Linux kernel vulnerabilities

In the Linux kernel, the qnx4 filesystem uses buffer_heads, which do not handle block size > PAGE_SIZE well. Without the fix, mounting triggers BUG_ON(offset >= folio_size(folio)) in folio_set_bh on the first __bread_gfp call.

In the Linux kernel, the jfs filesystem uses buffer_heads, which do not handle block size > PAGE_SIZE well. Without the fix, mounting triggers BUG_ON(offset >= folio_size(folio)) in folio_set_bh on the first __bread_gfp call.

In the Linux kernel, the hpfs subsystem does not correctly handle set_blocksize failures. The hpfs filesystem uses buffer_heads, which do not support block sizes larger than PAGE_SIZE, causing a BUG_ON in folio_set_bh during mount.

Similarly to hpfs, omfs in the Linux kernel fails to handle set_blocksize errors. The filesystem uses buffer_heads that do not support block sizes larger than PAGE_SIZE, leading to a BUG_ON in folio_set_bh during mount.

In the usbip vhci_hcd driver, status_show_vhci does not properly check for a NULL value from platform_get_drvdata(). If a VHCI controller probe fails (e.g., due to USB bus number exhaustion), hcd is NULL and hcd_to_vhci_hcd() dereferences a NULL pointer.

In the Linux kernel (USB HCD) there is a possible deadlock during control transfers to root hubs. When handling SCSI errors, memory allocations must not trigger I/O, but device resetting involves control transfers to the parent hub (possibly a root hub); usbcore does not properly pass flags to usb_submit_urb() in such cases. The issue affects all storage drivers.

In the USB gadget goku_udc driver, there is a NULL pointer dereference in the log when an INT_USBRESET interrupt occurs. If the controller raises a USB reset before any gadget driver is bound (or after unbinding), dev->driver is NULL and the INFO() call dereferences it, causing a crash.

In the Linux kernel's 8250 serial driver, there is a vulnerability due to missing FIFO error IRQ (FIFOE) handling. During the startup phase this can cause a soft lockup in the ISR because reporting IRQ_HANDLED without handling the error immediately retriggers the IRQ.

In the Linux kernel, the function serial8250_register_8250_port() has a NULL dereference vulnerability when both the existing uart slot and up have a NULL ->dev. The code only checks if up->port.dev is non-NULL, but then unconditionally calls has_acpi_companion(uart->port.dev), leading to a NULL dereference and kernel crash.

In the Linux kernel, a driver core issue causes a spurious kernel warning when removing a device whose supplier is in the process of unbinding. This occurs when the supplier's link status is not DL_DEV_DRIVER_BOUND but DL_DEV_UNBINDING, which is legitimate during cascading consumer unbinding. The warning is triggered in __device_links_no_driver during driver removal, e.g., for lan966x_pci.

A use-after-free vulnerability was found in the Linux kernel's virt: acrn module during eventfd shutdown. A race between acrn_irqfd_deassign() and the EPOLLHUP wakeup can free the same hsm_irqfd structure twice, allowing an attacker to exploit a dangling pointer. The issue was fixed by adopting the KVM irqfd lifetime model.

In the Linux kernel (RDMA/counter) there is a leak of the num_counters variable in alloc_and_bind() when __rdma_counter_bind_qp() fails. The error path does not decrement num_counters, which, after repeated failures, can permanently prevent the port from switching to AUTO mode (-EBUSY) and block the MANUAL→NONE auto-revert.

A vulnerability was fixed in the Linux kernel's RDS module where RDS_INFO_* getsockopt options did not filter the global lists they read by the caller's network namespace. An unprivileged user in a fresh user and network namespace could read the addresses and sequence numbers of every RDS socket and connection on the host.

In the Linux kernel, the tegra/soctherm driver did not unregister cooling devices on module removal, leaving the thermal framework with references to freed memory. The change switches to devm-based registration, which automatically releases resources and fixes the issue.

In the Linux kernel, the iwlwifi driver (MLD mode) has a vulnerability causing a kernel panic during failed reconfiguration after a NIC error. The issue stems from processing asynchronous notifications from dead firmware that reference freed memory (dangling pointer). The fix purges notifications immediately upon NIC error notification.

In the Linux kernel, rapl_add_package_cpuslocked() in powercap/intel_rapl returns an error without freeing the previously allocated rapl_package structure, leaking memory on every failed package addition. The fix uses the existing err_free_package label to release the allocation.

In the Linux kernel, after a router temporarily deprecates an IPv6 prefix and later restores it, the kernel permanently loses the ability to generate temporary privacy addresses (RFC 8981) for that prefix. The fix resets the regen_count check for the latest temporary address when processing an incoming Router Advertisement.

In the Linux kernel, the ACPICA component fixes the condition check for AML_ELSE_OP in acpi_ps_parse_loop() to prevent out-of-bounds access. The flaw could lead to reading or writing outside the allowed memory region.

In the Linux kernel, the ACPICA component fixes a use-after-free in acpi_ds_terminate_control_method() by clearing references to method locals and arguments. The flaw could lead to use of freed memory.

In the Linux kernel, the ACPICA component adds boundary checks in acpi_ps_get_next_field() to prevent out-of-bounds access. The flaw could lead to reading or writing outside the allowed memory region.

In the Linux kernel, the ACPICA component adds validation of package length reading in acpi_ps_get_next_package_length(). The lack of validation could lead to improper processing of AML data.

In the Linux kernel, the ACPICA component prevents adding invalid references for local, argument, and debug objects in acpi_ut_copy_simple_object(). The flaw could lead to an invalid internal state of the ACPI interpreter.

An integer overflow exists in the Linux kernel's ACPICA function acpi_ex_opcode_3A_1T_1R() (mid_op). Missing overflow check for Index + Length can result in a negative size being passed to memcpy().

In the Linux kernel, ACPICA lacks validation of handler object type in acpi_ev_has_default_handler() and acpi_ev_find_region_handler(). This may allow improper operations on handler objects.

In the Linux kernel, ACPICA lacks package limit checks in parser functions. This may allow out-of-bounds access.

In the Linux kernel, ACPICA lacks validation for node in acpi_ns_build_normalized_path(). This may lead to use-after-free vulnerabilities.

In the Linux kernel, ACPICA enhanced OEM ID and Table ID validation in acpi_ex_load_table_op(). Lack of this validation could lead to buffer overflows.

In the Linux kernel, ACPICA's acpi_ns_custom_package() unconditionally dereferences the first element of the _BIX package without a NULL check. When firmware returns a _BIX package with an unresolvable reference, ACPICA evaluates it to NULL, causing a crash.

In the Linux kernel, a vulnerability in ACPICA was fixed by enhancing buffer validation in acpi_ut_walk_aml_resources(). Insufficient checks could lead to buffer overflows.

In the Linux kernel, a vulnerability in ACPICA was fixed by adding boundary checks in acpi_ps_get_next_namestring() and acpi_ps_peek_opcode(). Missing checks could lead to out-of-bounds access.

In the Linux kernel, a problem in perf/ftrace was fixed where perf_ftrace_function_unregister() called unregister_ftrace_function() without checking whether the ftrace_ops was successfully registered. This triggered a WARN_ON in __unregister_ftrace_function() when FTRACE_OPS_FL_ENABLED was not set.

In the Linux kernel, a vulnerability in the ath11k wifi driver was fixed where in certain cases hardware could provide packets with a length greater than the maximum native Wi-Fi header length. This could lead to invalid data access and memory corruption in ath11k_dp_rx_h_undecap_nwifi().

In the Linux kernel, a vulnerability in the ata: ahci driver was fixed where when an AHCI controller is disabled in BIOS, the HOST_CAP register may contain a bogus value (e.g., 0xFFFFFFFF). If CAP.NP claims more ports than can physically fit within the mapped BAR region, accessing port registers beyond the BAR boundary causes a kernel panic.

In the Linux kernel, a node refcount leak in net: qrtr was fixed. qrtr_send_resume_tx() calls qrtr_node_lookup() which takes a reference on the returned node. If the subsequent call to qrtr_alloc_ctrl_packet() fails due to memory allocation failure, the function returns -ENOMEM without releasing the node reference.

A vulnerability in the Linux kernel's NTFS3 filesystem can lead to a NULL pointer dereference during file writes after toggling system.ntfs_attrib and overwriting system.dos_attrib. The issue arises from overwriting full DOS attributes, causing inconsistency between compression flags and memory mapping operations. The fix preserves non-DOS attribute bits to maintain consistent compressed and sparse state.

In the Linux kernel, a vulnerability in ntfs3 was fixed involving out-of-bounds read in ntfs_dir_emit() and hdr_find_e(). The bounds check in ntfs_dir_emit() did not account for UTF-16LE encoding (2 bytes per character) or the ATTR_FILE_NAME header size, allowing reads past the entry boundary.

In the Linux kernel, a problem in dpaa2-switch was fixed regarding FDB management on the bridge leave path. dpaa2_switch_port_set_fdb() always allocated a new FDB for a port becoming standalone, which in the case of multiple bridges on the same DPSW led to multiple ports sharing the same FDB.

In the Linux kernel, the DSA sja1105 driver's dsa_port_from_netdev() may return a port belonging to a different switch chip. Programming another chip's port index into the local hardware causes redirection to the wrong port or an out-of-bounds access if the index exceeds the local chip's port count.

In the Linux kernel, the dpaa2-switch driver shares NAPI instances for a DPSW device across all ports, but they are only disabled once the last port goes down. On the .remove() path, ports are unregistered one at a time, causing NAPI instances to be deleted even though they are not disabled.

In the Linux kernel, the NVMe driver lacks validation of descriptor sizes while walking the FDP configurations log. A descriptor with dsze == 0 or one past the log end can cause unbounded iteration or reads past the buffer.

In the Linux kernel, the iwlwifi (mvm) driver's P2P-Device binding handling can leave the phy_ctxt pointer as a PHY cache after remain-on-channel ends. A subsequent binding update by the station interface re-adds the P2P-Device to the binding, and its removal deletes the PHY context still in the binding, causing a firmware crash.

In the Linux kernel, the drm/amd/display driver's separate call to dc_update_planes_and_stream for a stream and its phantom stream causes a NULL pointer dereference, since the phantom is destroyed on the first call.

In the Linux kernel, the xhci driver may queue new commands on the command ring even when the xHC is marked inaccessible via HCD_FLAG_HW_ACCESSIBLE. This flag is set and cleared during suspend and resume.

In the Linux kernel, the drm/amdkfd driver's wait_on_destroy_queue() drops locks to wait for queue resume, allowing a concurrent destroy to free the queue and cause a use-after-free (UAF).

In the Linux kernel, the drm/amdgpu driver's FRU PIA parsing uses an open-coded TLV walk without read bounds. Replacing it with fru_pia_advance() and fru_pia_copy_field() helpers bounds every read by the actual EEPROM data length.

In the Linux kernel, the drm/amd/pm driver's pp_dpm_set_pp_table() uses memcpy with a size from the sysfs store count (up to PAGE_SIZE) without an upper bound, while the hardcode_pp_table buffer is allocated once with soft_pp_table_size. This causes a heap overflow.

In the Linux kernel, the drm/amdgpu/pm driver's SmartShift bias sysfs store handler returns a parse error after acquiring PM access, causing an unbalanced PM reference count.

In the Linux kernel, a buffer overflow vulnerability exists during vBIOS update in the drm/amdgpu driver. The write position is not clamped to the maximum buffer size, potentially allowing out-of-bounds access. The fix adds a clamp that blocks unsafe access via the VFS layer.

In the Linux kernel, the drm/amdgpu/ras driver has an issue with cp_ecc_error_irq interrupt handling. The interrupt is acquired in one place and released in another, potentially leading to double-release or use-after-free. The fix moves the release to appropriate functions and adds a ras_suspend callback.

In the Linux kernel, the cxl/region driver has an out-of-bounds array access vulnerability. The construct_region() function uses the part value to index an array without checking for a negative value. If the partition is not resolved, part remains -1, causing an invalid memory access.