Linux kernel vulnerabilities

In the Linux kernel QRTR subsystem, socket creation is not restricted to the initial network namespace, allowing unprivileged processes in other namespaces to send QRTR datagrams to sockets in other namespaces, breaking isolation. The fix confines the socket family to the initial network namespace.

In the Linux kernel, the mlx5 driver has a buffer overflow when reading the MCIA register if the device supports 32 dword reads, but the data structure only defines 12 dwords. This can lead to out-of-bounds read and kernel panic, especially with FORTIFY_SOURCE enabled.

In the Linux kernel, the ice driver has a memory leak when allocating timestamp rings for non-PF VSI types. The ice_is_txtime_ena() function does not check the VSI type, leading to incorrect allocation and memory leak on each PCI reset.

In the Linux kernel, a vulnerability was found in the idpf driver causing a crash during initialization when memory allocation for vports, netdevs, and vport_config buffers fails. The issue is that adapter->max_vports is set before successful allocation, leading to a NULL pointer dereference during device reset or module removal (rmmod).

In the Linux kernel, the RDS TCP module has a race condition during netns teardown. The sysctl is unregistered after closing the listen socket, which can lead to use-after-free in rds_tcp_skbuf_handler().

In the Linux kernel, the TIPC protocol has an integer overflow in tipc_recvmsg() and tipc_recvstream(). Using min_t(int, ...) instead of min_t(size_t, ...) can lead to a negative copy length, causing a kernel panic.

In the Linux kernel, the drop_monitor module has an information leak in the NET_DM_ATTR_PAYLOAD attribute. Uninitialized padding bytes are sent to user space in netlink messages, potentially revealing kernel memory.

In the Linux kernel, the drop_monitor module has a size calculation error for 64-bit attributes. Underestimating the SKB buffer size can lead to a kernel panic (skb_over_panic) when adding attributes.

In the Linux kernel, the drop_monitor module performs u64_stats updates after re-enabling interrupts, which on 32-bit architectures can lead to data corruption or sequence state corruption. The fix moves the updates before disabling interrupts.

In the Linux kernel for the LoongArch architecture, the bpf_jit_free() function has a memory leak because it does not free the JIT context offsets array (jit_data->ctx.offset). This can lead to memory exhaustion when loading BPF programs repeatedly.

A use-after-free vulnerability was found in the Linux kernel's tcp_bpf_sendmsg() function in the BPF sockmap mechanism. The issue arises from an unsafe comparison of the msg_tx pointer with psock->cork after reacquiring the socket lock, which can lead to double-freeing of memory (stale cork) when two threads send concurrently on the same socket.

A use-after-free vulnerability was found in the Linux kernel's tracing subsystem, specifically in freeing trigger private data after synchronization was deferred to a separate thread. This allows a concurrent tracepoint handler to access freed memory. The fix restores synchronization for histograms and adds an optional callback for enable triggers.

In the Linux kernel, the drm/rockchip: analogix_dp driver lacks an error check for platform_get_resource(). This can lead to a NULL pointer dereference when the memory resource is unavailable.

In the Linux kernel, the drm/imagination (powervr) graphics driver has a vulnerability where paired geometry and fragment job dependencies are not correctly counted in prepare_job(). This leads to underestimating the CCCB queue occupancy, potentially causing kernel warnings and job timeouts.

In the Linux kernel, the drm/bridge: cdns-dsi driver uses the deprecated UNIVERSAL_DEV_PM_OPS() macro, which invokes the same callbacks for both runtime PM and system sleep. This causes DSI clocks to be disabled twice, generating warnings.

In the Linux kernel, the remote DPCD/I2C sideband reply parsers in drm/dp/mst have out-of-bounds (OOB) reads. The functions drm_dp_sideband_parse_remote_dpcd_read() and drm_dp_sideband_parse_remote_i2c_read_ack() do not check that idx + num_bytes <= raw->curlen, potentially reading past the buffer.

In the Linux kernel, the function drm_dp_sideband_append_payload() in drm/dp/mst has three buffer overflow bugs: curchunk_len underflow when msg_len=0, overflow of the chunk[48] buffer, and overflow of the msg[256] buffer. These are reachable from any DP MST device that can forge sideband replies.

In the Linux kernel DRM DP MST subsystem, an out-of-bounds read vulnerability was found in sideband reply parsers. Three parsing functions read 16-bit fields without proper bounds checking, potentially reading past the buffer.

In the Linux kernel amdgpu driver, a buffer overflow was found in the cleaner shader sysfs path. A 64-byte buffer is allocated but filled with more data, potentially causing a kernel page fault.

In the Linux kernel amdgpu driver, the result of amdgpu_vm_bo_find() is not checked in the GET_MAPPING_INFO path, potentially leading to a NULL pointer dereference when a buffer is unmapped.

In the Linux kernel xe driver, a buffer overflow was found in the steered register list allocation. The allocation size is calculated using only the geometry DSS mask, while the filling loop uses the union of geometry and compute masks, causing writes past the allocated buffer.

In the Linux kernel amdgpu driver, issues were found in context pstate override handling, including potential use-after-free and NULL pointer dereference during context initialization. Additionally, context exit may overwrite the configuration set via sysfs.

In the Linux kernel amdgpu driver, a missing minimum-size check for CP_GFX_SHADOW chunks in amdgpu_cs_pass1() could lead to a NULL pointer dereference when a user submits a chunk with zero length.

In the Linux kernel nouveau driver, reversed error cleanup order was found in ucopy functions, potentially leading to ERR_PTR dereference causing a kernel oops or memory leak.

In the Linux kernel sysfb subsystem, a possible truncation was found when calculating the visible size of the system framebuffer. Using 32-bit arithmetic can overflow if height and stride values are large.

In the Linux kernel i915 driver, a missing Spectre mitigation was found for the user-controlled parallel submission slot, potentially enabling Spectre attacks.

In the Linux kernel xe driver, non-migratable faults requiring devmem incorrectly jump to the 'out' label, causing an incorrect error code to be returned. The fix returns -EACCES instead.

In the Linux kernel, the drm/xe/rtp driver had a security issue where OA registers were unconditionally whitelisted. The fix sets the RING_FORCE_TO_NONPRIV_DENY bit in OA nonpriv slots to prevent these registers from being whitelisted by default after reset.

In the Linux kernel drm/xe driver, there is a use-after-free vulnerability involving imported dma-buf objects. A BO can reference the exporter's reservation object which may be freed before the importer takes a reference, leading to a system crash.

In the Linux kernel, the drm/xe/vm driver has a vulnerability where using -1 as an array index during BO VMA prefetch with CONSULT_MEM_ADVISE_PREF_LOC causes an out-of-bounds access. The fix resolves the preferred location for BO VMAs directly.

In the Linux kernel, the drm/xe/pt driver has a vulnerability where current_op is not reset in xe_pt_update_ops_init(). During retries, this can lead to out-of-bounds write and subsequent use-after-free crash. The fix resets current_op and related flags.

In the Linux kernel, the drm/imagination (powervr) graphics driver has a double call to drm_sched_entity_fini(), leading to a refcount underflow and potential use-after-free. The issue occurs during context destruction when drm_sched_entity_fini() is called both in pvr_queue_kill and pvr_queue_destroy paths.

In the Linux kernel, the drm/imagination driver has a vulnerability in pvr_set_uobj_array() where the strides for user and kernel pointers are swapped during array copying. This leads to reads/writes at wrong addresses and incorrect padding clearing.

In the Linux kernel, the DRM Imagination (powervr) driver has a vulnerability due to incorrect error checking of pvr_vm_context_lookup() using IS_ERR(). This function returns NULL or a pointer, not an error code, leading to NULL pointer dereference and kernel oops when calling the DRM_IOCTL_PVR_CREATE_CONTEXT ioctl with an invalid VM context handle.

In the Linux kernel, the drm/imagination driver has a vulnerability due to lack of synchronization between find and map operations in drm gpuvm. During map/unmap operations, a find operation may be in progress, leading to NULL pointer dereference. The fix acquires vm_ctx->lock before mapping memory.

In the Linux kernel, the drm/amdkfd driver has a vulnerability in allocate_event_notification_slot where the upper bound for event id was not checked. This could lead to allocation of a slot outside the allowed range, potentially causing errors or security issues.

In the Linux kernel, the drm/amdkfd driver has a vulnerability where the range of queue type and mqd size values is not checked during CRIU restore. This could lead to improper behavior or potential security issues. The fix adds appropriate checks.

In the Linux kernel, the drm/amdkfd driver has a vulnerability involving a 32-bit overflow in the CWSR total size calculation. With large ctx_save_restore_area_size and debug_memory_size multiplied by the XCC count, the product can wrap, yielding an undersized CWSR save area that firmware later overruns. The fix promotes total_cwsr_size to u64 and uses check_add_overflow()/check_mul_overflow().

In the Linux kernel, the drm/amd/display driver has a reference leak of prev_sink in the detect_link_and_local_sink function. In the DP alt mode timeout path, the function returns false without releasing prev_sink, while all other return paths correctly call dc_sink_release(prev_sink).

In the Linux kernel, the drm/virtio driver has an out-of-bounds read vulnerability in virtio_get_edid_block(). The function validates the read offset only against the device-supplied resp->size field, not against the fixed-size resp->edid array. A malicious virtio-gpu backend can advertise a large size and high block count, leading to reads past the array and an info leak from kernel memory.

In the Linux kernel, the drm/i915/vrr driver lacks validation of the minimum and maximum refresh rates (vfreq) provided by EDID. In the worst case, a zero min_vfreq could lead to a division by zero in intel_vrr_compute_vmax().

In the Linux kernel, the drm/i915/hdcp driver has a vulnerability where the bounds check for the data->streams[] array is performed after the buffer overflow has already occurred. The fix moves the check before the write, preventing memory overwrite.

In the Linux kernel, the drm/amdgpu/sdma7.0 driver replaces BUG_ON() with WARN_ON() to avoid kernel crashes on errors. Previously, using BUG_ON() caused immediate system halt.

In the Linux kernel, the drm/amdgpu/sdma6.0 driver replaces BUG_ON() with WARN_ON() to avoid kernel crashes on errors. Previously, using BUG_ON() caused immediate system halt.

In the Linux kernel, the drm/amdgpu/sdma5.2 driver replaces BUG_ON() with WARN_ON() to avoid kernel crashes on errors. Previously, using BUG_ON() caused immediate system halt.

In the Linux kernel, the drm/amdgpu/sdma5.0 driver replaces BUG_ON() with WARN_ON() to avoid kernel crashes on errors. Previously, using BUG_ON() caused immediate system halt.

In the Linux kernel, the drm/i915 driver's active_instance function may return a pointer to node->base when node is NULL due to OOM during GFP_ATOMIC allocation. The fix changes the function to return NULL on error.

In the Linux kernel, the drm/i915/bios driver lacked range checking for the panel_type2 field in the LFP Data Block. Helper functions for range checking were added, improving correctness in panel type selection.

In the Linux kernel, the drm/amdgpu/gfx11 driver replaced BUG_ON() with WARN_ON() to avoid crashing the kernel in certain cases.

In the Linux kernel, the drm/amdgpu driver had a lifetime issue with the vm pointer in amdgpu_vm_get_task_info_pasid(). The pointer was used after the lock was released, potentially leading to use-after-unlock. The fix removes the amdgpu_vm_get_vm_from_pasid() function and inlines the code to hold the lock while in use.