as an invalidated binding. This leads to re-adding the hook after the device has been unregistered.

In the Linux kernel's BPF, the bpf_redirect*() helpers and skb_do_redirect() assume the existence of bpf_net_context, but in some qdisc paths it is not established, leading to NULL dereference.

In the Linux kernel's bonding, when IPv6 is disabled (ipv6.disable=1), devconf_all is not initialized, but bond_send_validate() still calls bond_ns_send_all(), leading to NULL dereference in ip6_pol_route().

A vulnerability was found in the Linux kernel's RDS (Reliable Datagram Sockets) subsystem. The destination socket lookup does not consider network namespaces, allowing a message to be delivered to a socket in a different namespace. This can lead to a use-after-free condition when the namespace is torn down, potentially causing a system crash or arbitrary code execution.

In the Linux kernel's rxrpc, rxrpc_wake_up_io_thread() checks local->io_thread but then reloads the pointer for wake_up_process(). Since the pointer is cleared with WRITE_ONCE(), the second load can see NULL even if the first did not, leading to a race.

In the Linux kernel, the dpaa2-switch driver has a reference leak for the MAC endpoint device during disconnect. fsl_mc_get_endpoint() returns a device with a reference that is not dropped in the disconnect path, causing a memory leak on every successful connection.

In the Linux kernel, the airoha network driver has a potential use-after-free in airoha_ppe_deinit(). The function replaces the NPU pointer with NULL without waiting for existing RCU readers, which could lead to accessing freed memory.

In the Linux kernel, the dpaa2-eth driver has a reference leak for the MAC endpoint device during disconnect. fsl_mc_get_endpoint() returns a device with a reference that is not dropped in the disconnect path, causing a memory leak on every successful connection.

In the Linux kernel, the airoha network driver has a DMA direction bug for the NPU mailbox buffer. airoha_npu_send_msg() always maps the buffer with DMA_TO_DEVICE, but some callers expect the NPU to write response data back into the same buffer. On non-cache-coherent architectures, this can lead to reading stale data.

In the Linux kernel, a vulnerability in the iommu/amd driver was found in the iommu_completion_wait() function due to incorrect handling of the need_sync flag. In a multi-CPU scenario, the function could return early without waiting for all previously queued commands to complete, violating the synchronization contract.

In the Linux kernel, the nfp driver lacks a check for the resource mutex allocation result. nfp_cpp_resource_find() may return success even if the mutex allocation fails, leading to a NULL pointer dereference when trying to lock the mutex.

In the Linux kernel, the wanxl driver has a potential NULL pointer dereference during early initialization failures. wanxl_pci_init_one() stores the card in driver data before the BAR is mapped, and on error wanxl_pci_remove_one() calls wanxl_reset(), which dereferences card->plx, which may still be NULL.

In the Linux kernel, the mwifiex driver lacks validation of event length supplied by firmware, leading to potential out-of-bounds read or integer underflow when handling station association events in AP mode.

In the Linux kernel, the iommu/amd driver's ivrs_acpihid command-line parser does not check the capacity of the early_acpihid_map array before appending an entry, which can lead to an out-of-bounds write when more than four entries are provided.

In the Linux kernel, the iommu/intel driver's dmar_latency_disable() function has a bug where it zeroes the entire latency_statistic array instead of a single entry, which for type > 0 leads to an out-of-bounds write and corruption of adjacent memory.

A vulnerability in the Linux kernel's TIPC subsystem affects the UDP replicast list. List updates were not serialized, which could lead to list corruption and a kernel panic. The issue is a race between adding entries from a softirq and deleting them during bearer cleanup.

In the Linux kernel, a vulnerability in the RDS module causes a NULL pointer dereference in __ipv6_chk_addr_and_flags() when attempting to bind an RDS socket to an IPv6 address while IPv6 is disabled via the 'ipv6.disable=1' parameter. This occurs because the inet6_addr_lst list is never initialized when IPv6 is disabled. The issue can lead to a system crash.

In the Linux kernel, a memory leak of FDIR filters (Perfect FDIR filters) was detected in the txgbe driver during network interface removal. Filters added while the interface is down are not freed because txgbe_fdir_filter_exit() is not called when the device is not up. The issue leads to memory leakage.

In the Linux kernel, a vulnerability in the SCTP protocol involves an incorrect capacity check of the auth_chunk_list in sctp_auth_ep_add_chunkid. The limit set to 20 entries is larger than the actual capacity of the destination structure (16 entries), which can lead to a buffer overflow during copying in sctp_association_init().

In the Linux kernel, a deadlock was detected in the pds_core driver between the reset thread and the device removal function. pci_reset_function() acquires device_lock, and pdsc_remove() is called with device_lock already held, leading to a deadlock when the reset thread is active. The fix uses pci_try_reset_function(), which does not block.

In the Linux kernel, a use-after-free vulnerability was detected in the pds_core driver related to the workqueue during device removal. The workqueue is destroyed before pdsc_teardown() is called, allowing work to be queued on the destroyed workqueue, leading to use-after-free. The fix moves destroy_workqueue() after pdsc_teardown() and orders resource freeing appropriately.

In the Linux kernel, a race condition was detected in the pds_core driver during the addition and removal of auxiliary devices. Two paths (VF reset and devlink handler) can concurrently modify the same slot, leading to memory leaks or NULL pointer dereference. The fix involves checking and updating the slot under config_lock.

In the Linux kernel, errors were detected in the element size calculation during command stream validation in the ethosu accelerator. For NHWC format, the element size is missing, and for OFM different precision bits are used than for IFM/IFM2, leading to an undersized calculation. This can result in improper validation and potential buffer overflow.

A vulnerability in the Linux kernel's SCTP implementation was found. The sctp_process_strreset_inreq() function does not validate the stream count in a RESET_IN_REQUEST from a peer, which can cause an overflow when generating the RESET_OUT_REQUEST. On interfaces with MTU larger than 65535 bytes (e.g., loopback with IPv6 jumbograms), this can lead to a __u16 overflow, undersized skb allocation, and a kernel BUG.

In the Linux kernel, a resource leak was detected in the mctp i3c module during failed driver registration. If I3C driver registration fails, the notifier and mctp_i3c_bus objects are not cleaned up, leading to memory leaks and leaving a notifier pointing into a module that failed to load. The fix adds cleanup in the error path.

In the Linux kernel TIPC subsystem, the __tipc_nl_compat_dumpit function can enter an infinite loop when the dumpit callback returns a negative errno. The while(len) loop never terminates, causing genl_mutex to never be released and other tasks waiting on it to starve in D state.

In the Linux kernel CIFS subsystem, there is a cifsFileInfo leak when kmalloc fails in deferred close drain paths. After cancelling a pending deferred close, if memory allocation fails, the loop breaks but the cifsFileInfo reference and the open server handle are not released.

In the Linux kernel mt76 WiFi driver (mt7925 model), the mt7925_sta_set_decap_offload() function can dereference a NULL pointer when an MLO station does not have a link STA for every valid link of the vif. This leads to NULL dereference when setting or clearing the MT_WCID_FLAG_HDR_TRANS flag.

In the Linux kernel mt76 WiFi driver (mt7915 model), the mt7915_mcu_bss_he_tlv() and mt7915_mcu_sta_bfer_tlv() functions can dereference a NULL pointer when mt76_connac_get_he_phy_cap() returns NULL. This leads to NULL dereference when appending the TLV.

In the Linux kernel mt76 WiFi driver (connac subsystem), the mt76_connac_mcu_uni_bss_he_tlv() function can dereference a NULL pointer when mt76_connac_get_he_phy_cap() returns NULL. There is no check of the cap pointer before dereferencing it.

In the Linux kernel mt76 WiFi driver (mt7996 model), the mt76_connac_get_he_phy_cap() function can theoretically return NULL, and the code does not check the cap pointer before dereferencing it, which can lead to a crash.

In the Linux kernel mt76 WiFi driver (mt7925 model) during reset recovery, mt7925_vif_connect_iter() can pass NULL as bss_conf to mt76_connac_mcu_uni_add_dev(), leading to a system crash. This happens when the driver bitmap contains a link whose bss_conf has already gone away.

In the Linux kernel mt76 WiFi driver (mt7996 model), the mt7996_mcu_sta_bfer_eht() function can dereference a NULL pointer when mt76_connac_get_eht_phy_cap() returns NULL. There is no check of the cap pointer before dereferencing it.

In the Linux kernel, the drm/xe driver for Intel GPUs has a vulnerability due to missing drm_dev guards when detaching CCS read/write buffers. In certain scenarios, buffers are freed after the device is unbound, leading to a NULL pointer dereference and system crash.

In the Linux kernel brcmfmac WiFi driver, a trace warning occurs when calling brcmf_cfg80211_set_pmk() in 802.1X-SHA256 mode because the use_fwsup flag is not set to BRCMF_PROFILE_FWSUP_1X.

In the Linux kernel, the drm/vc4 hvs and v3d drivers use dev_get_drvdata(master) in their unbind functions, leading to a null pointer dereference when vc4-drm is removed before dependent drivers. The fix uses the data pointer passed to the unbind functions instead of dev_get_drvdata(master).

In the Linux kernel HSR subsystem, when a slave device is unregistered, synced VLAN IDs are not removed, causing a memory leak. The fix adds a call to vlan_vids_del_by_dev() in hsr_del_port().

In the Linux kernel vmxnet3 driver, vmxnet3_get_hdr_len() triggers BUG_ON for Geneve packets when the descriptor indicates an inner header instead of the outer. The fix checks the VMXNET3_RCD_HDR_INNER_SHIFT flag and safely returns 0 instead of triggering BUG_ON.

In the Linux kernel, in the DRM/XE driver for Intel GPUs, a memory leak was discovered in xe_vm_create(). On a reservation object allocation failure, resources initialized by xe_svm_init() are not freed, leading to memory leaks in both fault-mode and non-fault-mode VMs.

In the Linux kernel TIPC subsystem, MTU validation for media and bearers lacks an upper bound check, allowing values above U16_MAX, leading to truncation and division by zero. The fix rejects MTU values above U16_MAX.

In the Linux kernel GRE subsystem, a regression in LLTX mode for tunnels with SEQ/CSUM causes dev->lltx to be set after early returns, losing lockless TX and risking deadlock. The fix moves dev->lltx assignment before the early returns.

In the Linux kernel for LoongArch, the BPF JIT sign-extends signed ALU32 div/mod results, leaving upper 32 bits set, inconsistent with the verifier model. The fix adds zero-extension of the result after the divide/modulo operation.