Linux kernel vulnerabilities

In the Linux kernel tracing subsystem there is a use-after-free bug. event_hist_trigger_named_init() first publishes the trigger on the global named_triggers list and only then takes the reference; if initialization fails, the trigger is not removed from the list and gets freed, so the next lookup by name reads the freed object.

A vulnerability in the Linux kernel tracing subsystem related to histogram trigger registration has been discovered. The flaw can cause a trigger to be freed while still present on the global named_triggers list, leading to a use-after-free condition. The fix adjusts the registration/unregistration order to prevent this.

In the Linux kernel accel/ivpu driver, ivpu_to_cpu_addr() did not validate the full buffer range. The lack of a check that the whole [vpu_addr, vpu_addr + size) range stays within the BO could lead to out-of-bounds access.

In the Linux kernel accel/ivpu driver, fw_log_print_buffer() re-read the log header fields from shared memory after they had been validated. This allowed a TOCTOU attack where the NPU firmware changes the values between check and use, causing out-of-bounds reads while printing logs.

In the Linux kernel accel/ivpu driver, printing the name from the tracing buffer header was not limited to the field size. The name field is a fixed-size array populated by the NPU firmware and is expected to be NUL-terminated, but a missing terminator caused reads past the field and exposed adjacent bytes via dmesg and debugfs.

In the Linux kernel accel/ethosu driver, ethosu_job_open() returned the value from WARN_ON() (0 or 1) instead of the original negative errno. This caused an incorrect return code to be passed to userspace.

In the Linux kernel accel/ethosu driver, the command stream was not ensured to end with a stop op. Although the QSIZE register setting should prevent out-of-bounds access, it is unclear whether the hardware generates the required interrupt, which could lead to a timeout.

In the Linux kernel, in the accel: ethosu driver, on SRAM mapping failure, the SRAM size is left non-zero. This allows jobs to access SRAM which points to physical base address 0x0.

In the Linux kernel, in the accel: ethosu driver, userspace can set the job SRAM size to 0 but still have SRAM accesses in the command stream. When the job SRAM size is 0, setting the region base register is skipped, leading to use of a stale base address from a prior job.

In the Linux kernel, the ASoC driver for Spreadtrum platforms (sprd) lacks validation of compress buffer sizes against fixed memory allocations. A local user can configure a logical buffer up to ~4GB, causing overflow of the IRAM (32K) or DDR (2M) buffers during copy operations from user space.

In the Linux kernel, in ASoC: sti, uni_reader_init() registers the shared IRQ before initializing reader->irq_lock. A pending interrupt can invoke the handler while the lock is still uninitialized.

In the Linux kernel, in Bluetooth: btqcomsmd, the teardown order is incorrect: hci_dev is freed before destroying the RPMsg endpoints. If WCNSS delivers data in that window, the callback can run with an already freed hci_dev.

In the Linux kernel, in Bluetooth: btrtl, when parsing firmware format v2, if key_id from chip is zero, rtlbt_parse_firmware_v2() intentionally ignores all security headers, but the implementation simply breaks from a switch and leaks uninitialized return code.

In the Linux kernel, in bootconfig, in get_boot_config_from_initrd(), a crafted initrd with a huge bootconfig size (e.g., 0xFFFFFFFF) can cause pointer arithmetic to wrap around on 32-bit systems, bypassing bounds checks and leading to a fatal page fault during early boot.

In the Linux kernel, in cpufreq, the policy CPU mask (policy->cpus) is allocated without zeroing (alloc_cpumask_var), leaving the bitmap uninitialized. Sysfs attributes are published before the mask is initialized, allowing access to invalid data.

In the Linux kernel, in cpufreq, the policy rwsem is initialized after the sysfs directory and default attributes are created. A sysfs access can reach a policy callback before the semaphore has been initialized.

A use-after-free vulnerability exists in the Linux kernel's proc_flush_pid() function during process exit. Due to an incorrect assumption about holding a reference to thread_pid, the PID can be freed by an RCU callback before proc_flush_pid() completes. The vulnerability can be triggered by an unprivileged user via a race between wait4(-1) and setsid().

A vulnerability was found in the Linux kernel's filesystem freezing mechanism. After a change in freeze counting, a nested thaw operation returned an incorrect -EINVAL error despite successfully releasing one freeze. This leads to a permanent block device lock, preventing remounting.

In the Linux kernel, the gennetlink policy dump keeps pointers to the target family's operation and policy tables in its callback state. The target family's module is not pinned, so it can be unregistered and unloaded while a policy dump is pending. Advancing the dump then dereferences policy memory from the unloaded module.

In the Linux kernel, drm_exec_prepare_array() silently returns success without calling drm_exec_lock_contended() when num_objects is zero. This breaks the invariant that every entry point must first attempt to lock any previously contended object. Drivers chaining multiple calls can spin forever when an empty array never clears exec->contended.

In the Linux kernel, the query_perf_config_list() function in the drm/i915 driver has a memory leak. When krealloc() fails, the original oa_config_ids array is not freed before returning, leading to a memory leak.

In the Linux kernel, the rockchip_dp_drm_encoder_enable() function in the drm/rockchip analogix_dp driver uses sprintf() to format a device tree path into a 32-byte stack buffer. Device tree paths are not limited to this size, so a sufficiently long path can overflow the buffer.

A vulnerability was found in the Linux kernel's io_uring/rw subsystem. Moving write accounting completion to task_work causes a deadlock during filesystem freeze, as the task waits on the sb_writers semaphore. The fix moves write accounting completion back to the ki_complete handler, leaving only fsnotify calls in task_work.

In the Linux kernel, the ring_buffer_subbuf_order_set() function stores the new order and only then checks CPUs, returning -EBUSY if any has resizing disabled. A user-mapped buffer has resizing disabled, and __rb_map_vma() reads buffer->subbuf_order without the mutex, so an mmap racing the failing order change can size the mapping incorrectly.

In the Linux kernel, in net/sched act_api when a batched RTM_NEWACTION request replaces an existing action, tcf_idr_check_alloc() takes a temporary reference. If a later action fails to initialize, tcf_action_destroy() uses strict release semantics, which for a filter-bound action returns -EPERM without dropping the reference. This leaks the action and its IDR slot.

In the Linux kernel's network bridge module, there is an issue with CFM and MRP frame handling. When these protocols are enabled on multiple bridges, the same list node is added to multiple lists, leading to list state corruption when unregistering on one bridge. The fix tracks per-bridge enable state using option bits and dispatches the handler directly, also reducing the net_bridge structure size.

In the Linux kernel's DSA tagger for Broadcom (tag_brcm), there is an issue with FCS calculation for nonlinear frames. The tagger does not declare the required tailroom, causing an out-of-bounds read (slab-out-of-bounds) during CRC calculation. The fix declares the required tailroom, which disables SG and FRAGLIST features and linearizes frames before processing.

In the Linux kernel's MANA driver (Microsoft Azure Network Adapter), there is an issue with the RX queue size. The queue is sized to hold exactly one CQE per WQE, but hardware may post an additional fence CQE, which in rare cases leads to no slot available and dropping that CQE, while the driver waits holding the RTNL lock. The fix reserves an extra slot for the fence CQE.

A vulnerability in the Linux kernel's MPLS handling was found where the inner_protocol field is not cleared after popping the last MPLS label. This can lead to a negative network header offset, causing Open vSwitch to perform a massive memcpy out of bounds, resulting in a system crash (page fault).

In the Linux kernel's Open vSwitch module, there is a use-after-free vulnerability related to the flow table mask array. The function tbl_mask_array_realloc() retires the old array before it is fully out of use, allowing a read after free in a certain time window. The fix publishes the new array before retiring the old one.

In the Linux kernel's netfs module, there is an issue with an uninitialized return value in the netfs_unbuffered_write() function. If preparation of the first subrequest fails, the loop exits before ret is initialized, which can lead to returning an incorrect error code. The fix initializes ret to 0.

A use-after-free vulnerability was found in the Linux kernel's netfilter cttimeout module during module unload. nf_ct_set_timeout() protects the timeout hook and policy lookup with rcu_read_lock(), but cttimeout_exit() unregisters per-net operations before clearing the hook, allowing access to freed memory. KASAN reported slab-use-after-free in ctnl_timeout_find_get.

A race condition in the Linux kernel's netfilter nf_log module allows a use-after-free when loggers are unregistered. The incorrect ordering lets a sysctl or netlink writer rebind a logger after per-net state is cleared but before the global backend is removed, leading to a dangling pointer.

In the Linux kernel's ifcvf driver (Intel FPGA Virtual Function), there is a resource leak issue on unsupported feature error. When a feature is not supported, the driver does not properly release the allocated device and adapter pointer. The fix routes the error through the common path to ensure resource release.

In the Linux kernel's autofs module, there is a memory leak in the autofs_fill_super() function. If creating root_inode fails, the function returns -ENOMEM without freeing the previously created inode, leading to a memory leak. The fix adds a call to autofs_free_ino() in the error path.

In the Linux kernel, the EROFS filesystem has a vulnerability in LZMA decoder pool resizing. On partial allocation failure, a broken stream remains in an inconsistent state, potentially passing NULL to xz_dec_microlzma_reset().

In the Linux kernel, the fbdev vfb driver has a use-after-free vulnerability because the colormap is freed immediately after unregistering the framebuffer, even when an open file still holds a reference. This can lead to a read-after-free during copy to userspace.

In the Linux kernel, the idpf driver has a vulnerability where DIM works are not disabled before freeing q_vectors memory. These works can run on freed memory, leading to a use-after-free condition.

A vulnerability in the Linux kernel's IPv6 packet fragmentation mechanism (inet: frags) was found. Improper flushing of fragment queues before their removal can lead to use of stale metadata, resulting in out-of-bounds access and heap corruption. An attacker with access to unprivileged network namespaces can exploit this for local privilege escalation.

In the Linux kernel, the ieee802154 6lowpan subsystem has a NULL pointer dereference vulnerability in lowpan_newlink. A TUN device can change its link type to ARPHRD_IEEE802154 without initializing ieee802154_ptr, leading to a crash.

In the Linux kernel, the ieee802154 cc2520 driver has a use-after-free vulnerability in FIFOP work. After driver removal, the FIFOP interrupt can still queue work after flush, allowing execution after private data is freed.

In the Linux kernel, the ieee802154 hwsim driver has a double-free vulnerability in hwsim_update_pib. PIB updates are not serialized, leading to a race and double-free of the object.

In the Linux kernel, the IPv4 FIB subsystem has a vulnerability of unbounded table ID probing during automatic allocation. This can lead to long RTNL hold times, causing performance issues.

In the Linux kernel, the IPv6 flowlabel subsystem has a vulnerability of unbounded lease list growth per socket. Repeated GET requests can lead to uncontrolled memory consumption.

In the Linux kernel, the IPVS subsystem has a vulnerability of accepting invalid states in connection template sync records. This can lead to using an invalid state as an index in TCP/SCTP transition tables.

In the Linux kernel's mac802154 subsystem, a use-after-free vulnerability was found in the RX frame queueing mechanism. The softirq producer adds beacon and MAC-command frames to lists without locking, and the worker processes them after the interface may have been freed, leading to dereferences of freed memory (sdata). The issue was confirmed by KASAN.

A use-after-free vulnerability was found in the Linux kernel's Landlock module, in the current_check_refer_path() function. During linkat() processing, the module accesses the source directory's parent without holding a reference or lock, allowing concurrent rename(2) and rmdir(2) to free and reuse memory. The issue is fixed by properly taking a reference on the parent dentry.

In the Linux kernel, the iommu/s390 subsystem has a NULL pointer dereference in iova_to_phys() when using a 5-level translation table via ZPCI_TABLE_TYPE_RFX. get_rso_from_iova() returns NULL when the region-first entry is invalid, but get_rto_from_iova() does not check this before accessing rso[rsx].

In the Linux kernel, the s390/crypto subsystem fails to scrub temporary buffers in the AES CTR and GCM algorithms. The buffer processing remaining bytes < AES_BLOCK_SIZE in ctr_aes_crypt() was not scrubbed, and gcm_aes_crypt() error paths did not scrub the CPACF parameter block or the gcm_sg_walk struct buffers.

In the Linux kernel, the s390/crypto subsystem lacks proper handling of the EBUSY return code in the PHMAC algorithm when a request is transferred to the crypto engine. crypto_transfer_hash_request_to_engine() returns EINPROGRESS or EBUSY to signal success, but EBUSY was not handled.