Linux kernel vulnerabilities

In the Linux kernel, cdx_create_res_attr() frees res_attr when sysfs_create_bin_file() fails but does not set cdx_dev->res_attr[num] to NULL, leaving a dangling pointer. A later call to cdx_destroy_res_attr() frees the already-freed memory, causing a double free.

In the Linux kernel's USB gadget f_tcm, usbg_make_tpg() holds dep_lock while calling configfs_depend_item_unlocked(), creating a circular lock dependency with configfs_rmdir(). This can lead to a deadlock.

In the Linux kernel, a vulnerability was found involving an out-of-bounds read in the of_alias_scan() function. The stem parser checks isdigit before validating boundaries, causing a read one byte before the property name when the name is empty or all digits. This could lead to unexpected behavior or information leakage.

A vulnerability in the Linux kernel's NFS server (nfsd) involves a NULL pointer dereference in nfsd_file_net_dispose(). During network teardown, the nn->nfsd_serv pointer may be cleared while the function still attempts to use it, leading to a crash. The fix safely checks the pointer before use.

In the Linux kernel's NFS server (nfsd), the vulnerability concerns the order of DRC hash table initialization before registering the shrinker. On weakly-ordered architectures (arm64, ppc), the shrinker may observe an uninitialized hash table, causing a NULL pointer dereference in the callback. The fix moves the initialization before registration.

In the Linux kernel Bluetooth subsystem, hci_send_cmd_sync() cloned the sent command into hdev->req_skb using skb_clone(). Under memory pressure this clone could fail, leaving req_skb NULL, so hci_req_cmd_complete() never invoked hci_cmd_sync_complete() and the waiter timed out with -ETIMEDOUT after 10 seconds. The fix replaces skb_clone() with skb_get(), which only increments the reference count and cannot fail.

A race condition in the Linux kernel between KASAN quarantine cache shrink and CPU hotplug was found. When a CPU goes offline, objects remain on its per-CPU shrink_qlist and are not returned to the slab allocator, causing incomplete cache destruction and kernel warnings. Affects kernels with CONFIG_KASAN_GENERIC enabled.

A bug in the Linux kernel's I3C subsystem causes recursive locking during registration of new I3C devices. The function i3c_master_register_new_i3c_devs() registers devices while holding i3c_bus_normaluse_lock(), and device_register() can immediately trigger a probe callback that tries to acquire the same lock again, leading to a deadlock. The fix separates device creation from registration and uses the maintenance lock.

In the Linux kernel, the dm-pcache module does not validate the persisted dirty_tail chain at load. A crafted image, whose on-media fields are authenticated only by a crc32c with a fixed seed, can aim dirty_tail at a chain of last ksets that never terminates, causing cache_writeback_fn() to re-arm itself forever. The fix adds validation of the dirty_tail chain at load with a hop cap.

A bug in the Linux kernel's memcg subsystem causes LRU size accounting to be copied to the parent instead of moved when a memory cgroup is offlined, leaving stale counters on the child. This makes the LRU (or MGLRU) scanner read phantom sizes and grind through empty lists on dying cgroups, over-budgeting limits and wasting CPU. On one host, counters described 476 GiB of pages—1.89x the machine's RAM.

In the Linux kernel, the drm/bridge synopsys dw-dp driver initializes and registers the DisplayPort AUX channel during dw_dp_bind(), but never unregisters it. This may lead to resource leaks and/or use-after-free. The fix adds the missing dw_dp_unbind() function to allow cleanup.

In the Linux kernel, the drm/rockchip dw_dp driver initializes and registers core resources such as the DisplayPort AUX channel during dw_dp_bind(), but never unregisters them. This leads to memory leaks and/or use-after-free, as shown in a KASAN report. The issue is fixed by using the exported dw_dp_unbind() function in the component's unbind() callback and in its bind() error path.

In the Linux kernel, the drm/rockchip analogix_dp driver has an OF node reference leak in rockchip_dp_drm_encoder_enable(), because of_get_child_by_name() does not call of_node_put() symmetrically. The fix uses __free(device_node) to automatically manage reference release.

In the Linux kernel, smack_msg_queue_msgrcv() incorrectly checks permissions of the 'current' task instead of the 'target' task. In the pipelined_send() optimization path, the sender checks on behalf of the receiver, so an unauthorized receiver can get the message, violating Smack MAC policy. The fix checks permissions on the 'target' task.

In the Linux kernel, the HID roccat driver uses an 8-bit, device-supplied profile index without a range check, even though the profiles array has only 5 elements. A malicious USB device claiming the Roccat Kone id can send a switch-profile event with an out-of-range value, causing an out-of-bounds read that is exposed via the actual_dpi sysfs attribute.

In the Linux kernel, the ASoC SOF functions sof_ipc4_widget_setup_comp_src() and sof_ipc4_widget_setup_comp_asrc() print an error and jump to the cleanup label when the number of input or output formats is zero, but 'ret' is still 0. As a result, the function returns success even though the widget setup actually failed.

In the Linux kernel, the cxl/mbox CXL_MEM_SEND_COMMAND bounds the user's in.size to the mailbox payload size but leaves out.size unbounded, which is then used in kvzalloc(). A large out.size drives a huge allocation, above INT_MAX it warns and taints the kernel, and with panic_on_warn=1 it panics.

In the Linux kernel, the ASoC rt700-sdw driver has a vulnerability where rt700_sdw_remove() drains jack_detect_work and jack_btn_check_work only when the hw_init flag is set. This flag is cleared when the SoundWire device becomes UNATTACHED, potentially leaving active work objects and causing DEBUG_OBJECTS to report an active timer after removal.

In the Linux kernel, the ASoC fsl_audmix component leaves the AUDMIX block powered off and suspended after pm_runtime_enable() until the first runtime resume. Register writes issued between probe() and the first resume target unpowered hardware and cause a system hang.

In the Linux kernel, the drm/lima driver calls lima_vm_create() before va_start and va_end are set up, so both are 0. When DRM_DEBUG_MM is enabled, the DRM_MM_BUG_ON check in drm_mm_init() fires a kernel BUG, as seen on exynos4412-odroid-u2.

A vulnerability was fixed in the Linux kernel scheduler (sched/fair) involving a u32 overflow in update_tg_cfs_runnable(). The overflow corrupts runnable_sum, leading to a divide-by-zero in propagate_entity_load_avg() and a kernel crash. The issue can be triggered by workloads such as hackbench.

In the Linux kernel, the perf/x86/intel/uncore code has incorrect ordering of uncore_box_ref()/uncore_box_unref() relative to uncore_change_context(). In uncore_event_cpu_online(), uncore_box_ref() runs while box->cpu is still -1, so the box is never initialized on the first CPU in a die, and in the offline path the box is torn down on the second-to-last CPU.

In the Linux kernel, the drm/panthor driver has a NULL pointer dereference (NPD) issue during partial unmap of an evicted buffer object (BO). When BO pages are released on eviction, the 'bo->backing.pages' pointer is set to NULL, and the logic for handling GPU mapping splits did not completely skip this case for the VMA of an evicted BO, leading to a NULL dereference and kernel crash.

In the Linux kernel's BPF subsystem, copy_map_value_long() failed to copy the padding between map->value_size and round_up(map->value_size, 8) for per-CPU maps. As a result, UAPI LOOKUP_ELEM paths could return stale heap contents to user space.

In the Linux kernel's BPF/LSM subsystem, security_bpf_prog_free() called from softirq context (via __bpf_prog_put_rcu) triggered a "sleeping function called from invalid context" BUG when a sleepable LSM program was attached to the hook. The fix drops bpf_prog_free from sleepable_lsm_hooks.

In the Linux kernel's mm/mm_init, a missing allocation failure check for pgdat->per_cpu_nodestats in free_area_init_core_hotplug led to a NULL dereference when offsetting into the per-CPU area. The fix propagates -ENOMEM and leaves per_cpu_nodestats pointing at boot_nodestats.

In the Linux kernel's leds: lp5860 driver, lp5860_device_init() would double-unlock an already unlocked mutex if lp5860_init_dt() failed. The fix reworks how the lock is taken and released.

In the Linux kernel, zynqmp_dma_remove() disabled runtime PM only after checking state and performing a manual suspend, which can race with runtime PM in the remove/unbind (rmmod) path. The fix disables runtime PM first, then suspends only if the device is not already suspended, preventing further runtime PM transitions.

In the Linux kernel, the dmaengine xilinx_dma driver's xilinx_dma_poll_timeout function, when called with delay_us=0 and a condition that is never fulfilled, caused the CPU to busy-wait for a prolonged time. Instead of timing out after approximately XILINX_DMA_LOOP_COUNT microseconds, the timeout occurred after several minutes, leading to a CPU stall. The fix introduces the XILINX_DMA_POLL_DELAY_US constant and uses delay_us=10.

In the Linux kernel, the syscall trace path reloads syscall arguments from pt_regs before calling the handler. On C-SKY ABIv2, the code adjusts sp before loading LSAVE_A4 and LSAVE_A5, so the wrong slots are fetched and traced syscalls using the 5th or 6th argument (e.g., mmap2) receive corrupted arguments. The fix loads a4/a5 from pt_regs before changing sp.

In the Linux kernel, the rtw89_ppdu_str() function in the rtw89 Wi-Fi driver uses a '>' comparison instead of '>=', which can lead to an out-of-bounds access. The fix changes the operator to '>=' to avoid the invalid memory access.

A vulnerability in the Linux kernel's uprobes mechanism on x86 has been fixed. Optimized uprobes could clobber the user stack redzone area because the call instruction stored a return address on the stack while user code might keep temporary data there without adjusting rsp. The fix moves optimized uprobes from the nop5 to the nop10 instruction, allowing an additional lea instruction to adjust rsp before the call.

In the Linux kernel, hwrng_register() adds rng to the global rng_list and may then try to set it as current_rng. If that step fails, it returns an error but does not remove rng from the list, causing a dangling reference and potential use-after-free if the caller frees rng. The fix adds a list_del_init() cleanup step.

In the Linux kernel, the crypto qat driver queues SR-IOV re-enable work using a work_struct and completion embedded in an on-stack adf_sriov_dev_data. If the completion wait times out, the reset worker can return while device_sriov_wq still holds or executes the stack-backed work item. The fix cancels the work on device_sriov_wq on timeout before the stack frame unwinds.

In the Linux kernel, qat_alg_xts_reverse_key() expands the forward XTS AES key on the stack, and the key schedule contains key material that can remain in the stack frame. The fix clears the temporary crypto_aes_ctx with memzero_explicit() after the copy.

In the Linux kernel, the hardware ECDH path in atmel_ecdh_compute_shared_secret() uses the private key stored in the device, but the public key is cached only after atmel_ecdh_set_secret() successfully generated that private key for the current tfm. The fix adds a check for a missing cached public key to prevent using a private key not generated for the current tfm.

In the Linux kernel, the crypto: atmel-sha204a driver failed to free the work_data structure when an I2C transfer failed in the nonblocking RNG path. The pointer remained in rng->priv, so subsequent reads could interpret stale state as valid RNG completion data, causing a heap information leak.

In the Linux kernel, sa_ul_probe() in the crypto: sa2ul driver ignored the return value of sa_init_mem(), which creates the DMA pool for security context buffers. If pool creation failed, probe continued with DMA setup and algorithm registration even though later request setup depends on that pool.

In the Linux kernel, xtrng_readblock32() in the hwrng: xilinx-trng driver returned the number of bytes read even when the first poll timed out. The caller treated a zero return as a short successful read, and partial reads for full 32-byte blocks could make the tail copy use a fixed block offset instead of the amount already produced.

In the Linux kernel, rk_hash_run() in the crypto: rk3288 driver waited for RK_CRYPTO_HASH_STS to become idle after the final DMA transfer but ignored the poll result. If the hash engine never became idle, the driver still read the digest registers and finalized the request with the previous success value.

In the Linux kernel, register_aes_algs() in the crypto: keembay driver registered AEAD algorithms before skcipher algorithms. If skcipher registration failed, the function unwound the earlier AEAD registration passing ARRAY_SIZE(algs) (the skcipher table size) instead of ARRAY_SIZE(algs_aead).

In the Linux kernel, __wait_for_resp() in the RDMA/bng_re driver ignored wait_event_timeout() expiry. If the response slot remained in use after the timeout and the polled CREQ service attempt, the loop started another full timeout period and could repeat forever.

In the Linux kernel, apple_nvme_init_queue() in the nvme-apple driver initialized queue state and then marked the queue enabled. The old wmb() after WRITE_ONCE(enabled, true) did not publish the earlier initialization before enabled became visible, potentially racing with interrupt and request paths.

In the Linux kernel, the nr_deadline_tasks variable in the cpuset structure could be modified concurrently by inc_dl_tasks_cs() under rq->lock and by cpuset_attach() under cpuset_mutex. Simultaneous updates could corrupt the variable, leading to incorrect operations.

In the Linux kernel, the mac80211_hwsim driver has a vulnerability where a NULL pointer can be passed to ieee80211_free_txskb() during queue stop. The issue arises from separating the empty queue check from the dequeue operation, which is unsafe under concurrent TX status handling.

In the Linux kernel's proc_timens_set_offset() function, there is a lack of validation for the tv_nsec field, which should be in the range [0, 999999999]. Invalid values can lead to incorrect calculations or unexpected behavior when adding times.

In the Linux kernel's qcom gdsc clock driver, there is an issue with improper removal of genpd domains during unregistration. The gdsc_unregister() function does not call pm_genpd_remove() for registered domains, leaving entries on the global list and causing errors on re-registration.

In the Linux kernel's staging media ipu7 driver, there is a pm_runtime refcount leak in ipu7_resume(). Using pm_runtime_get_sync() without balancing on error leaves the usage count incremented.

In the Linux kernel's rcar thermal driver, there is an error checking issue in probe(). The thermal_zone_device_enable() function is called before checking if thermal zone registration succeeded, which could lead to an error pointer dereference.

In the Linux kernel's USB gadget r8a66597 driver, there is a double free of ep0_req in the probe error path. If usb_add_gadget_udc() fails, ep0_req is freed twice, which could lead to memory corruption.