Linux kernel vulnerabilities

A vulnerability in the Linux kernel's xdp_master_redirect() function dereferences a master pointer without a NULL check. Under certain conditions during bond slave release, this can lead to a NULL pointer dereference and kernel panic.

In the Linux kernel, the pefile_digest_pe_contents() function is vulnerable to an out-of-bounds (OOB) read. A crafted PE file can cause an unsigned subtraction underflow, leading to reading a huge memory region and a kernel panic.

A use-after-free vulnerability was found in the Linux kernel's TIPC subsystem in the tipc_disc_rcv() function. The bearer_disable() function frees the discoverer structure (b->disc) with kfree(), but tipc_disc_rcv() still dereferences it in RX softirq context, leading to a use-after-free. The issue affects the UDP bearer, which lacks a proper grace period before deallocation.

In the Linux kernel, the accept_untracked_na() function is vulnerable to a NULL pointer dereference. It re-fetches the inet6_dev pointer without a NULL check, which can be exploited by a concurrent addrconf_ifdown() call, causing a kernel panic.

In the Linux kernel usbnet gl620a driver, an out-of-bounds read vulnerability exists in genelink_rx_fixup(). A malicious GeneLink (GL620A) device can send a short URB with an inflated packet size, causing data to be copied beyond the allocated buffer and leaking kernel heap memory.

A stack out-of-bounds write vulnerability was found in the Linux kernel's Bluetooth EIR component when building advertising data. The eir_create_adv_data() function may prepend a 3-byte Flags AD structure and then copy instance data without checking if it fits into the fixed 31-byte buffer, causing a stack overflow.

In the Linux kernel, the fib6_nh_mtu_change() function is vulnerable to a NULL pointer dereference. It re-fetches the idev pointer without a NULL check, which can be exploited by addrconf_ifdown(), causing a general protection fault.

In the Linux kernel's bridge CFM module, the ccm_tx_work_expired() function is vulnerable to memory exhaustion (OOM). It re-arms itself with a 0 interval when exp_interval is invalid, leading to continuous buffer allocation and memory exhaustion.

In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full interrupt handler gates the write_requested() callback on dw->state != CMD_SEND, and dw->state is only reset to READY on a STOP interrupt. The START_DET interrupt, which would reset the state on every (re)START, was never added to the enabled interrupt mask, so that recovery path was dead code. As a result, if the STOP interrupt is lost or the bus master issues a legal WRITE-repeated-START-WRITE sequence, the driver remains in CMD_SEND permanently and never invokes write_requested() again.

A flaw was found in the Linux kernel in net/can/bcm.c, allowing an unprivileged local user to execute arbitrary code in the kernel, leading to local privilege escalation to root.

In the rtl8723bs driver in the Linux kernel, the loop in is_ap_in_tkip() does not properly validate buffer bounds when processing information elements (IEs). This can lead to an out-of-bounds (OOB) read when accessing the IE header or its data.

In the NTFS3 filesystem in the Linux kernel, the log_replay() function does not validate the lcns_follow field during record conversion. A malicious filesystem image can provide an oversized lcns_follow value, causing an out-of-bounds (OOB) read during the memmove operation.

In the NTFS3 filesystem in the Linux kernel, the UpdateRecordDataRoot and UpdateRecordDataAllocation functions do not validate the view.data_off field in the NTFS_DE structure. A malicious filesystem image can provide an oversized view.data_off value, causing an out-of-bounds (OOB) write during the memmove operation.

In the Linux kernel's Open vSwitch module, a vulnerability was found due to missing validation of nested action attribute sizes. An attacker can exploit this to create oversized action containers, leading to incorrect stream interpretation and potential system integrity compromise.

In the Linux kernel, the next hop weight was increased from 8 bits to 16 bits to support larger ECMP weight ratios in CLOS networks. The change repurposed the reserved field resvd1 in the nexthop_grp structure to store high-order weight bits.

In the Linux kernel, the unused character device and IOCTLs in the QAT driver have been removed, reducing the attack surface. Device management is already handled via sysfs.

In the Linux kernel, redundant port lock acquisition in Samsung serial driver RX helpers has been removed, which caused a deadlock when console flow control was enabled.

In the Linux kernel DRM driver for Hyper-V, a vulnerability was found due to missing validation of VMBus packet size in the receive callback. An attacker in a virtual machine can send a crafted packet, causing an out-of-bounds read and potentially leaking data from previous messages.

In the Linux kernel, the tsconfig_prepare_data() function in ethtool was missing a call to ethnl_ops_complete() before returning an error, which could lead to lock management issues.

In the Linux kernel, a vulnerability was found in the XFRM subsystem where RCU synchronization in xfrm_policy_fini() was performed in the per-netns .exit handler, causing serial delays when removing multiple network namespaces. The fix moves the synchronization to the .pre_exit handler, reducing RCU grace periods from O(N) to O(1) per batch.

In the Linux kernel DRM Hyper-V driver, the resolution_count field in SYNTHVID_RESOLUTION_RESPONSE was not validated, potentially causing an out-of-bounds read of the supported_resolution array. Also, when the WIN10 resolution probe failed, screen_*_max / preferred_* were left unset, causing all userspace framebuffers to be rejected.

In the mlx5e driver in the Linux kernel, during handling of temporary SAs (acquire SA) in IPsec, the eswitch mode block was skipped, but the success label called unblock, causing an underflow of the num_block_mode counter.

In the pinctrl driver for Amlogic A4 SoCs in the Linux kernel, accessing the pinconf-pins sysfs node caused a deadlock because pinctrl_find_gpio_range_from_pin() tried to acquire the same mutex again.

In the arm_ffa firmware in the Linux kernel, the register-based PARTITION_INFO_GET_REGS path trusted firmware-provided indices, potentially allowing writes past the allocated array when copying partition descriptors.

In the Linux kernel NFSD, the nfsd4_revoke_states() function for layouts (SC_TYPE_LAYOUT) never set sc_status before calling nfsd4_close_layout(), causing an infinite loop in layout state revocation.

In the Linux kernel, in tcp_ao_established_key(), lockdep_sock_is_held() was used for a TCP_TIME_WAIT socket (twsk) which lacks sk_lock, causing an out-of-bounds memory access.

In the DRM Xe driver in the Linux kernel, in xe_gsc_init_post_hwconfig(), a managed BO was explicitly freed using xe_bo_unpin_map_no_vm(), causing a double-free because devm had already registered a cleanup action.

In the DRM AMDGPU driver in the Linux kernel, for VCE 1, the VCPU BO size did not account for the offset where the firmware resides, potentially causing an out-of-bounds read. Also, stack and data were not aligned to the 32K TLB size, and firmware was not checked to fit in the reserved space.

In the Linux kernel mac80211 subsystem, the MLE (Multi-Link Element) defragmentation routine was called with a pointer to the defragmented copy but the original elements, potentially causing a heap over-read if the original frame was at a higher address.

In the Linux kernel, a vulnerability in userfaultfd reads PTE entries without page table lock, causing undefined results on swap or migration entries. This may leave a thread asleep waiting for a UFFDIO_WAKE that may never arrive.

In the Linux kernel's KVM subsystem for x86, a vulnerability was found where the TPR threshold in VMCS is not properly recomputed after a PPR update. Under certain conditions, when no new interrupts are pending, apic_update_ppr() does not call kvm_lapic_update_cr8_intercept(), leaving a stale, high TPR_THRESHOLD value. This can cause a VM entry failure with hardware error 0x7 on older platforms or under nested virtualization (e.g., Hyper-V).

In the Linux kernel, the ACPI CPPC driver triggers a UBSAN warning due to misuse of the access_width field. When space_id is ACPI_ADR_SPACE_PLATFORM_COMM, access_width can exceed 4, causing a shift-out-of-bounds in a 32-bit int.

In the Linux kernel, the ACPI NFIT driver has a potential NULL pointer dereference. Installing a notify handler before checking the NFIT table presence can lead to acpi_nfit_uc_error_notify() being called without an allocated acpi_desc object.

In the Linux kernel, a use-after-free vulnerability was found in the ACPI NFIT driver. The error cleanup in acpi_nfit_init() fails to remove the acpi_desc object from the acpi_descs list, leading to a dangling pointer that can be accessed during subsequent Machine Check Exceptions (MCE), causing a use-after-free condition.

In the Linux kernel, the Rust block driver has a cleanup issue in GenDiskBuilder::build(). The error path before registration leaks a temporary gendisk and request_queue, potentially retaining blk-mq state after the tag set is dropped.

In the Linux kernel, the BPF JIT allocator is vulnerable to JIT spraying attacks. Reusing JIT memory can allow exploiting branch predictions from a previous program. A mechanism to flush branch predictors before reusing JIT memory has been added.

In the Linux kernel, the Spectre-v2 mitigation lacks IBPB flush on BPF JIT memory reuse. Enabling IBPB flush for BPF JIT allocations has been added, skipping when the BPF dispatcher uses retpoline.

In the Linux kernel, the rtw89 WiFi driver has a bug in the drop logic for malformed AMPDU frames. The previous fix fails with the first AMPDU packet in a certain sequence number range, causing unexpected packet drops and possible disconnection from the AP during rekey.

In the Linux kernel, the USB gadget rndis function lacks a length check for the RNDIS header in rndis_rm_hdr. The fields MessageType, MessageLength, DataOffset, and DataLength are accessed without verifying their presence.

A stack buffer overflow vulnerability was found in the BMC150 accelerometer driver in the Linux kernel. The device can report up to 127 FIFO frames, but the destination buffer is sized for only 32 frames, causing an out-of-bounds write on the stack.

In the kxsd9 accelerometer driver in the Linux kernel, a runtime PM usage-counter reference leak was found in the write_raw() error path. When a scale with a non-zero integer part is requested, the function returns -EINVAL without releasing the PM reference, preventing the device from autosuspending.

In the Linux kernel, the ad_sigma_delta driver for registerless ADC devices (has_registers=false) without rdy_gpiod, the ad_sigma_delta_clear_pending_event() function may read conversion data instead of status, corrupting the data stream. Additionally, when num_resetclks=0, a memset with negative size causes a heap overflow.

In the ad_sigma_delta ADC driver in the Linux kernel, issues were found with CS (chip select) being left asserted and SPI bus lock state leaks. In ad_sigma_delta_single_conversion(), set_mode() and disable_one() are called while keep_cs_asserted is still true, leaving CS active after conversion. Additionally, in the error path of ad_sd_buffer_postenable(), the device may remain in continuous conversion mode with CS asserted, and the bus_locked flag may stay set, allowing concurrent SPI access.

In the lpc32xx_adc ADC driver in the Linux kernel, an initialization order bug was found: init_completion() is called after registering the interrupt handler (devm_request_irq()). If an interrupt occurs before initialization, the handler calls complete() on an uninitialized completion structure, causing a NULL pointer dereference and kernel panic.

In the ti-ads1119 ADC driver in the Linux kernel, a runtime PM usage-counter reference leak was found in the buffer preenable function. When i2c_smbus_write_byte() fails, the error is returned without releasing the PM reference, leaving the device active.

In the hw-consumer IIO buffer driver in the Linux kernel, a memory leak was found: after the scan mask allocation was changed to a separate bitmap, iio_hw_buf_release() does not free the mask before freeing the buffer structure.

In the scd30 chemical sensor driver in the Linux kernel, a sign-extension bug was found when processing float32 values. The bitwise AND with ~BIT(31) (0xFFFFFFFF7FFFFFFF) corrupts the exponent, leading to incorrect readings. Code readability was also improved by refactoring variable initializations.

A race condition in the Linux kernel's IIO event FIFO reset allows a concurrent thread to read from the FIFO during reset, causing an out-of-bounds read and kernel memory leak to userspace.

In the bmg160 gyroscope driver in the Linux kernel, an out-of-bounds array read was found in bmg160_get_filter() and bmg160_set_filter(). When the requested bandwidth/filter value is not in the bmg160_samp_freq_table[], the functions read past the array, potentially causing incorrect values or crashes. The set_filter() path is reachable from userspace via sysfs.

In the Linux gp2ap002 light sensor driver, a runtime PM reference leak occurs when gp2ap002_read_raw() fails, skipping the put_autosuspend call and preventing device autosuspend.