Linux kernel vulnerabilities

In the Linux kernel's Intel ice network driver, there is a bug in PTP handling during driver release. When a PF reset occurs in ICE_PTP_UNINIT state, ice_ptp_rebuild() changes the state to ICE_PTP_ERROR, leading to a BUG in list_debug.c during release. The fix detects ICE_PTP_UNINIT and does not transition to ICE_PTP_ERROR, preventing the crash.

A vulnerability in the Linux kernel causes a deadlock during emergency thaw of frozen block devices. The do_thaw_all_callback() function calls bdev_thaw() while holding sb->s_umount, which leads to re-acquiring the same lock by the same task when the last freeze reference is dropped, resulting in a system hang.

In the Linux kernel RBD driver, a positive result code in a reply to an object map update is not reset to zero, which can trigger an assertion and crash the system. The fix resets the positive result code to zero and adds a WARN_ON_ONCE.

In the Linux kernel ksmbd module, destroy_previous_session() is called before NTLMv2 validation, allowing an authenticated attacker to destroy another user's session. The fix moves the call after validation and uses the verified user.

In the Linux kernel gve driver, a page allocation failure during Rx buffer refill can cause a permanent queue stall. The fix introduces a recovery timer that periodically reschedules NAPI when the buffer count falls below a threshold.

In the Linux kernel ice driver, missing validation of ptype in ice_parser_profile_init allows a malicious VF to write past the bitmap, causing a page fault. The fix rejects out-of-range ptype values.

In the Linux kernel mac802154 subsystem, the scan worker does not hold a reference to the network interface, which can lead to use-after-free during concurrent interface deletion. The fix adds netdev_hold() and releases the reference at every exit.

In the Linux kernel mac802154 llsec subsystem, missing validation of frame length relative to authentication tag length leads to passing a huge value to AEAD and out-of-bounds read. The fix rejects frames shorter than the tag.

In the Linux kernel ovpn module, in TCP error paths, a peer reference leak can occur when schedule_work() returns false. The fix checks the return value and drops the extra reference.

In the Linux kernel, pppoe_sendmsg() saves a pointer to the PPPoE header before calling dev_hard_header(), which may reallocate the skb head and invalidate the pointer. Under certain conditions, this can lead to a write through a stale pointer into freed memory. The fix reloads the pointer after device header creation.

A vulnerability in the Linux kernel's rtase driver can cause TX hangs due to hardware packet parsing errors. Incomplete IPv4, IPv6, TCP, or UDP headers, as well as PTP packets with short transport data, may trigger this issue. The driver applies workarounds such as dropping malformed packets and padding transport data.

In the Linux kernel, in tcp_v4_send_ack() and tcp_v6_send_response(), when constructing standalone TCP responses with TCP-AO options, the alignment padding bytes after the MAC are left uninitialized and may be transmitted. The fix initializes only the padding in the TCP-AO branches before hashing the header.

In the Linux kernel, in tcp_check_req() in the SYN-RECEIVED state, a non-exact RST (not matching RCV.NXT) is accepted and removes the request instead of triggering a challenge ACK as per RFC 9293. The fix adds the RFC 5961 reset check before ACK-field validation to enforce challenge ACK for non-exact RSTs.

In the Linux kernel, a vulnerability in the VXLAN module causes corruption of the MDB source list during a failed replace operation. Due to improper error handling, existing source entries are deleted, leading to incorrect behavior of EXCLUDE and INCLUDE filters, causing unauthorized traffic or blocking of legitimate traffic.

In the Linux kernel, in the AMDGPU graphics driver for GFX10 generation, BUG_ON() macros have been replaced with WARN_ON() to avoid kernel crashes on errors. The fix is from a cherry-picked commit.

In the Linux kernel, in the AMDGPU graphics driver for GFX12.1 generation, BUG_ON() macros have been replaced with WARN_ON() to avoid kernel crashes on errors. The fix is from a cherry-picked commit.

In the Linux kernel, in the AMDGPU graphics driver for GFX12 generation, BUG_ON() macros have been replaced with WARN_ON() to avoid kernel crashes on errors. The fix is from a cherry-picked commit.

In the Linux kernel, in the AMDGPU graphics driver for GFX9.4.3 generation, BUG_ON() macros have been replaced with WARN_ON() to avoid kernel crashes on errors. The fix is from a cherry-picked commit.

In the Linux kernel, the amdgpu driver for GFX9 replaced BUG_ON() with WARN_ON(). Previously, invalid conditions caused a system crash; now they only generate a warning.

In the Linux kernel, the amdgpu driver for SDMA 4.4.2 replaced BUG_ON() with WARN_ON(). Previously, invalid conditions caused a system crash; now they only generate a warning.

In the Linux kernel, the amdgpu driver for SDMA 7.1 replaced BUG_ON() with WARN_ON(). Previously, invalid conditions caused a system crash; now they only generate a warning.

In the Linux kernel, the amdgpu driver (VCE) fixed an integer overflow in image size calculation. Malicious VCE command streams with oversized dimensions (e.g., 65536×65536) caused the buffer size to wrap to 0, bypassing validation and allowing out-of-bounds memory access by GPU firmware. The fix uses 64-bit arithmetic and rejects invalid dimensions.

In the Linux kernel, the amdgpu driver (VCN4) avoids rereading the IB parameter length. Instead, it uses the value returned by vcn_v4_0_enc_find_ib_param(), eliminating a potential TOCTOU issue if the IB contents change between reads.

In the Linux kernel, the amdgpu driver fixed a division by zero with invalid UVD dimensions. When width or height is less than 16, width_in_mb or height_in_mb becomes 0, leading to division by zero in H264 and H264 Perf decode paths. Added validation to reject frames with dimensions smaller than 16.

In the Linux kernel, the amdgpu driver fixed a kernel panic during driver load failure. Previously, when MES initialization failed, the KIQ ring was falsely marked as ready, leading to a NULL pointer dereference and kernel panic.

In the Linux kernel, the amdgpu driver fixed a memory management issue: before freeing acp_genpd memory, pm_genpd_remove() is called to unregister from the global list, and the pointer is cleared after free.

In the Linux kernel, the amdgpu driver fixed an issue with doorbell mapping. Previously, xa_store_irq() allowed a newly created queue to overwrite an existing doorbell mapping, potentially causing misrouting of fence IRQ processing or erasing another queue's mapping. The fix uses xa_insert_irq(), which rejects mapping a reserved doorbell to a new queue.

In the Linux kernel, the amdgpu driver fixed an aperture mapping leak. Previously, during normal driver unload, iounmap() was not called, leaving an orphaned entry in the PAT tree. On reload, this caused a WC vs WB conflict and initialization failure. The fix uses devres-managed mappings, guaranteeing cleanup.

In the Linux kernel, the ksmbd (SMB server) module has a vulnerability due to missing validation of the num_subauth field when copying ACE entries in the set_ntacl_dacl function. A malicious authenticated client can send a crafted security descriptor with an invalid num_subauth value, leading to an out-of-bounds heap read of approximately 1 KB.

In the Linux kernel, ksmbd has an issue with restoring DACL size on check_add_overflow() to avoid malformed ACL. check_add_overflow() writes the truncated sum even on overflow, and this value is later used to compute the size, causing under-reporting and potential out-of-bounds reads.

In the Linux kernel, ksmbd has an issue with bounding the DACL dedup walk to copied ACEs. When copying ACEs stops early due to size overflow, the number of ACEs reflects only copied ones, but set_posix_acl_entries_dacl() still uses the original count, leading to scanning beyond the copied array.

In the Linux kernel, ksmbd has an issue with validating ACE size against SID sub-authorities. set_ntacl_dacl() does not verify that the declared ACE size contains all sub-authorities, leading to copying undersized ACEs and later out-of-bounds reads during deduplication.

A deadlock was found in the Linux kernel audit subsystem when duplicating executable-related rules. The issue occurs during file rename operations when an active audit rule matches the moved file — audit_dupe_exe() attempts to re-acquire the parent directory lock (I_MUTEX_PARENT) already held by the rename operation, causing a recursive locking deadlock. The patch introduces struct audit_watch_ctx to pass the fsnotify event context and avoid redundant path resolution.

In the Linux kernel, fuse-uring has a race between registration and connection abortion. This can lead to a hang of the abort/unmount thread, as nothing will decrement queue_refs or wake stop_waitq.

A vulnerability in the Linux kernel's sched_ext mechanism was found where dispatch_to_local_dsq() can switch rq queues without updating the current rq tracking, leading to a lockdep assertion failure and potential critical error. The issue concerns maintaining consistency between rq locks and their tracking during nested ops.dequeue() calls.

In the Linux kernel, a vulnerability in the KVM subsystem for AMD processors (SVM) causes an ASID collision after a CPU hotplug cycle. If a vCPU stays scheduled out while its last pCPU goes through online->offline->online, it may resume with an ASID already assigned to another vCPU, leading to stale TLB translations. The issue manifests as a KVM internal error (Suberror: 1) and emulation failure for FPU/XSave instructions.

In the Linux kernel, time/jiffies has an issue with registering the jiffies clocksource before usage. Using it before registration leaves max_delta_raw at zero, causing time not to progress, leading to long boot delays in XEN HVM systems.

In the Linux kernel, the Wacom HID driver has an issue where after starting HID hardware, but before registering input devices and initializing LEDs, failures can occur. In such cases, driver resources are released without stopping the HID hardware, potentially leading to an incorrect state. The fix routes post-start failures through hid_hw_stop() before releasing resources.

A vulnerability in the Linux kernel's debugobjects mechanism allows a race condition during concurrent OOM disable. This can cause debug_object_assert_init() and debug_object_activate() to invoke fixup callbacks even when debugging is disabled, leading to malfunctioning timers (e.g., hrtimer).

In the Linux kernel, the IIO subsystem has an issue with uninitialized data in debugfs. If the *ppos argument is non-zero, simple_write_to_buffer() does not initialize the start of the buffer, potentially leading to exposure of uninitialized data. The fix adds a check at the beginning of the function and returns -EINVAL for non-zero *ppos values.

In the Linux kernel, the USB gadget RNDIS function lacks a length check in the response query. Variables for BufLength and BufOffset were added in rndis_query_response() and a length check is performed on them, similar to rndis_set_response().

In the Linux kernel, the Wacom HID driver has an issue with using GFP_KERNEL in wacom_wac_queue_flush(), which is called in atomic context (from the raw_event callback). This can lead to a "scheduling while atomic" bug. The fix changes the allocation to GFP_ATOMIC, and the existing code already handles allocation failure.

In the Linux kernel, the Bluetooth hci_uart driver did not clear the HCI_UART_SENDING bit when canceling write_work, which blocked future writes after reopening the device. The fix clears this bit and safely cancels the work using disable_work_sync and enable_work.

In the Linux kernel, the staging vme_user driver for the tsi148 bridge leaks the location monitor resource when the device is unbound or the module is unloaded. The tsi148_remove() function does not free the lm_resources list, leading to a memory leak.

In the Linux kernel, a vulnerability in KVM nVMX was fixed where vmcs12 pages were not released when nested VM-Enter failed due to invalid guest state. This caused a leak of pinned pages or mappings if L1 retried VMLAUNCH/VMRESUME.

In the Linux kernel, a vulnerability in the Safe-RET mechanism allows an attacker to inject interrupts during Safe-RET execution on machines affected by SRSO, potentially neutralizing the safe return sequence and leading to data leakage through speculative execution. The fix emulates register state as if the Safe-RET sequence executed successfully and avoids executing a RET instruction after returning from the interrupt.

In the Linux kernel, a vulnerability was found in KVM/VMX where vmx_update_cr8_intercept called get_vmcs12() without checking if the vCPU is in guest mode. This caused a lockdep warning and potential issue during vCPU creation. The fix restricts get_vmcs12() call to guest mode only, with no functional change.

In the Linux kernel, the intel-hid driver has a race condition in ACPI notify handling. When two tablet-mode events occur concurrently on different CPU cores, the input device may be registered twice, leading to a duplicate sysfs entry and a subsequent NULL pointer dereference.

In the Linux kernel, the spear_adc driver initializes a completion structure after registering the interrupt handler. If an interrupt arrives before initialization, the handler calls complete() on an uninitialized structure, causing a kernel panic due to a wild pointer dereference.

In the Linux kernel, the ALSA us144mkii driver's capture_urb_complete() calls usb_anchor_urb() on every completion callback, even though the URB is already anchored. This corrupts the anchor's doubly-linked list and inflates the URB refcount, leading to a use-after-free when the stream is stopped.