Linux kernel vulnerabilities

In the Linux kernel, the drm/i915/gem driver had a memory leak of the siblings[] array when an error occurred during processing of user extensions after a successful BALANCE/PARALLEL_SUBMIT extension on context creation. The fix addresses this leak.

In the Linux kernel, the drm/i915/gem driver had a NULL pointer dereference when setting an engine slot to I915_ENGINE_CLASS_INVALID and attempting to apply I915_CONTEXT_PARAM_SSEU to the same slot. The fix addresses this issue.

In the Linux kernel, the drm/i915/gt driver had a NULL pointer dereference when sched_engine allocation fails in execlists_create_virtual(). The fix avoids using intel_context_put() before intel_context_init(), preventing the dereference.

In the Linux kernel, the drm/i915/mst driver had an unbounded loop in intel_dp_check_mst_status() servicing interrupts from the sink, potentially getting stuck on stuck sink devices. An upper bound of 32 tries was added.

In the Linux kernel, the drm/gpusvm driver had a device mapping leak on error during page retrieval. The fix publishes dpagemap early so the error path can properly unmap those mappings.

In the Linux kernel, the ttm_pool_backup function in the DRM/TTM module did not account for NULL pages and pages that are backup handles. This caused invalid pointers to be passed to set_pages_array_wb(), leading to a general protection fault (oops) during memory reclaim operations.

In the Linux kernel, the drm/amdgpu driver's amdgpu_acpi_vfct_bios() fetched the VFCT table with acpi_get_table() but never released it, causing a mapping leak. The fix adds acpi_put_table() on all exit paths.

In the Linux kernel, the amdgpu driver has a bug where not all pending fences are force-completed during GPU reset for queues not in MAPPED state. This causes processes waiting on the fence to hang, potentially freezing the system.

In the Linux kernel, the amd/display driver has a bug where the new_stream pointer is not set to NULL after release. A later error can cause a double release and potential use-after-free.

In the Linux kernel, the amd/display driver for DCE8 ASICs has a bug where assigning a stream encoder for a second DisplayPort MST stream may select an analog encoder lacking DP hooks, causing NULL pointer dereference and system crash.

In the Linux kernel, the amdgpu driver has a bug where amdgpu_bo_create_reserved incorrectly increments pin_count on every call even when the BO already exists, leading to memory leaks as pin_count never drops to zero.

In the Linux kernel, the vc4 driver has a bug where the BO cache timer can be rearmed during teardown, leading to use-after-free or resource leaks.

In the Linux kernel, the gpusvm driver has a bug where an MM reference is not released on kvmalloc_array() failure in drm_gpusvm_range_evict, causing a reference leak.

In the Linux kernel, the airspy driver has a bug where buffers are not returned on start_streaming() failure, causing buffer leaks and WARN_ON warnings.

In the Linux kernel, the amlogic-c3 driver has a bug where missing validation of zones_num in AE and AWB config can lead to out-of-bounds access of the zone_weight buffer.

In the Linux kernel, the cedrus driver has a bug where invalid indices in H.264 reference lists can cause out-of-bounds reads of the DPB array. The fix skips such entries.

In the Linux kernel, the chips-media wave5 driver has a bug where a buffer can be returned to userspace before being removed from the ready queue, leading to list corruption and pointer poisoning.

In the Linux kernel, the cx231xx driver had a devres lifetime issue where resources were tied to the USB device instead of the interface, potentially causing memory leaks on driver unbind without physical disconnect.

In the Linux kernel, the cx23885 driver now checks the return value of pci_ioremap_bar() in cx23885_dev_setup(). If ioremap for BAR0 fails, it releases the allocated PCI memory region, decrements the device count, and returns -ENODEV.

In the Linux kernel, the i2c alvium driver fixed a critical pointer access issue in alvium_ctrl_init. The function created several controls and used the returned pointer without checking, which could lead to write access over NULL pointer. The fix adds pointer checks before adding flags.

In the Linux kernel, the mali-c55 driver fixed a possible ERR_PTR dereference in enable_streams. The function media_pad_remote_pad_unique() can return ERR_PTR on error, and the return value was assigned without checking, which could lead to ERR_PTR dereference. Added proper error checking with IS_ERR() before dereferencing and set remote_src to NULL on error.

In the Linux kernel, the meson vdec driver fixed a memory leak in the error path of vdec_open. Previously, when vdec_init_ctrls() failed, the m2m context was not released, causing a resource leak. Added an err_m2m_ctx_release label that calls v4l2_m2m_ctx_release() before releasing the m2m device.

In the Linux kernel, a vulnerability in the msi2500 driver (MSI2500 SDR receiver) causes queued vb2 buffers to leak when start_streaming() fails. Five error paths failed to return buffers to the vb2 framework, triggering WARN_ON and memory leaks. The fix consolidates error handling, ensuring all buffers are returned and the correct error code is propagated.

In the Linux kernel, the nuvoton npcm-video driver fixed memory leaks in probe and remove functions. The npcm_video structure was not freed on error paths or in npcm_video_remove(), and the reserved memory association was not released when npcm_video_setup_video() failed.

In the Linux kernel, the nxp imx8-isi driver added missing v4l2_subdev_cleanup() calls in crossbar and pipe cleanup paths. Initialization functions allocated subdev active state, but it was not freed, causing a memory leak on every rmmod.

In the Linux kernel, the nxp imx8-isi driver fixed potential out-of-bounds issues. The maximum downscaling factor supported by ISI can be up to 16. Added a minimum value constraint before applying the setting to hardware to prevent the process from becoming unresponsive.

In the Linux kernel, the pci dm1105 driver fixed a memory leak by destroying the allocated workqueue in the remove() callback. Previously, the workqueue resources were not freed, causing a memory leak.

In the Linux kernel, the pwc driver (USB camera) has a buffer leak during start_streaming() failure. When the first URB is submitted, its completion handler can move a buffer to fill_buf, and the error path does not free that buffer, leading to a WARN_ON and memory leak.

In the Linux kernel, the pwc driver (USB camera) has a buffer leak during start_streaming() failure. When start_streaming() returns an error without returning buffers via vb2_buffer_done(), a WARN_ON is triggered and queued buffers leak.

In the Linux kernel, the radio-si476x driver has a reference leak on probe failure. If V4L2 registration succeeds but later steps fail, the v4l2_device is not unregistered, leading to a leak.

In the Linux kernel, the rtl2832 driver (DVB-T tuner) has a use-after-free during device removal. A delayed work can be rescheduled after cancellation, leading to use after memory free.

In the Linux kernel, the rtl2832_sdr driver has a vulnerability causing vb2 buffer leak on start_streaming() failure. If the function returns an error without returning buffers, WARN_ON triggers and queued buffers leak. The issue affects multiple error paths, including subdev, tuner, ADC, buffer and URB allocation failures.

In the Linux kernel, the saa7134 driver (TV card) has a possible memory leak in saa7134_video_init1. Missing return value checks for saa7134_pgtable_alloc() and not freeing memory on vb2_queue_init() error lead to leaks and potential use of uninitialized DMA resources.

In the Linux kernel, the stm32-dcmipp driver (camera) has a buffer leak during start_streaming() failure. When start_streaming() returns an error without returning buffers, a WARN_ON is triggered and queued buffers leak.

In the Linux kernel, the stm32 dcmi driver (camera) has a notifier leak on probe failure. If notifier registration succeeds but later steps fail, the notifier is not unregistered, leading to a leak.

In the Linux kernel, the sun4i-csi driver (camera) has a buffer leak during start_streaming() failure. When start_streaming() returns an error without returning buffers, a WARN_ON is triggered and queued buffers leak.

In the Linux kernel, the ti vpe driver has an error code bug for devm_kzalloc(). Using PTR_ERR_OR_ZERO() returns 0 for NULL pointer, masking the memory allocation failure.

In the Linux kernel, in the VPE driver for TI platforms, there is an issue where if the vpe_top resource is missing, vpe_probe() returns -ENODEV after v4l2_device_register() has succeeded. Since probe failures do not call the driver's remove callback, the v4l2 device remains registered on that error path.

In the Linux kernel, in the V4L2 control mechanism (v4l2-ctrls), there is a lack of validation for active L0/L1 reference counts for HEVC slice parameters. The common validation path does not verify these values before driver-specific code consumes them, which can lead to incorrect behavior.

In the Linux kernel, in the v4l2_async_register_subdev_sensor() function, there is an issue with overwriting the subdev owner. The v4l2_async_register_subdev() macro expands to __v4l2_async_register_subdev(sd, THIS_MODULE), but since it is called inside v4l2-fwnode.c, THIS_MODULE resolves to the v4l2-fwnode module rather than the sensor driver module. When v4l2-fwnode is built-in, THIS_MODULE evaluates to NULL, which overwrites the sensor driver's owner with NULL.

In the Linux kernel, in the vivid driver, there is a missing check for vb2_is_busy() when toggling capabilities. The vivid_update_format_cap/out() functions can be called when the capture/output queue is not busy, but for controls that select CROP/COMPOSE/SCALE capability, this check is not performed. This can lead to unexpected results when the format is changed between REQBUFS and STREAMON.

In the Linux kernel, in the vivid driver, there are cleanup bugs in vivid_init(). When platform_device_register() fails, the embedded struct device in vivid_pdev has already been initialized, but the failure path does not drop the device reference, leading to a reference leak. Additionally, the unreg_driver label incorrectly calls platform_driver_register() instead of platform_driver_unregister(), breaking cleanup when workqueue creation fails after successful driver registration.

A vulnerability was found in the Linux kernel's ALSA sequencer subsystem. The issue is that the queue deletion function does not close a re-opened timer, leading to a use-after-free condition. An attacker with access to /dev/snd/seq can exploit this flaw to corrupt kernel memory.

In the Linux kernel, in the ALSA timer subsystem, there is an issue with draining slave callbacks before the master detaches them. When a master instance is closed, remove_slave_links() clears each slave's ->timer, and the slave's own close then skips the drain entirely, which can lead to use-after-free if the slave's callback is still running.

In the Linux kernel, in the ALSA timer subsystem, there is an issue with re-entering an instance callback that is still running. The userspace-driven timer (utimer) TRIGGER ioctl calls snd_timer_interrupt() directly with no serialization, so two threads can run snd_timer_interrupt() on the same timer concurrently. The SNDRV_TIMER_IFLG_CALLBACK bit cannot represent two concurrent callbacks, leading to use-after-free.

In the Linux kernel, in the wifi ath6kl driver, there is an out-of-bounds (OOB) access issue caused by the firmware-supplied ADDBA window size. The aggr_recv_addba_req_evt() function logs a debug message when win_sz is out of range but does not return. The out-of-range win_sz is then used to compute an allocation size, leading to zero-size or overflowed allocations and subsequent out-of-bounds access.

In the Linux kernel, in the wifi ath6kl driver, there is a use-after-free issue in the aggr_reset_state() function. The function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_destroy(). If the timer callback is executing at that time, it may access freed memory.

In the Linux kernel's mwifiex driver, there is a NULL pointer dereference vulnerability. When an access point (AP) advertises HT Capabilities but lacks the HT Operation element, the driver attempts to read a non-existent bcn_ht_oper pointer during TDLS link setup, causing a system crash.

In the Linux kernel's wilc1000 driver, there is an out-of-bounds read vulnerability when processing association responses. The driver does not validate that the frame length is sufficient to contain the header, which can lead to reading beyond the buffer or length wrap-around.

In the Linux kernel's mt76 driver (mt7615 subsystem), there is a NULL pointer dereference vulnerability. The TXRX_NOTIFY event is handled on all buses, but the DMA queue cleanup function is only implemented for mmio buses, leading to a NULL call on USB and SDIO buses.