Linux kernel vulnerabilities

In the Linux mpl115 pressure sensor driver, a runtime PM reference leak happens on read error because pm_runtime_put_autosuspend() is skipped.

In the Linux tmp006 temperature sensor driver, the trigger is allocated with devm but registered with plain iio_trigger_register(), leaving a dangling pointer after module unload.

In the ALSA usx2y driver for us144mkii, a use-after-free occurs because URBs can resubmit and re-arm work after cancellation, leading to work on freed memory.

In the ALSA virtio-snd driver, control metadata from the device is not validated, allowing a malicious device to cause out-of-bounds access.

In the ALSA ymfpci driver, snd_ymfpci_create_spdif_controls() does not check the return value of snd_ctl_new1(), which can return NULL on memory allocation failure, leading to NULL pointer dereference.

In the ALSA aoa driver, the layout.c function does not check the return value of snd_ctl_new1(), which can return NULL, leading to NULL pointer dereference.

In the ALSA caiaq driver for Traktor Kontrol S4, an out-of-bounds read occurs because the parser assumes 16-byte blocks but the device can send a short block, causing unsigned underflow and reading past the buffer.

In the ALSA cmipci driver, snd_cmipci_spdif_controls() does not check the return value of snd_ctl_new1(), which can return NULL, leading to NULL pointer dereference.

In the ALSA compress driver, snd_compr_task_new() leaks driver resources on error after successful task_create() and may incorrectly report success due to uninitialized retval.

In the Linux kernel's ALSA es1938 driver, the return value of snd_ctl_new1() is not checked. If memory allocation fails, NULL is returned and then dereferenced, leading to a NULL pointer dereference.

In the Linux kernel's ALSA firewire isight driver, the sample count from the device packet is not bounded to MAX_FRAMES_PER_PACKET. A malicious or faulty Apple iSight device can send a packet with an excessive sample count, causing out-of-bounds read of the payload and out-of-bounds write of the PCM DMA buffer.

In the Linux kernel's ALSA gus driver, the return value of snd_ctl_new1() is not checked. If memory allocation fails, NULL is returned and then dereferenced, leading to a NULL pointer dereference.

In the Linux kernel's ALSA hda/cs35l41 driver, there is a teardown issue with firmware load work. ALSA controls are not removed on component unbind, and fw_load_work may be cancelled only conditionally. If the component or device is removed before the queued work runs, a use-after-free can occur.

In the Linux kernel's ALSA ice1712, ice1724, and aureon drivers, the return value of snd_ctl_new1() is not checked in multiple places. If memory allocation fails, NULL is returned and then dereferenced, leading to NULL pointer dereferences.

In the Linux kernel's ALSA seq, snd_seq_event_dup() leaks uninitialized heap data. For legacy (non-UMP) events, the trailing word in cell->ump.raw.extra is not zeroed, causing uninitialized heap data or leftover event data to be copied to user space.

In the Linux kernel's ALSA usb-audio driver for DualSense controllers, snd_dualsense_ih_match() uses kobject_get_path() to compare kobject paths. During rapid disconnect/reconnect, a dangling kobject name can be dereferenced, causing a fault in strlen() and a system crash.

In the Linux kernel's resctrl subsystem on x86 with SNC enabled, an out-of-bounds access can occur during CPU offline. When a monitoring domain is going offline, its cpu_mask is empty, and the NUMA node ID query via cpu_to_node() uses nr_cpu_ids as argument, causing an out-of-bounds access.

In the Linux kernel, a vulnerability was found in the vfio/pci driver related to the disable_idle_d3 parameter. Initially writable and directly controlling device power state, later code changes made it globally modifiable, causing unbalanced power management (PM) operations. The fix latches the flag per device, ensuring consistent PM behavior.

In the Linux kernel's vfio/pci driver, after a reorder in vfio_pci_core_register_device(), the VGA arbiter client registration is not unwound on failure. This can leave a callback with a freed vdev cookie, which becomes unsafe when the callback follows drvdata to the vfio device.

In the Linux kernel, vfio_mig_get_next_state() has an infinite loop when handling blocked state transitions. The skip loop does not account for the ERROR sentinel, causing a spin and potential soft lockup.

In the Linux kernel VFIO, debugfs is removed after devres release, leaving stale debugfs entries visible. The issue is in the order of vfio_device_del() and vfio_device_debugfs_exit().

In the Linux kernel vfio/mlx5 driver, bitfields are used in a racy manner because bitfield operations are not atomic. They are split into dedicated storage units for concurrently modified flags.

In the Linux kernel Bluetooth btusb driver, a use-after-free occurs on controller registration failure. Sibling interfaces are not released, leading to double-free on disconnect.

In the Linux kernel Bluetooth btusb driver, a use-after-free occurs on Marvell OOB wakeup probe failure. Submitted TX URBs are not stopped, leading to access to freed memory.

A use-after-free (UAF) vulnerability was found in the Linux kernel's binder_thread_release() function. A race condition between thread exit and concurrent transaction freeing can lead to accessing freed memory.

A use-after-free vulnerability was found in the Linux kernel's binder_free_transaction() function in the Binder driver. The issue occurs because the target process pointer (t->to_proc) is read under a lock, but after the lock is released, the process can be freed, leading to access to freed memory.

In the Linux kernel rust_binder driver, an incorrect stride (usize instead of u64) is used when cleaning up the offsets array. On 32-bit kernels, this causes over-decrement of reference counts and corrupted reference accounting.

In the Linux kernel rust_binder driver, the freeze listener is not cleared on node removal when the user does not do it explicitly. This can lead to a memory leak due to a reference cycle.

In the Linux kernel xhci driver, xhci_free_streams() calls dma_free_coherent() with irqs disabled, which can cause a 'sleep in atomic context' error. The issue occurs when disconnecting a USB device with active streams.

In the Linux kernel, the xHCI driver has a memory leak in xhci_ring_to_sgtable(). The temporary pages array is not freed after successfully creating the sg_table, leaking memory each time a sideband client gets an endpoint or event ring buffer.

In the Linux kernel's TCPCI rt1711h driver, the TCPCI port is not unregistered if later steps in probe() fail. The port remains registered, potentially causing issues on re-initialization or driver detach.

In the Linux kernel's PCI Altera driver, resource leaks occur when pci_host_probe() fails. The chained IRQ handler and INTx domain are not removed, and controller interrupts remain enabled, leading to use of a stale data pointer.

In the Linux kernel's PCI MediaTek driver, an IRQ domain leak occurs when a port fails to enable. IRQ domains created by mtk_pcie_init_irq_domain() are not freed, leading to resource leaks.

In the Linux kernel, the sriov_restore_vf_rebar_state() function has an out-of-bounds access to the barsz[] array when a VF Resizable BAR Control register read returns PCI_ERROR_RESPONSE. This can lead to memory corruption and system instability.

A vulnerability in the Linux kernel's DAMON module was found in the damon_hot_score() function, which mishandles extreme monitoring interval values (zero or too high). Setting a zero sampling interval causes a divide-by-zero error, while a zero aggregation interval returns an incorrect value, also leading to division by zero. An excessively high aggregation interval can cause an out-of-bounds array access, resulting in memory corruption.

A bug in the Linux kernel's virtio_pci driver causes a NULL pointer dereference when unbinding a virtio_balloon device. The issue stems from incorrect indexing of the vqs_info array when queues are conditional (e.g., stats, free_page, reporting), creating holes. During device removal, a dense index (queue_idx) is used to look up in a sparsely populated array, leading to a crash.

In the Linux kernel's virtio hwrng driver, a buffer over-read vulnerability exists. A malicious or buggy virtio-rng backend can report an inflated used.len, causing memcpy() to read past the vi->data array into adjacent heap memory.

A use-after-free vulnerability was found in the Linux kernel's chaoskey driver in the chaoskey_release() function. When a user closes the device after USB unplugging, a debug log statement accesses the usb_interface structure after it has been freed, causing memory corruption.

In the Linux kernel's dwc3 USB driver, dwc3_gadget_suspend() calls the gadget disconnect callback with IRQs disabled, causing a Lockdep violation. The issue was found by a static analysis tool and manually confirmed.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's USB misc/usbio driver. During device disconnect, the usbio_disconnect() function iterated over clients and freed them, but the loop continued to access freed memory, causing a KASAN error. The fix replaces the loop with list_for_each_entry_safe_reverse() to prevent use after free.

In the Linux kernel's 6LoWPAN stack, a race condition in lowpan_nhc_do_uncompression() can lead to use-after-free of an NHC descriptor after releasing the lock. KASAN reported the issue as a slab-use-after-free.

A NULL pointer dereference vulnerability was found in the func_set_flag() function in the Linux kernel tracing subsystem. When the active tracer is switched from 'function' to another (e.g., 'wakeup_rt'), the current_trace_flags field becomes NULL, and the function reads it before verifying the tracer type, causing a kernel crash.

In the Linux kernel's vme_user driver (staging), the buffer_to_user() and buffer_from_user() helpers did not validate that offset + count stays within the fixed-size kern_buf (128 KiB). This allowed out-of-bounds reads/writes beyond the allocated buffer.

In the Linux kernel's SMB client (cifs), a vulnerability exists due to incorrect application of the +1 byte exemption for responses with a data area. The smb2_check_message() function accepts responses one byte longer than received, which leads to an out-of-bounds read when a data area is present. The issue is reachable during SMB negotiation and session setup, before full authentication.

In the Linux kernel's ipu7_isys_init() and ipu7_psys_init() functions, a double-free and use-after-free occur when kfree(pdata) is called again after the device teardown already freed it. Additionally, the error code is not saved before put_device(), causing ERR_CAST() to dereference a freed pointer.

In the rtl8723bs driver in the Linux kernel, a heap buffer overflow occurs in rtw_cfg80211_set_wpa_ie() when a local user sends a crafted WPA IE of length 255, causing memcpy to copy 257 bytes into a 256-byte buffer, overflowing into the adjacent last_mic_err_time field.

In the rtl8723bs driver in the Linux kernel, an underflow and OOB read occur in OnAuth() when a short authentication frame causes negative length calculation in rtw_wep_decrypt(), leading to out-of-bounds read. Also, memcmp always reads 128 bytes regardless of actual IE length.

In the rtl8723bs driver in the Linux kernel, an OOB read occurs in the IE loop in OnAssocRsp() when a malicious AP sends an AssocResponse with a truncated last IE, causing pIE->length to be read out of bounds. Also, declared IE length may extend beyond the buffer.

In the rtl8723bs driver in the Linux kernel, an OOB read occurs in the IE loop in update_beacon_info() when a malicious AP sends a Beacon with a truncated last IE, causing pIE->length to be read out of bounds. Also, declared IE length may extend beyond the buffer.

In the rtl8723bs driver in the Linux kernel, OOB reads occur in IE loops in issue_assocreq() and join_cmd_hdl() when IE data ends with only an element_id byte, causing pIE->length to be read out of bounds. A malicious AP can trigger this via crafted Beacon or Probe Response frames.