Linux kernel vulnerabilities

A vulnerability in the Linux kernel crypto driver for Amlogic SoCs (meson_crypto_probe) causes a double cleanup on allocation failure, leading to a slab-use-after-free in kthread_destroy_worker. This can be triggered by a malicious module or reproducer, potentially causing memory corruption.

In the Linux kernel, the smb2_aead_req_alloc() function has an error code bug: the *num_sgs variable is u32, so ERR_PTR(*num_sgs) does not work correctly. This can lead to returning an invalid error pointer, which when dereferenced causes a system crash.

In the Linux kernel, the init_pseudo() function does not set the SB_I_NOEXEC and SB_I_NODEV flags by default. This causes a warning in path_noexec() when mapping anonymous-inode files (e.g., dma-buf) on kernels with CONFIG_DEBUG_VFS=y, and also allows executable mappings of such files, violating a security invariant.

In the Linux kernel, the HID hid-lenovo-go driver's hid_go_cfg_remove() does not cancel the delayed work go_cfg_setup, which may run after the HID device is destroyed. This leads to a use-after-free of the drvdata.hdev pointer, potentially causing a system crash.

A vulnerability in the Linux kernel USB gadget f_fs (FunctionFS) driver was found. An uninitialized work_struct reset_work is used during filesystem unmount, leading to a WARN_ON warning and potential operational issues. The problem occurs when a FunctionFS instance is mounted without the "no_disconnect" option or unmounted without prior deactivation.

A vulnerability in the Linux kernel's Btrfs filesystem leads to a NULL pointer dereference during trim operations (fstrim). The issue occurs when a device previously marked as missing is re-scanned, which clears the MISSING flag but does not update the bdev pointer, leaving it NULL. This results in a kernel crash when attempting to trim such a device.

In the Linux kernel on RISC-V, there is a vulnerability where the sfence.vma instruction is not executed on spurious page faults. This can lead to a repeated fault and a system crash if the page does not become valid within the expected timeframe.

In the Linux kernel, the Intel IOMMU (vt-d) driver triggers a WARNING during SVA unbind on devices without PCI/PRI support. The unbind path attempts to disable IOPF even though it was never enabled, causing an imbalance and a WARNING in intel_iommu_disable_iopf().

In the Linux kernel, the udmabuf driver causes a spurious DMA-API warning about overlapping cacheline mappings when CONFIG_DMA_API_DEBUG_SG is enabled. The issue occurs when importing a udmabuf into a DRM driver (e.g., amdgpu) and results from double mapping of the same pages. The fix passes DMA_ATTR_SKIP_CPU_SYNC to skip redundant CPU sync and suppress the warning.

In the Linux kernel's I2C subsystem, there is a vulnerability causing a NULL-pointer dereference on adapter registration failure. If registration fails, the release callback attempts to access an uninitialized completion structure, leading to a crash.

In the Linux kernel's FUSE-uring subsystem, there are data races on the ring->ready field. On weakly-ordered architectures, the store to fiq->ops can be reordered before the store to ring->ready, potentially leading to use of a stale fiq->ops pointer. Additionally, the fast-path read of ring->ready is unmarked, which KCSAN may flag.

In the Linux kernel's ARC EMAC ethernet driver, there is a vulnerability where interrupts are not quiesced before requesting IRQ. This may allow stale or latched interrupts to be delivered during teardown, leading to a race with net_device release.

In the Linux kernel's esd_usb CAN driver, there is a vulnerability where anchored URBs are not killed before freeing netdevs. This causes a use-after-free during device disconnect, as private data is freed before attempting to kill the URBs.

In the Linux kernel's USB gadget f_midi driver, a use-after-free vulnerability exists because the midi->work work item is not canceled before the f_midi object is freed. This allows the work handler to run after memory has been released. The issue was found by an in-house static analysis tool.

In the Broadcom BDC UDC driver in the Linux kernel, there is a use-after-free and NULL pointer dereference vulnerability. Interrupt handling and delayed work can execute after memory structures are freed during driver removal, potentially leading to system crash or code execution.

In the Linux kernel, the RDMA/rxe subsystem has a use-after-free vulnerability in rxe_mmap. The issue arises because the rxe_mmap_info structure is removed from the pending_mmaps list and the lock is released before remap_vmalloc_range completes, allowing a concurrent DESTROY_CQ ioctl to free memory during mapping. This can lead to a kernel crash (GPF) or a page-level use-after-free.

A vulnerability in the Linux kernel's xfrm_user_policy() function causes a double-free of sk_dst_cache. The issue occurs when a per-socket policy change for a connected UDP socket races with a send, leading to double release of a reference and use-after-free.

In the Linux kernel, xfrm6_fill_dst() has a double netdev_put issue. On the error path where in6_dev_get(dev) returns NULL, the function releases the device reference with netdev_put() but leaves xdst->u.dst.dev set. Later dst_destroy() calls netdev_put(dst->dev) again, causing double release and refcount underflow, leading to warnings and potential network issues.

A vulnerability in the Linux kernel's XFRM module related to IPsec policies has been found. An error in xfrm_hash_rebuild() causes incorrect preallocation for inexact policies, which under memory pressure can lead to a general protection fault (GPF) and kernel panic.

In the Linux kernel, the ksmbd (SMB2 server) module has a vulnerability involving an out-of-bounds read (slab-out-of-bounds). During validation of compound (chained) SMB2 requests, ksmbd_smb2_check_message() reads the StructureSize2 field without first checking that the compound element is large enough. A remote client can craft a request whose last element is exactly 64 bytes, causing a 2-byte read past the receive buffer.

In the Linux kernel, gtp1u_send_echo_resp() ignores the return value of skb_pull_data(). When an echo request is 16-19 bytes, the call fails and returns NULL, but execution continues, leading to skb_under_panic() and kernel panic. The fix is to drop the packet when skb_pull_data() fails.

In the Linux kernel, nh_res_bucket_migrate() uses an uninitialized netlink_ext_ack. When notifier initialization fails, the error path formats a pointer to uninitialized memory, potentially leading to a kernel panic.

In the Linux kernel, BPF for TCP has a double socket release issue during batch realloc in bpf_iter_tcp_batch(). On realloc failure, the function returns an error but leaves cur_sk/end_sk stale, leading to a second call to bpf_iter_tcp_put_batch() and dereferencing a cookie as a sock pointer. The fix empties the batch on the failure path to avoid double release.

In the Linux kernel's mac80211 subsystem, a use-after-free vulnerability exists during WiFi link updates. When drv_change_vif_links() fails, newly created debugfs entries are not removed, leaving dangling pointers to freed memory. A subsequent read of these files (e.g., link-1/txpower) can trigger memory corruption and kernel panic.

In the Linux kernel's Bluetooth qca driver (btqca), a vulnerability was found involving an integer underflow in the TLV parser. When the NVM tag length is less than 12 bytes, the loop boundary calculation wraps to a huge value, causing out-of-bounds reads and writes (vmalloc-out-of-bounds).

In the Linux kernel, in fib_table_insert(), a new fib_alias is published before calling fib entry notifiers. When a notifier fails, the alias is removed and freed immediately, while a concurrent lookup may still be using it, leading to use-after-free. The fix is to free the alias with kfree_rcu(), as fib_table_delete() already does.

In the Linux kernel, the p54 WiFi driver has a vulnerability in p54_rx_eeprom_readback() due to missing validation of the RX frame length. A malicious USB device can send a short frame that passes the length check but has truncated payload, leading to an out-of-bounds read and memory disclosure.

In the Linux kernel, in ieee80211_set_fils_discovery(), the old template is freed via kfree_rcu() before allocating the replacement. If the allocation fails, the function returns -ENOMEM while the pointer still points to the object already queued for freeing, leading to a double-free on later update or AP teardown. The fix is to queue the old object for kfree_rcu() only after the new one is published.

A vulnerability in the Linux kernel's MPLS module affects builds without IPv4 support (CONFIG_INET=n). The mpls_valid_fib_dump_req() function does not check for the presence of the RTA_OIF attribute before using it, leading to a NULL pointer dereference during MPLS route dumps. An unprivileged user can trigger this by sending a crafted RTM_GETROUTE request for AF_MPLS with strict checking enabled.

In the Linux kernel's mac80211 subsystem, there is a double-free vulnerability in ieee80211_set_unsol_bcast_probe_resp(). When allocation of a new template fails, the old object is already queued for freeing while the pointer still references it, leading to a second free and a KASAN error.

In the Linux kernel, a vulnerability in Btrfs free space cache (v1) lacks validation of entry counts in the on-disk header. Loading a crafted cache with excessive entries can cause an out-of-bounds read past the allocated pages array, leading to memory corruption and potential general protection fault.

In the Linux kernel, the ims-pcu driver has a heap-buffer-overflow vulnerability in ims_pcu_process_data(). The function processes URB data byte by byte but fails to check if the read_pos index exceeds the buffer size. A malicious USB device can send a packet larger than the buffer size, allowing overwrite of read_pos and control of the index, leading to heap buffer overflow and control flow hijack.

In the Linux kernel's rhashtable library, there is a use-after-free vulnerability during table restart. When the table is freed during resize, the iterator does not clear iter->p, leading to a dereference of freed memory in rhashtable_walk_next(). This affects netlink_diag and TIPC.

In the Linux kernel, KVM nVMX has a vulnerability where the shadow VMCS is freed while vmcs01 still points to it. Due to asynchronous VMCLEAR, the vCPU may migrate before the pointer is cleared, leading to VMCLEAR on freed memory. The fix hides the shadow VMCS only after explicit VMCLEAR completes.

In the Linux kernel, KVM x86 has an issue where the check for invalid/obsolete root occurs before making MMU pages available for the shadow MMU. If reclaiming shadow pages zaps an in-use root, KVM may map memory into an invalid root, violating the invariant that invalid pages are never on the active MMU list. The fix moves the check after making MMU pages available.

In the Linux kernel, the fast PIO handling in KVM was improved by replacing emulator_pio_in() with a direct call to __emulator_pio_in(). No functional change.

A use-after-free (UAF) vulnerability was discovered in the Linux kernel's POSIX CPU timers mechanism. The issue arises from a race condition during a non-leader exec() call, potentially leading to access of a freed timer object.

In the Linux kernel, the s390/pkey driver lacked a length check in the PKEY_VERIFYPROTK ioctl. The vulnerability allows user-space to supply a request structure exceeding the buffer size, potentially leading to a buffer overflow.

In the Linux kernel, the s390/pkey driver lacked a length check for the target buffer in the pkey_pckmo handler for key_to_protkey(). If the generated output exceeds the buffer length, the function fails, but without proper validation it could lead to a buffer overflow.

In the Linux kernel's Bluetooth L2CAP stack, a use-after-free vulnerability exists in l2cap_sock_new_connection_cb(). After releasing the parent lock, a child socket can be accepted and freed by another thread before dereference, leading to use-after-free.

In the Linux kernel, a vulnerability was found in the perf event group management. Removing events via perf_event_remove_on_exec() can leave an inconsistent group state when a group leader is removed while sibling events remain active. This corrupts the PMU context active list and can cause a double list addition.

In the Linux kernel, KVM for ARM64 in kvm_hyp_handle_mops() lacks translation of the synthetic SPSR_EL2 value before writing to hardware in nested virtualization. This causes incorrect SPSR_EL2 restoration.

In the Linux kernel, a use-after-free vulnerability was found in the br_ip6_fragment() bridge function. The prevhdr pointer becomes stale after skb_checksum_help() reallocates the skb head, leading to a write to freed memory.

In the Linux kernel, the psample module's open-coded nla_put() for PSAMPLE_ATTR_DATA misses clearing the pad, potentially leaking information via unzeroed padding bytes in the Netlink message.

In the Linux kernel, the virtio-net driver's receive_big() function checks the device-announced length too loosely, allowing a malicious virtio backend to write out-of-bounds past the frag array in skb. This can lead to NULL pointer write and potential exploitation.

In the Linux kernel, the rmnet driver (Qualcomm) lacks MAP frame length validation before parsing in the non-aggregation path. A short frame can lead to out-of-bounds buffer read, exploitable by a malicious device or attacker.

In the Linux kernel, the Bluetooth bpa10x driver's bpa10x_setup() reads the revision string from device response without length checking, leading to out-of-bounds buffer read. Unterminated or short responses leak adjacent kernel memory to logs and debugfs.

In the Linux kernel, BPF sockmap's bpf_msg_push_data() lacks overflow check when adding copy + len, leading to undersized allocation and out-of-bounds write. An attacker with BPF privileges can exploit this to corrupt memory.

In the Linux kernel, the net1080 USB network driver's net1080_rx_fixup() reads a pad byte before checking frame length, allowing a malicious NetChip 1080 device to cause out-of-bounds buffer read by sending a short frame with a large packet_len.

In the Linux kernel, DRM EDID's drm_parse_tiled_block() reads the full displayid_tiled_block structure without checking block length, leading to heap out-of-bounds read. A crafted EDID with a small tiled-display block can cause data leak.