Linux kernel vulnerabilities

In the imx-lpi2c I2C driver for i.MX platforms, the adapter is not marked as suspended during suspend/resume. In the window between suspend_noirq and actual suspend, and between resume and resume_noirq, I2C transfers may be initiated when hardware resources are unavailable, risking a system hang.

In the Synaptics RMI4 (F3A) driver, the keymap is allocated for at most 6 entries, but the GPIO count (0-127) is not bounded. A device with gpio_count > 6 causes out-of-bounds read in the interrupt and via EVIOCGKEYCODE/EVIOCSKEYCODE ioctls, potentially leaking adjacent slab memory to userspace.

In the Synaptics RMI4 (F30) driver, the keymap is allocated for at most 6 entries, but the GPIO/LED count (0-31) is not bounded. A device with gpioled_count > 6 causes out-of-bounds read in the interrupt and via EVIOCGKEYCODE/EVIOCSKEYCODE ioctls, potentially leaking adjacent slab memory to userspace.

In the Elan I2C touchpad driver, missing validation of x_traces and y_traces can lead to division by zero and kernel panic. Additionally, an arithmetic underflow in touch reporting logic when width is less than 90 causes a huge unsigned integer to be reported to userspace.

In the Goodix touchscreen driver, the contact count reported by the device is not clamped. The max_touch_num value (0-15) is taken from configuration without clamping, which can lead to a stack out-of-bounds write in goodix_ts_read_input_report() when touch_num > 10.

In the Linux kernel, the iforce driver lacks validation of the force-feedback effect index from the device. The index masked only with 0x7f (range 0-127) is used to address the core_effects[] array with only 32 entries, causing out-of-bounds read/write. A malicious or counterfeit device can set or clear a bit at an arbitrary offset past the object.

In the Linux kernel's mms114 touch driver, there is an indexing error for MMS134S and MMS136 controllers. The driver uses the wrong structure size (8 bytes) instead of the actual event size (6 bytes), causing touch events to be read from incorrect offsets.

In the Linux kernel's touchwin driver, there is a heap out-of-bounds write vulnerability. The packet index is not reset when the second and third data bytes do not match, allowing a malicious device to continuously increment the index and write beyond the buffer.

In the Linux kernel's mms114 driver, there is a stack out-of-bounds write vulnerability. The driver does not check the upper limit of the packet size from the device, allowing up to 255 bytes to be read into a fixed 80-byte buffer, causing stack overflow.

In the FUSE filesystem in the Linux kernel, there is a vulnerability due to 32-bit multiplication wrap in the prune notification payload length validation. The daemon-controlled multiplication count * sizeof(u64) can wrap, bypassing the check and leading to out-of-bounds read.

In the Linux kernel FUSE filesystem, a use-after-free vulnerability exists. The fuse_ref_folio() function unlocks the request but does not re-lock it before returning, potentially leading to use-after-free.

In the Linux kernel FUSE filesystem, a use-after-free vulnerability exists. The fuse_resend() and fuse_remove_pending_req() functions do not remove the intr_entry from the fiq->interrupts list, leading to use-after-free during iteration.

In the Linux kernel fuse-uring subsystem, a vulnerability exists where the EFAULT error is overwritten. After a copy_from_user() failure, fuse_uring_commit() sets err to a positive residual, causing fuse_uring_req_end() to overwrite -EFAULT with a positive value, masking the error.

In the Linux kernel fuse-uring subsystem, a vulnerability leads to a NULL pointer dereference. The fuse_uring_cancel() function moves cancelled entries to the ent_in_userspace list, and ent_list_request_expired() dereferences ent->fuse_req without checking, causing a crash.

In the Linux kernel FUSE-uring subsystem, a bug causes incomplete cleanup of FUSE requests when io_uring cancels task work (e.g., thread exit). The requesting thread hangs in D-state and the background counter inflates, eventually stalling all subsequent FUSE operations.

In the Linux kernel fuse-uring subsystem, a use-after-free vulnerability exists. The fuse_uring_async_stop_queues() function may run after the last reference to ring->queue_refs has been dropped.

In the Linux kernel fuse-uring subsystem, a race condition exists regarding the queue->stopped flag. The fuse_uring_commit_fetch() function checks queue->stopped without a lock, and the value is not set under lock in fuse_uring_abort_end_requests().

In the Linux kernel fuse-uring subsystem, a use-after-free vulnerability exists. A malicious user can send commit SQEs for requests not yet sent to the FUSE server, potentially leading to use-after-free during memcpy operations.

In the Linux kernel fuse-uring subsystem, a vulnerability leads to a NULL pointer dereference. If a copy into the userspace ring buffer fails, the entry remains on ent_w_req_queue with ent->fuse_req set to NULL, potentially causing a crash when the list is scanned.

In the Linux kernel, the XFS filesystem has a vulnerability where quota IDs wrap around during iteration. When the ID reaches the maximum value (XFS_DQ_ID_MAX), addition truncates it to zero, restarting the iteration and potentially causing incorrect quota enforcement.

In the Linux kernel iwlwifi driver, three BA session handlers used ffs(ba_data->sta_mask) - 1 to derive a station ID without checking that sta_mask is non-zero. When sta_mask is zero, ffs() returns 0 and the subtraction wraps to 0xFFFFFFFF, causing an out-of-bounds access on fw_id_to_link_sta[]. WARN_ON_ONCE(!ba_data->sta_mask) guards were added before each ffs() call.

In the Linux kernel NTB EPF driver, during teardown when BAR_PEER_SPAD and BAR_CONFIG share one PCI BAR, pci_iounmap() was called with an offset on the same iomem, which is unnecessary and triggers a kernel warning. The fix unmaps only when the BARs are different.

In the Linux kernel copy_process() function, the PF_BLOCK_TS flag was not cleared during process copying. This flag is only set when current->plug is non-NULL, and copy_process() inherits it from the parent but resets the child's plug to NULL, breaking the invariant. The fix clears PF_BLOCK_TS alongside the plug reset.

In the Linux kernel for MIPS DEC, a vulnerability occurs when the initial console output handler's buffer is placed in the XKPHYS 64-bit memory segment. The 32-bit firmware truncates the address, causing memory access errors and kernel crashes.

In the Linux kernel, a use-after-free vulnerability was found in the pwrseq subsystem's pwrseq_debugfs_seq_next() function. The issue stems from incorrect device reference counting, leading to use of freed memory.

In the Linux kernel for LoongArch architecture, a vulnerability was found where the stop_this_cpu() function fails to inform RCU about CPU shutdown. This causes RCU to expect quiescent states from CPUs that are already offline and spinning with interrupts disabled, potentially hanging the system during reboot or shutdown.

In the Linux kernel, a use-after-free vulnerability was found in the FPGA region subsystem's child_regions_with_firmware() function. Calling of_node_put(child_region) before the error message leads to accessing freed memory.

In the Linux kernel, a vulnerability was found in MIPS where stop_this_cpu() marks CPUs offline for the scheduler but does not inform RCU. This blocks reboots because RCU waits for quiescent states from parked CPUs that are spinning with interrupts disabled.

In the Linux kernel KVM for x86 Hyper-V, a vulnerability allows out-of-bounds memory read when checking if a virtual processor ID is in a sparse bank set. The bank index is not bounded to the maximum of 64 banks (64 vCPUs each), leading to a use-after-free condition. A malicious Hyper-V guest can exploit this to read kernel memory.

In the Linux kernel, a use-after-free vulnerability was found in the linkstation-poweroff driver's linkstation_poweroff_init() function. Calling of_node_put(dn) before of_match_node() leads to accessing freed memory.

In the Linux kernel, a use-after-free vulnerability was found in the fbdev subsystem's fb_find_mode() function. The mode_option_buf variable is freed before its alias name is no longer used, leading to accessing freed memory.

In the Linux kernel, a vulnerability was found in the memory driver (drivers/base/memory) where mem->altmap is set before successful device registration. If xa_store() fails, device_unregister() triggers memory_block_release() with altmap set, causing a WARN_ON.

In the Linux kernel, a vulnerability was found in the ASoC codec simple-mux driver's simple_mux_control_put() function. The bounds check accepts values equal to e->items, while enum values are zero-based, allowing an invalid mux state to be stored.

In the Linux kernel, a double free vulnerability was found in the USB gadget net2280 driver in the probe error path. After calling net2280_remove() and usb_put_gadget(), an explicit kfree(dev) was called, leading to a double free of the same structure.

In the Linux kernel, multiple issues were found in the GPIO rockchip driver: a debounce clock reference leak, failure to disconnect the chained IRQ handler, and an IRQ domain leak. These bugs could lead to kernel panics and resource leaks.

In the Linux kernel, a vulnerability was found in the media rc igorplugusb driver where the control request setup packet was incorrectly passed to usb_fill_control_urb(). The driver passed a pointer to the ir->request field instead of the allocated usb_ctrlrequest structure, leading to incorrect control direction.

In the Linux kernel's DAMON sysfs subsystem, a use-after-free vulnerability was found during refresh of tried region directories. Delayed kobj release callback can corrupt the linked list and cause memory corruption.

In the Linux kernel, a deadlock was found in the gpio:shared driver during parent proxy removal. The issue was caused by an overly wide critical section of the mutex protecting the offset field.

In the elan_i2c driver for Elan touchpads in the Linux kernel, firmware size validation was missing before use. This could lead to out-of-bounds memory reads.

In the i2c:davinci driver in the Linux kernel, a missing 'clock-frequency' device tree property caused a division by zero. The default value was defined in kHz instead of Hz, leading to a kernel panic.

A bug was found in the Linux kernel's dynamic ftrace trampolines on x86. When CALL_DEPTH_TRACKING is enabled on retbleed-affected platforms (e.g., Skylake), registering a dynamic trampoline causes a page fault and kernel panic on the first call to the traced function. The issue stems from incorrect relocation of %rip-relative addresses for per-CPU variables after copying code from ftrace_regs_caller.

In the pch_uart serial driver in the Linux kernel, the return value of dma_alloc_coherent() was not checked. A failed allocation could lead to a NULL pointer dereference.

In the Linux kernel USB gadget UVC driver, a vulnerability was found due to missing lock synchronization when walking the extension units list during function binding. The uvc_function_bind() function traverses the list without holding opts->lock, which can race with configfs operations and lead to use-after-free.

In the Linux kernel, the DRM MSM DSI driver has a vulnerability where memory dumping can access past the mapped region due to an unadjusted size. This can lead to accessing unmapped memory.

In the tps65219 voltage regulator driver in the Linux kernel, the irq_data.rdev field is not assigned, causing undefined behavior when the IRQ handler calls regulator_notifier_call_chain(). This can lead to an Oops error.

In the Linux kernel, a vulnerability was found in the TLB invalidation mechanism on x86 architecture. When booting with 'nopcid' (disabling PCID), broadcast TLB invalidation (INVLPGB) can still be used with a non-zero PCID, causing a general protection fault (#GP) and system crash.

In the Linux kernel, the ethtool PHY helper has a NULL pointer dereference vulnerability when the PHY driver is unbound via sysfs. The phy_remove() function clears the drv pointer but does not detach the device, causing a crash when reading the driver name.

In the Linux kernel, several ACPI platform drivers lack a NULL check for the ACPI companion object. Since any platform driver can be forced to match a non-ACPI device, this can lead to errors.

In the Linux kernel, the sched_ext scheduler has a use-after-free (UAF) vulnerability in scx_root_enable_workfn(). The put_task_struct() call is made before scx_error() dereferences p->comm and p->pid, potentially accessing freed memory.

In the Linux kernel, the octeontx2-af CGX driver lacks a bounds check for the cgx_speed_mbps array index. The RESP_LINKSTAT_SPEED function can return values 0-15, but the array has only 13 elements, causing an out-of-bounds read.