Linux kernel vulnerabilities

In the Linux kernel, the drm/amdkfd driver has an information leak vulnerability across processes. The kfd_smi_ev_enabled() function skips the privilege check for pid=0, and PROCESS_START, PROCESS_END, and VMFAULT events are emitted with pid=0 while carrying other processes' data. This allows users in the render group to monitor all GPU workloads.

In the Linux kernel, the ib_umem_find_best_pgsz() function has boundary condition issues, especially on 32-bit architectures. The iova value may be truncated, and lengths greater than 4GB can overflow. The fix uses proper u64 arguments and adds necessary checks.

A vulnerability in the Linux kernel's BPF sysctl replacement mechanism lacks NUL termination in the buffer passed to handlers, leading to out-of-bounds reads in parsers like bitmap_parse. The fix appends a '\0' to restore expected semantics.

In the Linux kernel, the HSR driver has an issue with sending netlink notifications to the wrong network namespace. The functions hsr_nl_ringerror() and hsr_nl_nodedown() use genlmsg_multicast(), which only delivers in the default init_net namespace, while HSR devices can operate in other namespaces. This causes events to not reach the appropriate recipients.

In the Linux kernel, the ALSA es18xx driver has a possible NULL pointer dereference during control creation. The snd_es18xx_mixer() function does not check if the control allocation succeeded, which under memory pressure could lead to a NULL pointer access.

In the Linux kernel, the netfilter nf_conntrack module has an alignment issue in the tcp_sack() function. The timestamp-only fast path dereferences the option stream as a __be32 value, assuming 4-byte alignment that TCP options do not guarantee. Using get_unaligned_be32() is safer.

In the Linux kernel, a vulnerability in the Btrfs filesystem causes a null-pointer dereference during balance operations when corrupted metadata leaves a chunk entry without a corresponding block group in the in-memory cache. The function btrfs_may_alloc_data_chunk() fails to properly check the result of the block group lookup, leading to a kernel crash when CONFIG_BTRFS_ASSERT is disabled.

In the Linux kernel, the btrfs tree-checker did not validate names in ROOT_REF and ROOT_BACKREF items. A corrupted item could cause readers to use the on-disk name length directly, leading to out-of-bounds reads and copying too many bytes into the UAPI buffer in BTRFS_IOC_GET_SUBVOL_INFO. Validation was added in tree-checker and the copy length was limited to the validated name length.

In the Linux kernel, the ASoC driver for MediaTek mt8365, mt8365_afe_suspend(), did not check the result of the register backup buffer allocation, which could lead to a NULL pointer dereference. A missing NULL check was added and the error is now propagated in mt8365_afe_dev_runtime_suspend() to avoid updating the suspended state on failure.

In the Linux kernel, in the pds_core driver, pdsc_teardown() freed DMA buffers without disabling bus mastering, which could lead to use-after-free if the device wrote to freed memory. pci_clear_master() was added before freeing resources, and pci_set_master() was added in pdsc_setup() for the firmware recovery path.

In the Linux kernel, in the IBM EMAC MAL network driver, mal_remove() called napi_disable() unconditionally, which could lead to a system hang if NAPI was not enabled or was already disabled. The fix is to call napi_disable() only when the commac list is not empty.

In the Linux kernel, in netconsole, drop_netconsole_target() unlinked the target while only holding target_list_lock, while another thread (cleanup worker) could be iterating target_cleanup_list under target_cleanup_list_lock. This could lead to list corruption. The fix is to acquire target_cleanup_list_lock around list_del() to serialize the operations.

In the Linux kernel, in Bluetooth L2CAP, l2cap_recv_frame() read the two-byte PSM from connectionless frames without checking if the frame contained enough data. A malformed frame with zero or one byte payload could cause an out-of-bounds read. Frames that cannot contain the PSM are now rejected.

In the Linux kernel, in the ASoC rockchip_pdm driver, rockchip_pdm_set_fmt() ignored the return value of pm_runtime_get_sync(), which could lead to register access without power if resume fails. It was replaced with pm_runtime_resume_and_get() and an early return on failure was added.

In the Linux kernel's stmmac network subsystem for XGMAC2, the RBUE (RX Buffer Unavailable) interrupt was enabled by default, causing a MAC interrupt storm under heavy RX load. The fix disables RBUE in the default interrupt mask because it is redundant—the normal RIE interrupt already triggers NAPI and refills descriptors. This prevents the storm while maintaining normal RX handling.

In the Linux kernel SMB client, the cifsd thread can access the tcp_ses structure before the parent thread finishes populating it, causing a race condition. Additionally, the kthread_run macro may start the thread before returning the thread pointer, so if the kernel is preempted the thread sleeps waiting for SIGKILL. The fix moves thread creation after all tcp_ses fields are populated and splits kthread_create from wake_up_process.

In the Linux kernel exfat filesystem, when the upcase table size is zero in the dentry (e.g. due to corrupted media), an integer overflow causes the module to loop indefinitely. The fix avoids loading the table when size is zero, falls back to the default upcase table, and marks the volume read-only if no table is found.

In the Linux kernel virtio-fs, virtio_fs_setup_vqs() frees fs->vqs and fs->mq_map on the error path, then virtio_fs_ktype_release() frees them again, causing a double-free and dangling pointers. The fix sets the pointers to NULL after kfree() so the later release is harmless. This can be triggered when a broken virtio-fs device advertises more request queues than the transport provides.

In the Linux kernel HID hidpp driver, if input_register_device() fails, input_free_device() is called but a stale pointer to the old device remains in hidpp->input, potentially leading to a use-after-free. The fix resets it to NULL before returning from hidpp_connect_event().

In the Linux kernel SPI subsystem, spi_get_device_match_data() does not check whether spi_get_device_id() returns NULL, which can lead to a NULL pointer dereference. This can happen when using driver_override without a matching SPI ID entry. The fix adds a NULL check.

In the Linux kernel TLS subsystem, the integration of TLS with sockmap (BPF psock) hides many latent bugs that are potentially exploitable. Since no active users of this integration were found, the fix rejects attempts to configure TLS keys on sockmap sockets. Adding a TLS socket to a sockmap was already rejected by sk_psock_init().

In the Linux kernel drm/amdkfd driver, the buffer size returned to user space in the AMDKFD_IOC_GET_DMABUF_INFO ioctl is controlled by the user. A hostile value (e.g. 2 GiB) can trigger an order-MAX allocation and OOM in kernel context. The fix lets the driver determine the buffer size based on the actual metadata size.

In the Linux kernel PCI iproc driver, root bus removal is not protected by the pci_rescan_remove_lock, which can race with concurrent rescan or hotplug operations triggered via sysfs. The fix holds the lock while stopping and removing the root bus.

In the Linux kernel PCI altera driver, root bus removal is not protected by the pci_rescan_remove_lock, which can race with concurrent rescan or hotplug operations triggered via sysfs. The fix holds the lock while stopping and removing the root bus.

In the Linux kernel, the PCI rockchip driver did not hold the pci_rescan_remove_lock while stopping and removing a root bus. This missing lock allowed a race with concurrent rescan or hotplug operations triggered via sysfs.

In the Linux kernel, the PCI mediatek driver did not hold the pci_rescan_remove_lock while stopping and removing a root bus. This missing lock allowed a race with concurrent rescan or hotplug operations triggered via sysfs.

In the Linux kernel, the PCI plda driver did not hold the pci_rescan_remove_lock while stopping and removing a root bus. This missing lock allowed a race with concurrent rescan or hotplug operations triggered via sysfs.

In the Linux kernel, the perf subsystem uses event::addr_filter_ranges under RCU but does not free it via RCU. The incorrect object lifetime can lead to memory errors.

In the Linux kernel, the f2fs filesystem's inline dentry conversion copies names out of the inline dentry area before checking that each recorded name length fits in the available filename slots. A corrupted image can therefore cause the conversion path to read past the inline filename storage.

In the Linux kernel, the au1000 network driver calls free_irq() in au1000_close() while holding aup->lock with spin_lock_irqsave(). free_irq() can sleep because it takes the IRQ descriptor request mutex, so it must not be called inside the spinlocked section.

In the Linux kernel, the SPI subsystem does not abort an active target-mode transfer when the controller is suspended. This can leave the hardware in an inconsistent state and prevent a clean resume.

A flaw was found in the Linux kernel's btrfs module in the validation of the INODE_REF name length (namelen). A crafted btrfs image can contain a namelen larger than the 255-byte limit, causing an out-of-bounds write and a kernel panic.

In the Linux kernel, the ksmbd server's ksmbd_vfs_set_sd_xattr function does not free the sd_ndr.data buffer allocated by ndr_encode_v4_ntacl() when a subsequent ndr_write_*() call returns an error. This causes a memory leak.

In the Linux kernel, the ksmbd server has two issues: when ndr_decode_v4_ntacl() fails, the error path does not free acl.sd_buf (memory leak), and when acl.sd_size is less than sizeof(struct smb_ntsd), the function returns success without freeing the buffer and leaves a stale *pntsd.

In the Linux kernel, a double fput() occurs in the error handling of cachefiles_create_tmpfile() in the cachefiles subsystem. This leads to incorrect release of a file reference.

In the Linux kernel, the drm/amdgpu driver has a vulnerability due to missing synchronization with RCU callbacks during module unload. This can lead to RCU callbacks executing after module memory is freed, causing a page fault and system crash.

In the Linux kernel, the ALSA usb-audio (caiaq) driver's usb_ep1_command_reply_dispatch() reads data from the URB buffer without first verifying that actual_length contains the required bytes. Missing validation of EP1 reply lengths can lead to out-of-bounds reads.

In the Linux kernel, the wifi rsi driver's rsi_hal_load_key() unconditionally copies MIC keys from offsets intended for a 32-byte TKIP key, even for other ciphers (e.g., CCMP) with shorter keys. This can read past the supplied key buffer.

In the Linux kernel, the wifi cfg80211 subsystem's cfg80211_rx_assoc_resp() initializes the status and response-IE fields from the management frame before proving the frame is long enough for those offsets. The S1G path only patches resp_ie after the unsafe initializer has already run.

In the Linux kernel, the cfg80211_rx_mlme_mgmt() and cfg80211_tx_mlme_mgmt() functions do not properly validate the length of management frames before accessing fields based on the subtype, which can lead to out-of-bounds reads. The patch adds frame-control length gating and validates the minimum frame size for each subtype.

In the Linux kernel, the wifi mac80211 subsystem may experience a race during IBSS disconnect in ieee80211_ibss_disconnect() where a TX to the driver occurs after carrier off and after telling the driver to leave the IBSS. In the case of iwlwifi, this leads to an attempt to use invalid queues.

In the Linux kernel, the wifi libipw subsystem's libipw_rx() reads skb->data[hdrlen + 3] to extract the WEP key index, but the existing guard only checks skb->len >= hdrlen + 3, which does not prove the byte at hdrlen + 3 exists. Requiring hdrlen + 4 bytes before reading is needed.

In the Linux kernel, the wifi rsi driver's rsi_prepare_beacon() copies the mac80211 beacon frame after FRAME_DESC_SZ into a management skb whose usable tailroom after alignment may be smaller than MAX_MGMT_PKT_SIZE. Missing validation of beacon length before copying can lead to buffer overflow.

In the Linux kernel, the SMB client's stack-allocated cifs_open_info_data structure may contain random data, which can cause fields to have incorrect values if they are not set later.

In the Linux kernel iwlwifi driver (mvm subsystem), the sta_id in the BA_WINDOW_STATUS_NOTIFICATION_ID notification is not validated before being used as an index into the fw_id_to_mac_id[] array, leading to potential out-of-bounds access.

In the Linux kernel btrfs filesystem, merge_reloc_roots() has an issue with reloc root cleanup: when a root has zero references, the reloc_root pointer is reset without memory barriers, and the BTRFS_ROOT_DEAD_RELOC_TREE flag is cleared incorrectly. The fix uses clear_reloc_root() to ensure proper synchronization.

In the Linux kernel iwlwifi driver (mvm subsystem), there is an off-by-one boundary check error. Before reading the 11th byte, the length is not checked to be sufficient, potentially leading to out-of-bounds read.

In the Linux kernel iwlwifi driver (pcie subsystem), after a failed TX init, the RX resources are freed but the pointers are not set to NULL. This can lead to use-after-free during later cleanup or retry.

In the Linux kernel blk-cgroup, the error path of blkg_create() has two issues: the online flag is set even when the blkg was not fully inserted, and blkg_put() is called instead of percpu_ref_kill(), leading to permanent memory leaks and preventing cgroup destruction.

In the Linux kernel SMB client, dirty data is not flushed before punching a hole. This can lead to the range being reported as data after the punch, which is incorrect.