Linux kernel vulnerabilities

A vulnerability in the Linux kernel's VXLAN driver allows dynamic FDB entries to reference a nexthop ID, which is invalid and can lead to list corruption, race conditions, and use-after-free. The fix rejects such entries during creation and update.

In the Linux kernel, an unbounded tx_queue_len allowed an unprivileged user (via unshare -Urn) to set a huge value and exhaust global memory through ring buffer allocations in the pfifo_fast, tun, and tap subsystems. The vulnerability was fixed by capping tx_queue_len at S16_MAX (32767) in netif_change_tx_queue_len(), rejecting oversized values at set time.

A vulnerability was found in the Linux kernel's network interface creation and modification mechanism. The IFLA_TXQLEN attribute (txqueuelen) was not properly limited to S16_MAX during netlink parsing, allowing an oversized transmit queue length to be set. This led to excessive memory allocations in pfifo_fast, tun, and tap modules, which could be exploited by an unprivileged user in a namespace.

In the Linux kernel, the pds_core driver has a cmd_regs access race during BAR unmap on reset. pdsc_reset_prepare() and the pdsc_map_bars() error path in pdsc_reset_done() clear/iounmap cmd_regs without devcmd_lock, and the download loop in pdsc_legacy_firmware_update() dereferences cmd_regs after dropping and retaking the lock without re-checking; an FLR concurrent with a devlink flash can unmap cmd_regs under an in-flight devcmd, causing a NULL deref or a write to unmapped MMIO.

In the Linux kernel, the BPF verifier failed to mark the underlying scalar register as precise in two cases: when a helper argument is NULL (check_func_arg) and when the second parameter of bpf_get_local_storage() is zero (check_helper_call). As a result, a checkpoint created on such a path could be pruned against an arbitrary scalar value, leading to incorrect BPF program verification.

In the Linux kernel, mctp_i3c_probe() dropped busdevs_lock after finding the matching bus, allowing a concurrent I3C_NOTIFY_BUS_REMOVE to unregister and free the bus netdev before probe passed its private data to mctp_i3c_add_device(). This resulted in a use-after-free through the freed mbus pointer.

In the Linux kernel, an RTM_NEWQDISC request could make clsact bind a populated shared ingress block during ->init(), publishing an embedded mini_Qdisc to lockless readers. If the same request had an invalid TCA_RATE, estimator setup failed after ->init(), and the unwind synchronously freed the containing qdisc while tc_run() might still hold it, leading to a use-after-free.

In the Linux kernel, the net/mlx5e driver's sample_restore_put() could re-read restore->count after dropping restore_lock during concurrent teardown of TC sample rules sharing the same restore context. At that point another thread may have already completed cleanup and freed the restore object, leading to a use-after-free.

In the Linux kernel, mlx5_eswitch_termtbl_put() read tt->ref_count after termtbl_mutex was released. Two concurrent callers on the same mlx5_termtbl_handle raced: one decremented ref_count to zero, removed the hash entry, and called kfree(tt), while the other had already dropped the mutex and was about to evaluate if (!tt->ref_count), producing a use-after-free.

In the Linux kernel, fq_pie_change() accepted any quantum value from userspace, including 1. With a crafted size table qdisc_pkt_len reached ~2 GiB, so quantum=1 made the deficit-refill loop spin ~2^31 times under the qdisc lock, causing a soft lockup and denial of service.

In the Linux kernel, sfq_change() accepted any non-negative quantum (only rejecting (int)ctl->quantum < 0). With a crafted size table qdisc_pkt_len reached ~2 GiB, so quantum=1 made the deficit-refill loop spin ~2^31 times under the qdisc lock, causing a soft lockup and denial of service.

In the Linux kernel, hhf_change() accepted any quantum value from userspace, including 1. With a crafted size table qdisc_pkt_len reached ~2 GiB, so quantum=1 made the deficit-refill loop spin ~2^31 times under the qdisc lock, causing a soft lockup and denial of service.

In the Linux kernel, drr_change_class() rejected explicit quantum==0 but otherwise fell back to psched_mtu() with no floor. With a crafted size table qdisc_pkt_len reached ~2 GiB, so quantum=1 (or a zero psched_mtu on a headerless device) made the deficit-refill loop spin under the qdisc lock, causing a soft lockup and denial of service.

In the Linux kernel, the ets network scheduler lacked a lower bound on the quantum value. With a crafted size table qdisc_pkt_len can reach ~2 GiB, and a zero psched_mtu on a headerless device makes the deficit-refill loop spin under the qdisc lock. The fix moves the floor into ets_quantum_parse() so explicitly configured quanta are also clamped to [256, 1<<20].

In the Linux kernel macb driver, when the device tree describes a fixed-link and has no "mdio" child node, macb_mii_init() returns early without allocating the MDIO bus, leaving bp->mii_bus as NULL. Two cleanup paths (driver unbind and probe error path) call mdiobus_unregister()/mdiobus_free() without a NULL check, causing an oops. The fix adds NULL guards in both places.

In the Linux kernel BPF subsystem, bpf_loop() declares its nr_loops argument as ARG_ANYTHING, allowing privileged programs to pass pointer values. Since commit bb124da69c47 the verifier marks R1 precise and reads its upper bound, but precision backtracking only accepts scalar registers, triggering a "backtracking misuse" warning and a panic when panic_on_warn is enabled. The fix introduces ARG_SCALAR and uses it for nr_loops.

In the Linux kernel erofs filesystem, inode_share keys were encoded as fingerprint || domain_id without a separator, which could cause the fingerprint to be parsed as part of a domain ID. The fix changes the encoding to domain_id || '\0' || fingerprint, making in-memory key indices unambiguous.

In the Linux kernel iommu/riscv driver, command queue publishing was not serialized, potentially causing a race between producer state and hardware tail updates. The fix serializes publishing so software producer state advances only after a command is written and the hardware tail is updated, and waits for hardware consumption outside the queue lock when the queue is full.

In the Linux kernel iommu/amd driver, iommu_init_ga_log() unconditionally assigns the ga_log and ga_log_tail pointers, so each resume replaces the boot-time pointers and leaks both allocations. The function also uses GFP_KERNEL from a syscore resume callback, where interrupts are disabled and non-boot CPUs are offline. The fix returns early if both buffers are already allocated and clears the pointers in free_ga_log().

In the Linux kernel iommu/amd driver, amd_iommu_pdom_id_alloc() returns an int (domain ID or negative errno), but amd_iommu_alloc_domain_nested() stores the result in the u32 field gdom_info->hdom_id, discarding the sign. As a result, -ENOSPC becomes 0xffffffe4 and the "<= 0" test never fires, so the nested domain is set up with an unallocated ID. The fix keeps the value in an int, tests it, and stores it only after validation.

In the Linux kernel hwmon ltc4282 driver, ltc428_clk_provider_setup() does not initialize all members of the clk_init_data structure, in particular init.num_parents remains uninitialized despite being assumed NULL. With CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE enabled, this may cause a crash. The fix ensures all members are fully initialized.

In the Linux kernel pec_store() takes a guard(mutex)(&hwdev->lock). If the chip write operation returns an error other than -EOPNOTSUPP, the code jumps to the put label, which calls put_device(hdev); if this drops the final reference, the device is freed, and when the function returns the guard cleanup attempts to unlock the freed mutex (UAF). The fix uses scoped_guard() instead of guard().

In the Linux kernel, the netfilter nfnetlink_log module has a bug related to concurrent instance destruction. Unlinking an instance from the hashes can occur at any refcount, not only on the 1 to 0 transition. Uncooperative userspace can force a situation where a queue is pending destruction from a netlink event while a different socket with the same portid processes an UNBIND request, leading to the instance being unhashed again and a general protection fault.

In the Linux kernel, the virtio_ring packed ring handling leaves stale AVAIL and USED descriptor flags after a failed packed add. These descriptors can be misinterpreted by the device as another command entry, blocking the virtqueue. This typically occurs in swiotlb configurations under memory pressure when vring_map_one_sg() fails for larger I/O requests.

A use-after-free vulnerability exists in the Linux kernel's unregister_virtio_device() function. After device_unregister() is called, the memory holding the virtio_device object may be freed, and virtio_debug_device_exit() then reads the debugfs_dir field from that freed object. The affected transports are virtio_mmio, virtio_vdpa, virtio_uml, mlxbf-tmfifo, and virtio_ccw.

In the Linux kernel, the virtio_console module has a bug where control-out buffers are freed on device removal. __send_control_msg() publishes &portdev->cpkt as the control-out virtqueue cookie, and remove_vqs() passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages. If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object, reported by KASAN as slab-out-of-bounds.

In the Linux kernel, the vhost/vdpa module has a bug where a queue size VRING_NUM larger than the device maximum is accepted. vhost_vring_set_num() accepts any non-zero power-of-two queue size fitting in 16 bits, and vhost-vdpa passes that value to set_vq_num() without comparing it with get_vq_num_max(). A process with access to /dev/vhost-vdpa-* can configure a queue larger than the device advertises, leading to an out-of-bounds read in the vringh IOTLB path (KASAN reports a 16-byte out-of-bounds read).

In the Linux kernel, the vhost-vdpa module has a bug where the eventfd_ctx_fdget() error is installed in config_ctx. vhost_vdpa_set_config_call() swaps the eventfd_ctx_fdget() return value into v->config_ctx before checking it, so on failure the field briefly holds an ERR_PTR. vhost_vdpa_config_cb() only tests for NULL, so a config interrupt delivered inside that window hands the ERR_PTR to eventfd_signal(). Additionally, a rejected fd can tear down a working config interrupt.

A use-after-free vulnerability exists in the Linux kernel's vhost-vdpa mechanism. The vhost_vdpa_config_cb() function reads the v->config_ctx pointer without a lock or reference, while a concurrent VHOST_VDPA_SET_CONFIG_CALL ioctl frees the old eventfd context via eventfd_ctx_put(), leading to use of freed memory. The issue is reachable from userspace when using VDUSE (access to /dev/vduse, root by default).

In the Linux kernel, the vdpa_sim_blk module has a bug where out-of-range sector starts are accepted. vdpasim_blk_check_range() logs an invalid start sector but continues validating the request; the subsequent unsigned capacity subtraction can underflow and let an out-of-range buffer offset reach the data path. This leads to an out-of-bounds write (VIRTIO_BLK_T_OUT, VIRTIO_BLK_T_WRITE_ZEROES) or out-of-bounds read (VIRTIO_BLK_T_IN).

In the Linux kernel, the vdpa_sim_net module has a bug where the TX pull result is not checked before the RX copy. vringh_iov_pull_iotlb() returns a signed byte count; a failed TX pull is currently added to the unsigned byte counter and then passed as a size_t length to receive_filter() and vringh_iov_push_iotlb(). A negative error can therefore become a large length in the RX path.

In the Linux kernel, the vduse module has a bug where virtqueue alignment is not validated. vduse_validate_config() only checks the upper bound of vq_align, so invalid values can reach vring_create_virtqueue_map(). The split-ring helpers use align - 1 as a bit mask, so the alignment must be a non-zero power of two; a zero value makes vring_size() drop the descriptor and available-ring part and vring_init() leave the used ring pointer NULL. Opening a virtio-net device created with vq_align=0 triggers a null-ptr-deref in virtqueue_kick_prepare_split().

In the Linux kernel, the vhost subsystem has an issue with invalidating vring access on IOTLB transitions. When VIRTIO_F_ACCESS_PLATFORM changes, cached vring pointers and IOTLB metadata are interpreted in a different address space, potentially leaving stale ring mappings in use. A common vhost_clear_device_iotlb() helper was added to serialize the transition with workers and prevent mixed address space mappings.

In the Linux kernel, the virtio_input driver has a flaw in the error path of input device registration. Probe marks the device DRIVER_OK before calling input_register_device(); if registration fails, the error path clears vi->ready and calls del_vqs() while the device is still live, potentially causing DMA to already torn-down queues. The fix calls virtio_reset_device() before tearing down the virtqueues.

In the Linux kernel, the virtio_input driver has an ordering issue during device removal. virtinput_remove() unregisters the input device before resetting the virtio device, allowing a callback to use vi->idev after it is freed. The fix resets the device first and rechecks vi->ready after taking the lock.

In the Linux kernel, the AF_UNIX subsystem has a bug in manage_oob() that fails to update the last skb marker. As a result, a blocking recv(MSG_PEEK) call can hog CPU by busy-waiting for a new skb. The fix updates the @last marker in manage_oob().

The Linux kernel has a UDP length overflow when sending large packets over IPv6 UDP sockets with IPV6_MTU_DISCOVER set to IPV6_PMTUDISC_DO or IPV6_PMTUDISC_PROBE and a network device with an unusually large MTU. The cork->base.fragsize value is not bounded to IP6_MAX_MTU, causing the 16-bit UDP length field to overflow and triggering a WARN in udp_set_len_short. The issue affects UDP sockets only and was fixed by limiting fragsize to IP6_MAX_MTU.

In the Linux kernel, the vduse module has a bug in compat ioctl handling. The compat handler handles VDUSE_IOTLB_GET_FD and VDUSE_VQ_GET_INFO but then calls the native handler, which returns -ENOIOCTLCMD due to different command sizes. For GET_FD, this overwrites receive_fd()'s return value after the descriptor is installed, leaking one fd per call. The fix returns handled compat results directly.

In the Linux kernel, the cortina ethernet driver has a bug in NAPI budget accounting. The gmac_rx() function returns the remaining NAPI budget, but its caller treats the return value as the number of packets received. An idle poll therefore reports a full budget and remains scheduled. The fix returns the number of received packets instead.

In the Linux kernel, the cortina ethernet driver has a bug in NAPI budget accounting for dropped frames. The RX loop only consumes budget when it successfully delivers a frame; error paths keep consuming descriptors without reducing the budget, potentially processing the entire receive ring in one poll. The fix moves budget accounting to a common end-of-frame path.

In the Linux kernel, the s390/debug subsystem has a NULL pointer dereference in debug_set_level(). Commit a2cec6863709 removed a null-id check from debug_set_level(), introducing a possible NULL pointer dereference for debug-API users that put debug_register() results unchecked into debug_set_level(). The fix moves the check back to the external wrapper.

A memory leak was found in the Linux kernel's Intel ICE network driver. The missing xa_destroy call for the sched_node_ids structure can cause memory leaks even after all elements are removed. The fix moves the structure to the hw struct and adds proper cleanup.

In the Linux kernel, the ice network driver has a double dereference in the TP_printk() function of the ice_tx_dim_work trace event. After new checks were added to the tracing subsystem, dereferencing pointers at print time can lead to use of invalid data because the pointers may be stale. The fix copies eight scalar values into the event instead of storing pointers.

In the Linux kernel, the Bluetooth btusb driver has a use-after-free (UAF) vulnerability related to the asynchronous rx_work. btusb_close() and btusb_flush() cancel rx_work asynchronously, so if btusb_rx_work() is already running on another CPU, it may continue after cancellation. After device disconnect, btusb_data is freed, and the running work may access freed memory. The fix uses cancel_delayed_work_sync() instead of asynchronous cancellation.

In the Linux kernel, the Bluetooth btintel_pcie driver lacks validation of the packet_len field before using it in skb_put_data(). The function btintel_pcie_submit_rx_work() reads packet_len from the rfh_hdr header without checking if it exceeds the RX buffer size. An oversized packet_len can lead to an out-of-bounds read in skb_put_data(). The fix adds validation to ensure packet_len is non-zero and does not exceed the buffer size.

A race condition exists in the Linux kernel between hci_conn_del_sysfs() and concurrent unregistration of a child device (e.g., a BNEP network device in bnep_session). During unregistration, device_del() uses a stale parent pointer, leading to a NULL pointer dereference in klist_put(). The issue is fixed by holding an explicit reference to the parent device (get_device/put_device) and restoring the __match_tty filter.

A null-ptr-deref vulnerability exists in the Linux kernel's IPv6 __ip6_del_rt_siblings() function. When deleting a route (inet6_rtm_delroute) without the RTNL lock, another thread can modify the routing table and set rt->fib6_node to NULL, leading to a NULL dereference and kernel crash.

In the Linux kernel, the macb network driver has a phylink instance leak on the probe error path. The macb_mii_init() function creates a phylink instance on both success paths, but the probe unwind frees the netdev without destroying the instance, leading to memory leak. The fix destroys the phylink instance at the appropriate location.

In the Linux kernel, the macb network driver has a reference leak to the 'mdio' child node in the device tree. The macb_mii_init() function holds the reference returned by of_get_child_by_name() for macb_mdiobus_register() and drops it only on error paths, causing a reference leak on every successful probe. The fix drops the reference after registration, where __mdiobus_register() has already taken its own.

A flaw was found in the Linux kernel's namespace listing mechanism (listns), where legitimize_ns() takes a reference on the namespace before may_list_ns() checks permissions. On the denied path, dropping the last reference to a mount namespace occurs inside an RCU read-side critical section, which can sleep there and trigger a kernel warning.