Linux kernel vulnerabilities

In the Linux kernel for arm64, percpu operations on 8- and 16-bit types using LSE instructions do not include the size suffix, causing incorrect 32-bit memory accesses instead of the intended 8 or 16 bits. The fix appends the 'sfx' suffix to the LSE instruction.

In the Linux kernel Bluetooth module (hci_codec), the Read Local Supported Codecs parsers do not properly validate the vendor codec count length, potentially leading to out-of-bounds reads. The fix uses skb_pull_data() to validate and consume codec headers before using their count.

In the Linux kernel Bluetooth module (hci_sync), hci_dev_close_sync() clears the local codec list without holding hdev->lock, leading to a use-after-free during concurrent BT_CODEC queries. The fix takes the lock around the clear operation.

In the Linux kernel btrfs filesystem, mark_block_group_to_copy() iterates over the commit root without locking, leading to a use-after-free during concurrent transaction commits. The fix uses path->need_commit_sem to protect the commit root search.

In the Linux kernel btrfs filesystem, btrfs_rebuild_free_space_tree() does not clear the BTRFS_FS_CREATING_FREE_SPACE_TREE flag on error paths, potentially causing delayed reference processing to be skipped. The fix clears the flag on all failure paths.

In the Linux kernel dma-buf/dma-fence module, a previous fix changed the signaling check to an ops pointer check, causing loss of RCU protection after signaling for many dma_fence implementations, leading to use-after-free. The fix adds an additional signaling check alongside the ops pointer check.

In the Linux kernel dma-buf module, the mapped_len variable was 32-bit, causing silent overflow for MMIO sizes larger than 4G, leading to incorrect lengths passed to fill_sg_entry(). The fix changes mapped_len to size_t (64-bit) and adds overflow protections in calc_sg_nents.

In the Linux kernel IPv6 XFRM, xfrm6_local_rxpmtu() and xfrm6_local_error() assume skb->sk always points to a full IPv6 socket, but it can be a request_sock, leading to out-of-bounds reads. The fix uses skb_to_full_sk() and bails out when no full socket is attached.

In the Linux kernel ip_tunnel module, the options_len variable is not initialized before use in ip_tun_parse_opts_geneve, leading to a buffer overflow when copying option data. The fix initializes the counter before referencing options.

A vulnerability was found in the Linux kernel in scsi_cdl_enable() in the SCSI core. During scanning of USB devices that identify as ATA and support CDL, lengths returned by MODE SENSE can be invalid, leading to out-of-bounds stack read/write and disclosure of stack contents to the attacker.

A use-after-free vulnerability exists in the Linux kernel's xfrm_dev_state_free() during XFRM device state flush. The state GC worker can free the same state concurrently while the flush thread accesses it after dropping the xfrm_state_dev_gc_lock, leading to double driver callback invocation and use of freed memory.

In the Linux kernel, xfrm_input() has a use-after-free vulnerability involving xfrm_state. Some receive paths, such as VTI and XFRM interfaces, can reset the secpath before processing completes, leading to dereferencing freed memory. The fix saves the state protocol on the stack before the reset and uses the already saved address family.

In the Linux kernel, for MIPS I6500 CPU cores, the CONFIG_WEAK_REORDERING_BEYOND_LLSC option is not selected when CONFIG_EYEQ is enabled. The lld/scd instructions on these cores do not provide ordering guarantees, so arch_cmpxchg() is not fully ordered. This can lead to kernel page faults and system crashes, as demonstrated in the oops report.

In the Linux kernel memstick ms_block driver, there is a memory leak: the workqueue msb->io_queue created in msb_init_disk() is not destroyed on device removal (msb_remove()). Each card insert/remove cycle leaks the workqueue and its kworker, exhausting kernel memory.

In the Linux kernel, a collision exists between the SWAP_USAGE_OFFLIST_BIT flag and the real swap usage counter. The flag is defined as bit 30, which on systems with 4 KiB pages collides with the usage count once it reaches 4 TiB. This can cause underreporting of swap usage, premature swapoff leading to lost pages, and corruption of the counter and plist.

A bug in the Linux kernel shrinker mechanism manifests when cgroup.memory=nokmem is enabled. In that configuration, shrinker_memcg_alloc() fails to allocate an id, leaving shrinker->id as zero, which is then mistakenly treated as a valid bit index. This triggers a WARN_ON_ONCE in set_shrinker_bit() when the first THP is queued in a cgroup.

In the Linux kernel mmap_prepare() function, there is an error in memory accounting. When call_mmap_prepare() fails, jumping to abort_munmap does not unaccount previously accounted memory, leading to inconsistencies in memory counters.

In the Linux kernel filemap mechanism, there is an issue with dropbehind folios. Fault-around can map ready dropbehind folios without normal page-cache lookup, leading to forced unmapping during writeback. The fix retains mapped folios, avoiding a path that may sleep in non-preemptible context.

In the Linux kernel KEYS encrypted mechanism, there is an integer overflow in the datablob_len variable (u16). If the sum of lengths exceeds U16_MAX, the assignment truncates the allocation size, leading to a slab-out-of-bounds write reported by KASAN. The fix uses check_add_overflow() and kzalloc_flex().

In the Linux kernel KEYS trusted mechanism, tpm2_load_cmd() performs boundary checks against the ASN.1 size (payload->blob_len), which may be incorrect. The fix passes the decoded blob size to tpm2_load_cmd() and uses it for boundary checks.

In the Linux kernel, a vulnerability in sched_ext causes NULL pointer dereference in scx_bpf_select_cpu_and() and scx_bpf_dsq_insert_vtime() when handling tasks without a scheduler (e.g., exited or idle tasks). This leads to a kernel oops in the error handling path.

In the Linux kernel's sched_ext scheduler, there is a pre-enable error claim window that can lead to a use-after-free. An error claimed by a BPF program in this window is consumed by the disable path, causing the scheduler to remain up but unable to be disabled, and then freed while still in use.

In the Linux kernel's i2c atr driver, there is a dangling adapter pointer on add failure. After i2c_add_adapter() fails, the channel is freed but the pointer in the adapter array remains pointing to freed memory, potentially leading to use-after-free and blocking reuse with -EEXIST.

In the Linux kernel's mlx4 driver for InfiniBand, there is a use-after-free on pkey sysfs registration failure. Errors are ignored, and pointers to freed kobjects remain in the device, leading to double-free during cleanup.

A vulnerability in the Linux kernel's IB/hfi1 driver affects the PIO_CRED credit-return mmap. Incorrect pointer arithmetic and improper DMA API usage cause user space to receive the wrong credit-return page, leading to corrupted page tables, kernel Oops, or PIO transmission hangs.

In the Linux kernel's SELinux module, there is an issue with preserving user SID across nested backing files. For nested backing files (e.g., overlayfs over overlayfs), the user file SID may be the mounter's SID, leading to incorrect access checks during mprotect().

A vulnerability was found in the Linux kernel's SELinux module that allows bypassing access controls during mprotect() calls in nested overlayfs filesystems. An attacker can gain code execution permissions that should be denied by SELinux policy via a sequence of mmap(PROT_NONE) followed by mprotect(PROT_EXEC).

In the Linux kernel's MMC subsystem, there is a missing cancellation of SDIO IRQ work before freeing the host. Work scheduled from an interrupt can run after the host is freed, leading to use-after-free.

In the Linux kernel's mmc hsq driver, there is a use-after-free in retry work. The retry_work is embedded in a devm-allocated mmc_hsq but is never cancelled during driver removal, potentially leading to use-after-free.

In the Linux kernel's mmc mmci driver, there is a use-after-free in busy-timeout work. The ux500_busy_timeout_work can be queued but is not cancelled during removal, leading to use-after-free.

In the Linux kernel's mmc mxcmmc driver, there is a missing cancellation of data work and watchdog on removal. The watchdog and data work can run after the host is freed, leading to use-after-free.

In the Linux kernel, the mmc: sdhci-of-aspeed driver has a resource release ordering issue. On probe failure or removal, SDHCI child devices remain registered after the parent clock and managed resources are released. The fix unregisters OF children in reverse order before disabling the parent clock.

In the Linux kernel, the mmc: sdio_uart module has a transmit fifo leak when the port table is full. sdio_uart_add_port() allocates the fifo before claiming a slot; when all slots are taken, it returns -EBUSY without freeing the fifo. The fix frees the fifo in the error path.

In the Linux kernel, the mmc: spi module has an accounting error when retrying after CRC failures. mmc_spi_data_do() updates bytes_xfered after each block, but on CRC error and retry, the counter is not reset, potentially over-reporting transferred bytes. The fix clears bytes_xfered before retry.

In the Linux kernel, the Input: cyttsp5 driver fails to clamp the HID report size before memcpy. The size field comes from the device and is used as the memcpy length into response_buf of fixed size CY_MAX_INPUT, potentially causing a buffer overflow.

In the Linux kernel, the Input: evdev module leaks kernel stack memory via incomplete initialization of the absinfo structure in EVIOCSABS handling. The size copied from userspace may be shorter than the full structure, leaving uninitialized bytes that are later returned to userspace via EVIOCGABS. The fix zeroes the structure before copying.

In the Linux kernel, the Input: rmi_smbus driver has an out-of-bounds read in rmi_smb_write_block(). When chunking writes into SMBus blocks, the block length is calculated using the original total length instead of the remaining length, causing a read of 32 bytes even when fewer remain. The fix uses the remaining length.

In the Linux kernel, the Input: soc_button_array driver fails to check btns_desc->package.count before accessing btns_desc->package.elements[0]. This can lead to an out-of-bounds read if count is 0.

In the Linux kernel, the Input: synaptics-rmi4 driver causes a General Protection Fault during suspend and resume when the rmi_dev device is unbound. Calling rmi_driver_suspend() or rmi_driver_resume() without driver data causes a NULL pointer dereference and GPF. The fix checks for driver data before proceeding.

In the Linux kernel, the Input module leaks kernel stack memory via incomplete copying of the ff_effect structure in the compat path input_ff_effect_from_user(). Only the compat-sized prefix is copied, leaving uninitialized bytes that can be disclosed to userspace via UI_BEGIN_FF_UPLOAD. The fix zeroes the structure before copying.

In the Linux kernel, the hwmon (hp-wmi-sensors) driver contains a use-after-free in fungible_show(). The function reads the nsensor->current_state pointer after the lock has been released, allowing another thread to free and replace it during the read.

In the Linux kernel, the number of phases was increased to 16 and a new mask was added in the hwmon (pmbus/core) driver. This change prepares support for new devices but also fixes a potential out-of-bounds write in the mp2975 and mp2856 drivers, which already support more than 10 phases.

In the Linux kernel, the hwmon (pwm-fan) driver has a use-after-free (UAF) issue during driver detach. The sampling timer can be rearmed and access freed data before it is stopped. The fix separates timer retirement from power cleanup and uses timer_shutdown_sync() to ensure safe shutdown.

In the Linux kernel, the hwmon (w83791d) driver does not remove optional sysfs files for fans/PWM 4-5 during normal driver removal. Leftover files can lead to access to freed driver data. The fix removes the sysfs group during normal teardown as well.

In the Linux kernel, the wifi brcmsmac driver has a use-after-free (UAF) issue in brcms_free_timer(). Timer cancellation does not wait for the callback to finish, which can lead to access to freed memory. The fix adds an explicit cancel_delayed_work_sync() to ensure the callback completes before freeing the timer structure.

In the Linux kernel, the wifi iwlegacy driver has a double-free issue of broadcast stations on the error path. The function il_dealloc_bcast_stations() does not clear all fields, leading to repeated deallocation. The fix clears the entire 'used' field.

In the Linux kernel, the wifi libertas_tf driver has a use-after-free (UAF) issue in lbtf_free_adapter(). The order of freeing command buffers and stopping the timer is incorrect, which can lead to access to freed memory. The fix swaps the order to stop the timer before freeing buffers.

In the Linux kernel, the wifi libipw driver has an out-of-bounds read issue during TKIP frame verification. Short frames can cause length wrap and read past the buffer. The fix checks for the presence of a full MIC before verification and uses the MICHAEL_MIC_LEN constant.

In the Linux kernel, the wifi wcn36xx driver has a potential use-after-free (UAF) issue during TX ack timer teardown. The function timer_delete() does not wait for the callback to finish, which can lead to access to freed data. The fix uses timer_shutdown_sync() to ensure safe shutdown.

In the Linux kernel, the wifi wlcore driver has a runtime PM reference leak during regulatory domain configuration failure. The function does not release the reference after failure, which can lead to power management issues. The fix releases the reference after handling the command result.