Linux kernel vulnerabilities

In the rtl8723bs driver in the Linux kernel, OOB reads occur in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() due to missing bounds checks before reading IE/attribute headers and comparing multi-byte OUI identifiers.

In the rtl8723bs driver in the Linux kernel, an OOB write occurs in HT_caps_handler() which iterates over pIE->length bytes and writes into a fixed 26-byte array. A malicious AP can set pIE->length up to 255, causing up to 229 bytes of out-of-bounds writes.

In the Linux kernel, a use-after-free vulnerability was found in the Intel QAT driver during SR-IOV disable. The adf_disable_sriov() function destroys per-VF structures without stopping or synchronizing VF2PF workers, leading to freed memory dereference. The fix adds a vf2pf_disabled flag and synchronizes interrupts and workqueue.

A use-after-free vulnerability was discovered in the Linux kernel's ksmbd module. It occurs when a SMB2_CLOSE on a locking handle is followed by a SMB2_CANCEL request for the same AsyncId, causing a freed file_lock structure to be reused, leading to memory corruption.

In the Linux kernel, the pfkey_msg2xfrm_state() function fails to initialize the alg_key_len field for IPComp states (SADB_X_SATYPE_IPCOMP). This leaves uninitialized slab data, which is later used by xfrm_algo_clone() during state migration (XFRM_MSG_MIGRATE), causing a slab-out-of-bounds read and potential KASAN error.

Data races were discovered in the Linux kernel when reading the audit_queue length via skb_queue_len(). Multiple threads read this field without locking, while writes are protected by a spinlock, leading to inconsistent reads.

A use-after-free (UAF) vulnerability was found in the Linux kernel's Bluetooth L2CAP stack in the l2cap_chan_timeout() function. When a channel timeout is set and the connection is torn down before the timer expires, the timeout handler accesses freed connection memory, causing memory corruption. The fix ensures the connection reference is held for the channel's lifetime.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's Bluetooth MGMT subsystem in the add_device_complete function. It accesses the hci_conn_params object without proper locking, allowing a concurrent remove_device operation to free the memory before it is read.

In the Linux kernel NTFS3 driver, a slab out-of-bounds write vulnerability was found during $LogFile journal replay. An attacker can craft an NTFS image where the lcns_follow field in a log record exceeds the DPT entry capacity, causing a write beyond allocated memory.

In the Linux kernel NTFS driver, a vulnerability was found where post_write_mst_fixup() is called for an invalid index block. An attacker can craft a malicious NTFS image, leading to out-of-bounds memory read or write.

In the NTB (Non-Transparent Bridge) driver for PCIe EPF devices, a problem was found where pci_irq_vector() is called in hardirq context. This function uses a mutex, leading to a 'scheduling while atomic' error and potential system hang.

In the GPIO EIC (External Interrupt Controller) driver for Spreadtrum SoCs, a regular spinlock (spinlock_t) is used in the irq_startup path. On PREEMPT_RT systems, spinlock_t becomes a sleeping lock, causing a 'sleeping function called from invalid context' error.

In the Linux kernel, the GPIO SCH driver has a locking issue in the IRQ startup path. The sch_irq_unmask() function uses a regular spin_lock, which on PREEMPT_RT systems becomes a sleeping lock, causing a bug when called from a non-sleepable context. The fix replaces the lock with raw_spinlock_t, suitable for IRQ context.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the HID logitech-dj driver during DJ_SHORT report validation. The issue occurs when a crafted HID descriptor contains only padding output items, leaving maxfield as zero, and the code dereferences field[0] in the error path.

In the Linux kernel, the io_uring subsystem has a file reference leak in the NOP operation. When a NOP request is submitted with the IOSQE_FIXED_FILE flag but without IORING_NOP_FIXED_FILE, the file is acquired via fget() and never released, causing a memory leak. The fix decides file acquisition based on the REQ_F_FIXED_FILE flag, as in other operations.

In the Linux kernel, the io_uring/io-wq subsystem has an issue with handling the exit flag (IO_WQ_BIT_EXIT) for linked work items. Despite a previous fix, the exit flag was checked only once before processing an entire chain of linked tasks, allowing work to continue after exit began. The fix moves the check inside the loop, covering all linked items.

A use-after-free bug was found in the Linux kernel's netpoll mechanism during shutdown. The issue occurs when a pending TX worker runs in parallel with the cleanup routine, leading to access to already freed memory.

A vulnerability was found in the Linux kernel's IGMP implementation for IPv4. During network device destruction, multicast groups are not removed from the hash table (mc_hash), leading to a use-after-free condition under concurrent RCU access.

In the Linux kernel, the TCP/IP stack has a vulnerability due to missing validation of the net.ipv4.tcp_reordering sysctl value. Negative values written to this sysctl are copied to the tp->reordering field as u32, causing wrap to large values. This can lead to overflow in MTU size calculations and out-of-bounds read. The fix adds validation via proc_dointvec_minmax() and secures calculations by using u64.

In the Linux kernel, the NXP i.MX8 ISI media driver has a use-after-free bug during module removal. The function mxc_isi_remove() calls mxc_isi_crossbar_cleanup() before mxc_isi_v4l2_cleanup(), freeing media entity pads and then attempting to remove links referencing those freed pads. The fix reverses the call order.

In the Linux kernel, the MFD ChromeOS Embedded Controller driver has a use-after-free bug due to premature drvdata setting. The function ec_device_probe() set drvdata before initialization completed, allowing sub-drivers to access freed memory after a failed probe. The fix delays drvdata setting until initialization succeeds.

In the Linux kernel, the shrinker mechanism has a bug where RCU lock is held while calling the ->count_objects() callback in shrinker_debugfs_count_show(). The zswap_shrinker_count() function may sleep via css_rstat_flush(), which is not allowed in an RCU critical section. The fix removes rcu_read_lock()/rcu_read_unlock(), as they are unnecessary.

A race condition in the Linux kernel's shrinker_info teardown and expansion logic was discovered. The expand_shrinker_info() function iterates over memcgs that may not have completed online, while alloc_shrinker_info() frees memory outside the shrinker_mutex lock, leading to potential double-free or use-after-free. This affects memory management in cgroup environments.

In the Linux kernel, the shrinker debugfs mechanism has a NULL pointer dereference bug. The shrinker_debugfs_add() function creates "count" and "scan" debugfs files for every shrinker, assuming each implements both count_objects() and scan_objects(). However, some shrinkers (e.g., xen-backend) only set count_objects(), leaving scan_objects() as NULL, causing a kernel panic when writing to the "scan" file.

A NULL pointer dereference vulnerability in the Linux kernel's lookup_swap_cgroup_id() function on swapless hosts. The function fails to verify that the swap type is registered, causing a system crash when accessing a corrupted PTE entry.

In the Linux kernel, the swap_reclaim_full_clusters() function lacks a cond_resched() call, which can lead to a softlockup on large systems with many CPUs and a large swap device. During heavy reclaim of full swap clusters, the loop may run too long without yielding the CPU, causing a softlockup.

In the Linux kernel netfilter subsystem, there is an issue with unreadable packet fragments (e.g., from devmem TCP). The skb_copy_bits() function returns an error, but the xt_u32 module does not handle it properly. Additionally, gather_frags, nfnetlink_queue, and nfnetlink_log do not cope with such fragments.

In the Linux kernel ebtables subsystem, the chainstack array is not zeroed before use. If cpu_possible_mask is sparse (e.g., CPU 0 and 2 are possible, but CPU 1 is not) and allocation for CPU 2 fails, the cleanup loop may call vfree() on an uninitialized pointer, leading to a potential bug.

In the Linux kernel ebtables subsystem, module names are not properly null-terminated. The request_module() function may receive a non-null-terminated string, leading to potential buffer overflow or incorrect module loading.

In the Linux kernel ebtables subsystem, the update_counters() and compat_update_counters() functions pass a 32-byte table name to find_table_lock() without null-termination. On a lookup miss, try_then_request_module() attempts to load a module, and vsnprintf() reads beyond the name boundary, causing a stack-out-of-bounds read (KASAN).

In the Linux kernel Bluetooth btmtksdio driver, there is an infinite loop in the btmtksdio_txrx_work() function. The bug is due to incorrect use of time_is_before_jiffies() in the loop condition. After the 5-second timeout expires, the condition becomes always true, causing an infinite loop and locking the SDIO host.

In the Linux kernel, the Bluetooth bnep driver reads an L2CAP connection without holding the channel lock during netdev registration, leading to a use-after-free if the controller is torn down concurrently. The fix pins the L2CAP connection reference before registration.

In the Linux kernel Bluetooth btnxpuart driver, an out-of-bounds read occurs in nxp_recv_fw_req_v3() because the offset and length are not validated against the firmware image size, allowing a controller to read past the buffer and send memory over UART.

In the Linux kernel, bt_accept_dequeue() has a use-after-free vulnerability because it drops a temporary reference before bt_accept_unlink(), leading to access to freed memory when the reference was the last one.

In the Linux kernel Bluetooth subsystem, a null pointer dereference was found in hci_abort_conn(). The issue occurs when hdev->sent_cmd is NULL while req_status is HCI_REQ_PEND, potentially causing a system crash.

In the Linux kernel Bluetooth ISO driver, iso_conn_big_sync() can cause a NULL pointer dereference because after releasing the socket lock, the connection may be torn down, and the function reads conn->hcon without re-checking conn validity.

In the Linux kernel Bluetooth L2CAP stack, l2cap_get_conf_opt() reads the option value before verifying that the full option fits in the buffer, allowing an attacker-controlled length to cause an out-of-bounds read of up to 4 bytes.

In the Linux kernel coresight ultrasoc-smb driver, smb_sync_perf_buffer() can write out of bounds of the dst_pages[] array because the initial page index is not normalized modulo the AUX buffer size, leading to an out-of-bounds write.

In the Linux kernel, a vulnerability was found in the SMB client where cifs_swn_notify() uses a stale tcon pointer after memory is freed, leading to use-after-free. The issue arises from the lack of a stable reference to tcon in SWN registration when multiple mounts share the same registration ID.

In the Linux kernel ksmbd SMB server, a path traversal bypass exists in __ksmbd_vfs_kern_path() because the -EXDEV error from vfs_path_parent_lookup() is not intercepted, allowing the caseless retry logic to create files or directories outside the shared resource.

In the Linux kernel, the ksmbd filesystem lacks a permission check for the FSCTL_SET_ZERO_DATA operation. An authenticated SMB client can use a handle opened only with FILE_WRITE_ATTRIBUTES to zero file data without FILE_WRITE_DATA rights.

In the Linux kernel, the ksmbd filesystem has a use-after-free vulnerability in the file_lock structure during deferred lock cancellation. When a lock is cancelled and the work is no longer active, freeing the lock before removing it from the async list leads to accessing freed memory.

In the Linux kernel, the ksmbd filesystem lacks a read permission check for the source file during the duplicate extents operation (FSCTL_DUPLICATE_EXTENTS_TO_FILE). A handle opened only with attribute access can be used to copy file contents to an attacker-readable destination.

In the Linux kernel's ksmbd (SMB) filesystem, a missing WRITE_DAC/WRITE_OWNER permission check in the SMB2 SET_INFO SECURITY operation allows a client with a low-privilege handle (e.g., FILE_WRITE_ATTRIBUTES) to rewrite the file's security descriptor and gain unauthorized access.

In the Linux kernel, the ksmbd filesystem has a lock management issue with SMB3 multichannel. A byte-range lock can be removed from the connection list using the wrong spinlock, leading to access to freed objects during concurrent list traversal.

In the Linux kernel, the ksmbd filesystem validates the NTLMv2 response after updating the session key. On authentication failure, the session key can be modified before the error is returned, allowing a client to change the session key of an existing binding session.

In the Linux kernel, SMB3 client with POSIX Extensions ignored chown/chgrp changes unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID were set. The fix checks for posix_extensions in cifs_setattr_nounix() to properly call id_mode_to_cifs_acl() and set ownership/group on the server.

In the Linux kernel, SMB client has a double-free vulnerability in SMB2_open() replay. A response-bearing attempt can free its buffer, and if SMB2_open_init() fails before the next send, cleanup frees the same buffer again. The fix resets response bookkeeping before each attempt.

In the Linux kernel, SMB client function receive_encrypted_standard() allocates next_buffer before checking if the number of compound PDUs reached MAX_COMPOUND. If the limit is exceeded, the function returns immediately and the allocated next_buffer is leaked. The fix moves the MAX_COMPOUND check before allocating next_buffer.

In the Linux kernel, SMB client function posix_info_sid_size() reads sid[1] for subauthority count, but its boundary check still accepts buffers with only one remaining byte. The fix requires two bytes before reading sid[1] so all client paths safely reject truncated POSIX SIDs.