Linux kernel vulnerabilities

In the Linux kernel's mt76 driver (mt7921 subsystem), there is a NULL pointer dereference vulnerability. The TXRX_NOTIFY event is handled on all buses, but the DMA queue cleanup function is only implemented for mmio buses, leading to a NULL call on USB and SDIO buses.

In the Linux kernel's mt76 driver (mt7925 subsystem), there is a NULL pointer dereference vulnerability. The TXRX_NOTIFY event is handled on all buses, but the DMA queue cleanup function is only implemented for mmio buses, leading to a NULL call on USB bus.

In the Linux kernel's brcmfmac driver, there is a double-free vulnerability of DMA buffers. The function releasing scratch buffers does not null the pointers after freeing, so when called multiple times (e.g., during reset and removal) it leads to freeing the same allocation again.

A vulnerability in the Linux kernel's ath12k WiFi driver causes a NULL pointer dereference during driver unbinding. Two hash tables are destroyed without checking if they were initialized, leading to a crash when device initialization fails, such as in VMs due to MSI addressing issues.

In the Linux kernel's staging rtl8723bs driver, there is an out-of-bounds read vulnerability in the rtw_get_wps_ie() function. The function processes IE data from network frames without validating that the header and payload fit within the buffer, which can lead to reading beyond memory.

A use-after-free vulnerability was found in the Linux kernel's Bluetooth subsystem (hci_sync). The issue stems from missing synchronization of the UUID list between asynchronous work and add_uuid/remove_uuid operations, potentially leading to reading freed memory.

A use-after-free vulnerability was found in the Linux kernel's Bluetooth RFCOMM subsystem. The rfcomm_tty_set_termios() function accesses the session without holding the proper lock, allowing the krfcommd thread to free the session while it is still in use, leading to memory corruption.

A vulnerability in the Linux kernel's transfer_args_to_stack() function in fs/exec.c involves unsigned long loop counter wrap. When bprm->p drops below PAGE_SIZE, the loop condition becomes always true, leading to out-of-bounds read and copying data from an invalid address to the process stack. The issue affects only CONFIG_MMU=n builds and can cause a system crash.

In the Linux kernel's binfmt_misc mechanism, the have_execfd flag is set before the interpreter is opened. If the interpreter open fails, the flag remains set, leading to a NULL pointer dereference in begin_new_exec() and a system crash.

In the Linux kernel for the LoongArch architecture, there is an initialization order bug: jump_label_init() is called after parse_early_param(), causing static key modifications in early param handlers to not work correctly. As a result, when memory allocation profiling is enabled and disabled via a boot parameter, the kernel fails to boot. The fix moves jump_label_init() before parse_early_param().

In the Linux kernel CD-ROM subsystem, there is a stack out-of-bounds read vulnerability in CDROMVOLCTRL. During processing, a 32-byte stack buffer is read beyond its boundary when the device returns a block descriptor. The fix reduces cgc->buflen by the same amount as the buffer pointer adjustment so the MODE SELECT transfer covers only the intended parameter list.

In the Linux kernel Stratix10 Service Layer firmware, there are bugs causing memory leaks and list corruption. The fix adds memory freeing on the error path, changes allocation from devm_kzalloc() to kzalloc() with explicit kfree(), and removes an erroneous list_del() that corrupted the list head.

In the Linux kernel comedi_parport driver, there is an issue with premature interrupts that can lead to a general protection fault. The fix changes the initialization order in parport_attach() so hardware registers are initialized before requesting the interrupt, and adds a test in the interrupt handler to ensure the comedi device is fully attached.

In the Linux kernel, the MEI bus cleanup has a concurrency issue where mei_device is accessed without proper locking, potentially leading to use-after-free. The fix protects queue cleanup and WARN traversal with the device lock and moves the traversal before dropping the bus reference.

In the Linux kernel, the Intel TH driver has a reference leak for MSC output devices. intel_th_output_open() takes a reference that is not released on file close, causing a memory leak on every MSC output open. The fix moves the reference drop to intel_th_msc_release().

In the Linux kernel, the NSM misc driver's nsm_dev_ioctl() can unlock a mutex that was never locked when copy_from_user fails before acquiring the lock, leading to a bad unlock balance warning. The fix returns immediately on pre-lock failure.

In the Linux kernel, the NSM misc driver does not set the owner field in file operations, so opening /dev/nsm does not take a module reference. If the driver is a module, an open file descriptor can survive rmmod, leading to calls into unloaded code. The fix sets owner to THIS_MODULE.

In the Linux kernel tracing subsystem, there is an issue with delayed module refcount for the 'enable_event' trigger. The module refcount is released immediately while trigger data may still be used after the RCU grace period, leading to use-after-free. The fix moves the module ref release into the delayed callback.

In the Linux kernel tracing subsystem, the mmiotrace read() function can dereference a NULL pointer when hiter->dev is not found (e.g., no PCI device). The fix adds a check for hiter->dev before dereferencing.

In the Linux kernel tracing subsystem, there is a resource leak when closing the trace_pipe file for mmiotrace. mmio_pipe_open() allocates resources that are not freed on close because the pipe_close callback was not set. The fix sets .pipe_close to mmio_close.

In the Linux kernel tracing subsystem, there is a union collision between the module pointer and refcnt in struct trace_event_call for dynamic events. When refcnt is non-zero, the module field is interpreted as a pointer, leading to invalid pointer dereference during event filtering. The fix checks the TRACE_EVENT_FL_DYNAMIC flag before using the module field.

In the Linux kernel, a vulnerability in the ublk subsystem was found where waiting on ub->completion instead of the actual device readiness (ublk_dev_ready()) can lead to a deadlock. If the ublk server sends END_USER_RECOVERY without a successful START_USER_RECOVERY, the device may be marked LIVE and the requeue list not kicked again, causing requests (e.g., flush_rq) to be stranded and blocking fsync and teardown.

In the Linux kernel for ARM64, huge_ptep_get() can be passed an unaligned virtual address, leading to incorrect determination of contiguous PTE count and potential out-of-bounds access, causing kernel panic. The fix aligns the pmdp pointer to the contpmd base before comparison.

A use-after-free vulnerability was found in the Linux kernel's mptcp_pm_userspace_get_local_id() function for MPTCP. The address entry is looked up under a spinlock, but its id is read after the lock is dropped, allowing a concurrent deletion to free the entry before the read. The issue was confirmed by a KASAN report.

In the Linux kernel, the afs_edit_dir_remove() function incorrectly uses afs_dir_find_block() instead of afs_dir_get_block() to get block 0. This may cause the page containing the block to be switched, leading to incorrect behavior.

In the Linux kernel, a vulnerability was found in the Btrfs filesystem related to data compression for data relocation inodes. During data relocation, when a relocation inode is written back under memory pressure, compression can cause an inline extent to be created, leading to an error in get_new_location() and a system crash.

In the Linux kernel, the vma_can_userfault() function did not reject registration of shadow stack and VM_SPECIAL VMAs, allowing registration of special memory areas via userfaultfd. The fix adds rejection of VM_SHADOW_STACK and VM_SPECIAL, except for hugetlb VMAs.

In the Linux kernel, the damon_set_regions() function did not validate ranges, allowing empty monitoring regions to be set. This may lead to WARN_ONCE() warnings and division by zero in damon_merge_two_regions(). The fix adds range validation.

In the Linux kernel, the damon_set_regions() function did not check whether input ranges are sorted and non-overlapping, which could lead to unexpected DAMON behavior, including creation of negative-size regions and division by zero. The fix restores validation of the assumptions.

A vulnerability was found in the Linux kernel's handling of device-private PMD entries during rmap walks. The bug causes these entries to be incorrectly treated as migration entries, potentially leading to memory corruption. Additionally, a race condition with PMD splitting can occur, worsening the issue.

In the Linux kernel, the SCTP protocol has a use-after-free vulnerability in the auth_enable sysctl during network namespace teardown. The sysctl registration was performed before the control socket was created, allowing access to a non-existent object. The fix moves sysctl registration to sctp_ctrlsock_init() and properly handles unregistration.

In the Linux kernel's libceph module, a NULL pointer dereference can occur during localized read selection when a CRUSH type name is missing. The fix skips such malformed parent buckets unless both bucket name and type name metadata are present.

In the Linux kernel's libceph module, a monmap with zero monitors was treated as valid, potentially leading to a client crash. The fix rejects such monmaps during decoding.

In the Linux kernel's libceph module, debugfs files were removed after the monitor client teardown, potentially leading to a use-after-free. The fix removes debugfs files before stopping the OSD and monitor clients.

In the Linux kernel's AMT module, delayed works could access the freed amt_dev structure after device removal. The fix uses disable_delayed_work_sync() in amt_dev_stop() to prevent re-queueing of works.

In the Linux kernel's binfmt_elf_fdpic module, there is a vulnerability where only the first PT_INTERP entry is supposed to be handled, but due to a loop logic error, binaries with multiple PT_INTERP entries overwrite interpreter_name and interpreter pointers, causing memory leaks and keeping a write denial on the file. An unprivileged user can exploit this to permanently block file writes.

A vulnerability in the Linux kernel's do_thaw_all() function in fs/super causes a double unlock of the s_umount semaphore during emergency thawing of frozen filesystems. This corrupts the rwsem state and triggers a DEBUG_RWSEMS warning, potentially destabilizing the system.

In the Linux kernel's forget_cached_acl() function, the ACL_DONT_CACHE state is not preserved, which for filesystems that opted out of ACL caching (e.g., FUSE) can lead to returning stale ACL values. The issue arises because forget_all_cached_acls() calls in FUSE code do not account for this state and remove it.

In the Linux kernel's fscrypt module, in find_or_insert_direct_key(), there is a missing comparison of the super_block pointer, causing entries in the global fscrypt_direct_keys table to be shared between different super_blocks. This can lead to a use-after-free when a key is evicted after the super_block's lifetime ends.

In the Linux kernel's fscrypt module, fscrypt_get_devices() uses dynamic allocation for an array of block device pointers, which can fail, especially during key eviction under direct reclaim. The unhandled failure leads to a use-after-free.

In the Linux kernel's ftrace module, the trace_parser structure is shared between threads during write and release operations, leading to a race condition on the idx, cont, and buffer fields. This can cause corrupted input or undefined behavior.

In the Linux kernel's iomap module, the functions ifs_set_range_dirty() and ifs_set_range_uptodate() have an out-of-bounds write vulnerability in bitmap_set() when the range length is zero. An underflow in last_blk calculation leads to huge values, causing a write beyond the allocated memory.

In the Linux kernel's slip module, slip_receive_buf() reads and writes through the rbuff pointer without holding the sl->lock, while sl_realloc_bufs() can change the buffer size. An MTU change can lead to an out-of-bounds write or use-after-free.

In the Linux kernel's geneve module, the function geneve_changelink() does not check for CAP_NET_ADMIN in the device's network namespace (dev_net(dev)), allowing a caller with privileges only in one namespace to modify a geneve device whose underlay operates in another namespace.

In the Linux kernel's net/af_iucv subsystem, there is a NULL pointer dereference vulnerability in afiucv_hs_callback_syn(). When child socket allocation fails, nsk is NULL, and the connection-refused path unconditionally calls iucv_sock_kill(nsk), leading to a crash. The fix only calls iucv_sock_kill() when a child socket was successfully allocated.

In the Linux kernel's net/iucv subsystem, there is a use-after-free vulnerability in handling severed iucv_path connections. The message_q queue holds raw pointers to the iucv_path, which is freed when the connection is severed, but notifications remain queued. Later recvmsg() uses the freed path, leading to a bug. The fix drops queued notifications when the path is severed.

A vulnerability in the Linux kernel's mlx5e driver can cause a system crash (NULL pointer dereference) during recovery after a PCIe DPC error. The issue occurs when the MPV_DEVCOM_MASTER_UP event is processed before the devcom pointer in mlx5e private data is initialized, leading to a NULL dereference. The fix uses the sender's devcom instead of the receiver's when marking the MPV component ready.

A vulnerability in the Linux kernel net/sched subsystem: qdisc_get_rtab() and qdisc_put_rtab() mutate the global qdisc_rtab_list and a non-atomic refcnt without locking, which is unsafe when called without RTNL (e.g., via cls_flower). This leads to a race condition, use-after-free, and double-free of the qdisc_rate_table structure.

In the Linux kernel's hip04 network driver, there is an RX buffer leak in hip04_rx_poll(). When build_skb() fails, the driver does not release the current buffer and DMA mapping, then overwrites slots, causing resource leak. The fix keeps the current slot intact and returns budget for NAPI to retry, and frees a newly allocated fragment on dma_map_single() failure.

In the Linux kernel's PTP subsystem for s390, there is a missing facility check. The physical clock is registered without verifying that facility 28 is installed and that PTFF QAF confirms PTFF QPT availability. The fix adds the missing check.