Linux kernel vulnerabilities

A DMA fence object leak in the Linux kernel's USB gadget f_fs driver. The double reference to dma_fence is not properly managed, causing memory leak.

In the Linux kernel's USB gadget f_fs driver, the epfile->in field is initialized too late, causing incorrect DMA direction for early ioctl calls.

Missing condition to skip sync_blockdev() on surprise removal in the Linux kernel's bdev_mark_dead() function. This can cause a hang waiting for writeback.

NULL pointer dereference in the Linux kernel's mt7921 and mt7925 WiFi drivers in CSA beacon handlers. After station disconnection, the new_ctx pointer can be NULL.

Missing block extent validation in the Linux kernel's UDF filesystem in udf_free_blocks(). Out-of-bounds access to the space bitmap array can cause a kernel panic.

Missing VAT header length validation against the VAT inode size in the Linux kernel's UDF filesystem. This can lead to out-of-bounds read and potential kernel panic.

In the Linux kernel, the UDF filesystem has a vulnerability due to incorrect validation of the sparing table length. The function treats reallocationTableLen as a byte count, while it is actually a count of 8-byte entries, leading to out-of-bounds memory access.

In the Linux kernel, the NVMe over RDMA target subsystem has a reference leak in the queue connect path. The function nvmet_rdma_queue_connect() does not release the ndev reference when the host queue backlog is exceeded.

In the Linux kernel, the AIX partition parser has a vulnerability due to missing bounds on the ppe array scan. The pp_count field from disk can be larger than 1016, leading to out-of-bounds read beyond the allocated buffer.

In the Linux kernel's isofs filesystem, a vulnerability was found in the handling of Rock Ridge symbolic links. An attacker can craft an ISO image that triggers an out-of-bounds read of up to 255 bytes of kernel memory, which is then copied to user space via readlink().

In the Linux kernel, the CAAM cryptographic driver has a vulnerability where sensitive key material is leaked via hex dumps in *_setkey() and gen_split_key() functions. Using print_hex_dump() without guard can expose keys in logs when CONFIG_DYNAMIC_DEBUG is enabled.

In the Linux kernel, the CAAM cryptographic driver has a vulnerability where sensitive key material is leaked via hex dumps in *_setkey() functions. Using print_hex_dump() without guard can expose keys in logs when CONFIG_DYNAMIC_DEBUG is enabled.

In the Linux kernel, the chacha20poly1305 cipher implementation has a vulnerability due to missing validation of the poly1305 template argument. The chachapoly_create() function assumes the second template argument is always present, which can lead to dereferencing an error pointer in strcmp().

In the Linux kernel, the elliptic curve cryptography (ECC) implementation has a vulnerability due to a carry overflow bug in vli multiplication. The condition checking for overflow does not handle the case where r01.m_high is saturated (0xFFFFFFFFFFFFFFFF) and an additional carry exists from lower bits.

In the Linux kernel's pcrypt crypto subsystem, a bug was found where the original callback was not restored when falling back to direct AEAD invocation. As a result, an asynchronous completion could run the padata callback even though the request was never submitted to padata.

In the Linux kernel, the loongson-rng driver was removed due to multiple vulnerabilities, including lack of forward security and a use-after-free bug. The driver was unused and had no real purpose in the kernel.

In the Linux kernel's ccp (AMD) crypto driver, a bug was fixed where SNP was unnecessarily initialized during SEV ioctls that do not require it. Previously, this could zero out MSR_VM_HSAVE_PA, risking host crash.

In the Linux kernel's ccp (AMD) driver, a bug was fixed where SNP was unnecessarily initialized during the SNP_COMMIT ioctl. This command does not require any specific firmware state, and prior initialization could lead to security issues.

In the Linux kernel's ccp (AMD) driver, a bug was fixed where SNP was unnecessarily initialized during the SNP_VLEK_LOAD ioctl. Previously, initialization was pointless because the firmware immediately deletes the key on shutdown. Now the operation is rejected if SNP was not previously initialized.

In the Linux kernel's ccp (AMD) driver, a bug was fixed where SNP initialization was unnecessarily retried during the SNP_CONFIG ioctl. Now the operation is rejected if SNP was not previously initialized, preventing potential security issues.

In the Linux kernel's DRBG (CTR_DRBG) random number generator, a bug was fixed where drbg_ctr_generate() sometimes returned success despite failure, leaving the output buffer uninitialized.

In the Linux kernel's QAT (Intel) crypto driver, a synchronization bug was fixed where iterations over the service_table list were not protected by the service_lock. This could lead to list corruption or a use-after-free bug during concurrent service registration/removal operations.

In the Linux kernel's QAT (Intel) crypto driver, a bug was fixed where the lengths of CRT components (p, q, dp, dq, qinv) were not validated in qat_rsa_setkey_crt(). Overly long components could cause a DMA buffer overflow and memory corruption.

In the Linux kernel, the x86/mm function incorrectly frees PMD-sized vmemmap pages. The pagetable_free() function treats vmemmap pages as compound pages, freeing only the first page and leaking the remaining ones.

In the Linux kernel, the SCMI regulator driver has a device node reference leak. The scmi_regulator_probe() function fails to release the child node reference on error, leading to resource exhaustion.

In the Linux kernel's perf/aux subsystem, a use-after-free vulnerability exists in map_range(). Two events sharing the same ring buffer can race between allocation and page mapping, leading to use of a freed physical page.

In the Linux kernel's tracing subsystem, an out-of-bounds read exists in glob matching. The regex_match_glob() function ignores field length and scans until a NUL byte, causing reads beyond buffer boundaries for non-NUL-terminated fields (e.g., dynamic char arrays in xfs tracepoints).

In the Linux kernel's NFSv4 client, an access authorization flaw exists for O_TRUNC operations. The nfs_open_permission_mask() function does not include O_TRUNC in the permission mask, allowing local file open with read-only mode and simultaneous truncation, violating POSIX.

In the Linux kernel's module decompression code, the return value of module_extend_max_pages() is not checked. On allocation failure, info->pages remains NULL and info->max_pages is 0, leading to dereference of ZERO_SIZE_PTR and a kernel oops.

In the Linux kernel's exfat filesystem, an out-of-bounds read/write exists in exfat_find_dir_entry(). When processing directory entries with short name fragments, the uniname pointer advances by a fixed amount while name_len grows slower, allowing writes beyond the p_uniname->name buffer.

A vulnerability was found in the Linux kernel's page_ext iteration API. The page_ext_iter_next() function fails to validate whether the PFN belongs to a valid section, which during memory hotplug can cause a NULL pointer dereference. The issue occurs when the iterator exceeds the page count and accesses uninitialized memory.

In the Linux kernel, the mincore() and madvise(MADV_PAGEOUT) functions have an ownership check flaw. The owner_or_capable() check uses nop_mnt_idmap, ignoring the mount's idmap, leading to incorrect authorization decisions.

In the Linux kernel's iommufd subsystem, a bug exists in iommufd_veventq_fops_read(). The bound check for the normal vEVENT path uses sizeof(hdr) instead of sizeof(*hdr), causing an undercount on 32-bit architectures and writing past the user-supplied buffer.

In the Linux kernel iommufd subsystem, a vulnerability was found where memory for the event queue is allocated inside a spinlock. A user can allocate a very large queue, exhausting atomic memory reserves.

In the Linux kernel iommufd subsystem, a vulnerability was found due to missing upper bound on the event queue depth (veventq_depth). A user can allocate a very large queue, exhausting kernel memory.

In the Linux kernel iommufd subsystem, a vulnerability was found with an infinite loop in iommufd_fault_fops_read(). On a copy_to_user() failure, the inner loop breaks but the outer while retries, causing 100% CPU usage and holding the mutex.

In the Linux kernel iommufd subsystem, a vulnerability was found due to missing upper bounds on entry_num and entry_len in iommufd_hwpt_invalidate(). Large values can cause soft-lockup or CPU stall.

In the Linux kernel KVM for ARM64, a vulnerability was found with a NULL pointer dereference in the VNCR pseudo-TLB during invalidation. The function kvm_invalidate_vncr_va() does not check if the pseudo-TLB is allocated, potentially causing a crash.

In the Linux kernel KVM for ARM64, a vulnerability was found due to missing clamping of used_lrs when copying vGIC state to the pKVM hypervisor. The host can provide a value exceeding the number of implemented list registers, leading to out-of-bounds access at EL2.

In the Linux kernel KVM for ARM64, a vulnerability was found due to not clearing __hyp_running_vcpu when copying vCPU context to the pKVM hypervisor. The host can provide a value that is then dereferenced at EL2.

In the Linux kernel KVM for AMD SEV, a vulnerability was found due to not pinning the source page for write when adding CPUID data for an SNP guest. KVM writes back corrected CPUID data, but if the page is read-only, it can clobber read-only memory.

In the Linux kernel KVM for x86, a vulnerability was found where fastpath userspace exits are handled before vendor-specific code runs. This can lead to missing operations such as flushing the PML buffer before returning control to userspace.

In the Linux kernel KVM guest_memfd component, a vulnerability was found where the memslot binding offset and size are treated as signed values instead of unsigned. This causes a false negative in overflow checking of offset+size against the file size, potentially allowing an absurdly large offset.

In the Linux kernel, KVM for ARM64 leaks a PFN when kvm_translate_vncr() races with an MMU notifier. The early return does not release the reference to the faulted-in page.

In the Linux kernel, a vulnerability in the svcrdma component causes threads waiting in svc_rdma_sq_wait() to hang indefinitely in TASK_UNINTERRUPTIBLE state during transport close. The lack of explicit wake-up prevents threads from checking the XPT_CLOSE flag, blocking svc_rdma_free() and resource release.

In the FPGA DFL-AFU driver, DMA mapping length from userspace via the DFL_FPGA_PORT_DMA_MAP ioctl is not validated. A large value can cause implicit truncation to int, leading to a buffer overflow.

In the Linux kernel I2C subsystem, there is a race during adapter deregistration. An adapter can be looked up via i2c_get_adapter() after its resources have been freed, leading to a use-after-free.

In the imx-lpi2c I2C driver for i.MX platforms, the adapter is not marked as suspended during suspend/resume. In the window between suspend_noirq and actual suspend, and between resume and resume_noirq, I2C transfers may be initiated when hardware resources are unavailable, risking a system hang.

In the Synaptics RMI4 (F3A) driver, the keymap is allocated for at most 6 entries, but the GPIO count (0-127) is not bounded. A device with gpio_count > 6 causes out-of-bounds read in the interrupt and via EVIOCGKEYCODE/EVIOCSKEYCODE ioctls, potentially leaking adjacent slab memory to userspace.

In the Synaptics RMI4 (F30) driver, the keymap is allocated for at most 6 entries, but the GPIO/LED count (0-31) is not bounded. A device with gpioled_count > 6 causes out-of-bounds read in the interrupt and via EVIOCGKEYCODE/EVIOCSKEYCODE ioctls, potentially leaking adjacent slab memory to userspace.