Linux kernel vulnerabilities

In the Linux kernel, SMB client with modefromsid active, parse_dacl() applies the server-provided sub_auth[2] value from the NFS mode SID to cf_mode without masking to 07777. The fix adds correct masking, same as in the read path.

A race condition between cgroup_writeback_umount() and inode_switch_wbs() in the Linux kernel causes a BUG_ON during filesystem unmount after container exit. This results in busy inodes and potential kernel panic.

In the cpufreq driver for Qualcomm devices, a double free vulnerability was found. The qcom_cpufreq_hw_cpu_exit() function calls kfree() on a pointer to devres-managed memory, which can lead to a double free when the device is detached.

In the firmware_loader subsystem, a device reference leak was found. The firmware_upload_register() function fails to release the device reference on error after initialization, causing a reference count imbalance.

In procfs, a race condition was found in proc_pid_get_link() and proc_pid_readlink(). The ptrace access check and task lookup are performed separately, allowing a race.

A vulnerability was found in the Linux kernel's RT_PUSH_IPI mechanism for the real-time (RT) scheduler. When RT_PUSH_IPI is enabled on a system without PREEMPT_RT, a live lock can occur on a CPU where softirqs run in interrupt context. This causes excessive IPI interrupts that slow down softirq processing, preventing context switching and leading to CPU lockup.

In cpufreq, a race between suspend and CPU hotplug operations during system reboot was found. The cpufreq_suspend() function lacks synchronization with hotplug, which can lead to a null pointer dereference.

In the pcc cpufreq driver, a use-after-free and double free were found during _OSC evaluation. After the first acpi_evaluate_object() call, the output buffer is freed but pointer and length are not reset, causing a write to freed memory on the second call.

In procfs, several functions lack exec_update_lock protection for ptrace_may_access(). Functions do_task_stat(), proc_pid_wchan(), proc_map_files_lookup(), proc_map_files_readdir(), proc_ns_get_link(), and proc_ns_readlink() perform access checks without proper locking.

In POSIX CPU timers, a PID reference leak was found in do_cpu_nanosleep(). On error after timer creation, the function does not release the PID reference, causing a leak.

On s390 architecture, support for DCACHE_WORD_ACCESS was reverted due to exception handling issues with pages donated to the Ultravisor. The load_unaligned_zeropad() function can cause an infinite exception loop.

In the Linux kernel's mm/slab subsystem, a bug was found in the memory zeroing mechanism during allocation. When only red zoning (SLAB_RED_ZONE) is enabled without tracking the requested size (SLAB_STORE_USER), kmalloc may zero only the requested size instead of the full object, breaking the __GFP_ZERO guarantees for krealloc.

In the HID driver for Goodix SPI devices (hid-goodix-spi), there is no validation of the report size before copying it into a 128-byte stack buffer. An attacker can send a report larger than ~116 bytes via the SET_REPORT ioctl, causing a stack buffer overflow.

In the Wacom HID driver (wacom_wac), the wacom_wac_queue_insert() function can call kfifo_skip() on an empty kfifo buffer, causing it to read garbage data and corrupt the internal kfifo state. This can lead to an out-of-bounds write beyond the 256-byte buffer, potentially writing up to 3842 bytes past the memory.

In the Linux kernel HID letsketch driver, a use-after-free (UAF) vulnerability was found in the inrange_timer during device unbind. The missing .remove callback allows the timer to fire on freed memory, leading to a security breach.

In the Linux kernel, a vulnerability in the HID multitouch driver causes out-of-bounds bit access on mt_io_flags, which is used as a per-slot bitmap but sized as unsigned long. This corrupts adjacent struct mt_device fields and leads to a kernel panic.

In the Linux kernel HID appleir driver, a Use-After-Free (UAF) vulnerability was found in appleir_remove(). The key_up_timer callback can fire after input_dev is freed, causing a use of freed memory. The fix introduces a 'removing' flag and timer synchronization.

A use-after-free vulnerability was found in the HID driver for Logitech G keyboards (lg-g15). The driver did not cancel pending work before freeing memory, allowing access to freed memory when the device is unplugged.

An unsigned integer overflow (u32) was found in the check_and_correct_requested_length function in HFS and HFSPlus filesystems in the Linux kernel. A large len value can wrap the off+len sum, bypassing bounds checking and leading to out-of-bounds buffer read.

In HFS and HFSPlus filesystems in the Linux kernel, the hfs_bnode_read function can return early without writing to the output buffer, leaving it uninitialized. Callers like hfs_bnode_read_u16 use the result unconditionally, leading to KMSAN uninit-value reports.

In the Linux kernel's nilfs2 filesystem, a vulnerability was found due to missing validation of segment numbers before starting segment cleaning operations. Invalid user-supplied segment numbers cause thread blocking while printing warnings, leading to system hangs.

In the MediaTek JPEG driver (mtk-jpeg) in the Linux kernel, the mtk_jpeg_release function calls cancel_work_sync even for variants that do not use the workqueue, causing a WARN_ON warning. The fix limits the call to platforms with a defined workqueue callback.

In the XFS filesystem in the Linux kernel, the xfs_exchmaps_estimate_overhead function adds bmbt and rmapbt overhead to a local resblks variable, but the final UINT_MAX check still tests req->resblks, the value before overhead was added. The check should apply to the computed value that is later used.

In the XFS filesystem in the Linux kernel, the xfs_dqinode_metadir_create() function does not free allocated transaction and update state when xfs_metadir_create() fails, causing a memory leak. The fix routes the error path through xfs_metadir_cancel() and releases the inode reference.

In the Linux kernel BTF parser, the btf_repeat_fields() function performs field count calculations in u32 arithmetic, which can wrap with malicious BTF. This bypasses capacity checks and leads to out-of-bounds write to the scratch array. The fix uses checked addition and multiplication.

In the Linux kernel BPF mechanism for ARRAY_OF_MAPS with the BPF_F_INNER_MAP flag, the verifier incorrectly elides lookup result nullness for constant keys, using the template max_entries instead of the concrete inner map. The fix does not elide nullness for maps marked with BPF_F_INNER_MAP.

A vulnerability was found in the Linux kernel's LPM trie map implementation in BPF, causing false lockdep warnings when sleepable BPF programs were executed. The issue involved incorrect RCU usage in trie_lookup_elem, trie_update_elem, and trie_delete_elem functions, which did not account for the rcu_read_lock_trace() context.

In the Linux kernel's USB Kalmia network driver, there is an out-of-bounds read vulnerability. The kalmia_rx_fixup() function incorrectly calculates the USB packet length, which can lead to reading beyond the allocated 14000-byte buffer.

In the Linux kernel's cdnsp USB driver, there is a memory leak during stream allocation. The cdnsp_alloc_stream_info() function does not free the stream context array (stream_ctx_array) if a stream ring allocation fails.

In the Linux kernel's dwc3 USB driver, there is a bug in the dwc3_readl() and dwc3_writel() calls within dwc3_ulpi_setup(). These functions are called with an incorrect argument (dwc3->regs instead of the dwc3 structure), which can lead to memory access errors.

In the Linux kernel's EHCI and FOTG210 USB drivers, there is a memory leak on failed isochronous submits. When a submit fails before linking the URB to the queue, the staged schedule (ehci_iso_sched) remains in urb->hcpriv and is not freed.

In the Linux kernel's USB gadget composite driver, there is an out-of-bounds read vulnerability in the USB_DT_OTG handler. The list_first_entry() function never returns NULL, so the if (!config) check is dead, leading to reading from an invalid address when the configuration list is empty.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's USB gadget subsystem. The issue occurs when gadget_match_driver() accesses freed udc structure memory, potentially leading to a NULL pointer dereference and system crash.

In the Linux kernel's USB gadget f_printer driver, there is a reference leak. The printer_open() function increments the reference count (kref) even on -EBUSY error when the device is already open, but VFS does not call release() for a failed open.

In the Linux kernel's idmouse USB driver, there is a use-after-free vulnerability on disconnect race. The mutex_unlock() function may access the mutex structure after releasing the lock, leading to use-after-free when release() races with disconnect().

In the Linux kernel's ldusb USB driver, there is a use-after-free vulnerability on disconnect race. The mutex_unlock() function may access the mutex structure after releasing the lock, leading to use-after-free when release() races with disconnect().

In the Linux kernel, the USB iowarrior driver has a use-after-free vulnerability on disconnect. Submitted write URBs are not stopped on close(), so they must be stopped unconditionally on disconnect() to prevent use-after-free in the completion handler.

In the Linux kernel, the USB iowarrior driver has a use-after-free vulnerability on disconnect race. mutex_unlock() may access the mutex structure after releasing the lock, so a kref is used to release driver data to avoid use-after-free in mutex_unlock() when release() races with disconnect().

In the Linux kernel, the USB legousbtower driver has a use-after-free vulnerability on disconnect race. mutex_unlock() may access the mutex structure after releasing the lock, so a kref is used to release driver data to avoid use-after-free in mutex_unlock() when release() races with disconnect().

In the Linux kernel, the usbio driver (usb: misc) has a slab-out-of-bounds read vulnerability. The usbio_bulk_msg() function copies data with a device-controlled length but checks it only against the transmit buffer (txbuf), not the receive buffer (rxbuf). A malicious USB device can exploit this mismatch to disclose adjacent kernel memory.

In the Linux kernel, the USB misc uss720 driver has a vulnerability where the parport is not unregistered on probe failure. uss720_probe() registers a parport before reading the 1284 register, and if get_1284_register() fails, the registration is not undone, leading to resource leaks and potential use of a freed pointer.

In the Linux kernel, the USB mtu3 driver has a vulnerability where DMA mapping is not unmapped on queue failure. mtu3_gadget_queue() maps the request before checking if the QMU GPD ring can accept a transfer, and if mtu3_prepare_transfer() fails, the request is returned with -EAGAIN without unmapping the DMA, leaving the DMA mapping active.

In the Linux kernel, the USB serial keyspan_pda driver has an information leak vulnerability. The write() callback should return the number of accepted characters, but the keyspan_pda implementation returns the number of submitted characters if the write urb is not in use. If this number is larger than the number of passed characters, the line discipline continues writing data from beyond the tty write buffer, leading to information leak.

In the Linux kernel, the USB serial digi_acceleport driver has a vulnerability where reception is broken after throttle. If the port is closed while throttled, the read urb is never resubmitted and the port will not receive further data until the device is reconnected. The fix clears throttle flags and submits the urb when opening the port.

In the Linux kernel, the USB serial digi_acceleport driver has a hard lockup vulnerability on disconnect. If submitting the OOB write urb fails persistently (e.g., during disconnect), the driver loops indefinitely with interrupts disabled. The fix adds error checking for urb submission when sending OOB commands.

In the Linux kernel, the USB serial digi_acceleport driver has a write buffer corruption vulnerability. The digi_write_inb_command() function should wait for the write urb to become available or return an error, but on timeout it updates the transfer buffer and tries to resubmit the urb. Additionally, for commands without timeout, corruption occurs immediately due to a broken jiffies comparison. The fix adds the missing return on timeout and waits indefinitely when no timeout is specified.

A memory leak was found in the Linux kernel's USB ULPI driver on registration failure. The allocated device name is never freed, causing a memory leak.

A NULL pointer dereference in the Linux kernel's usbip vudc driver in vep_dequeue(). The vrequest->udc field is uninitialized, causing a crash when cancelling FunctionFS AIO requests.

Missing SVID index validation in the Linux kernel's USB Type-C TCPM driver in svdm_consume_modes(). An invalid index can cause an out-of-bounds read and registration of a fake SVID.

A use-after-free bug in the Linux kernel's USB Type-C UCSI CCG driver on device removal. The interrupt handler may access the already freed ucsi structure.