Linux kernel vulnerabilities

In the Linux kernel iwlwifi driver (mvm subsystem), TX_CMD response parsing does not validate the response layout correctly. The minimum length check does not follow the runtime layout calculation, potentially leading to out-of-bounds read. For the new TX API, responses with frame_count != 1 are rejected.

In the Linux kernel iwlwifi driver (mvm subsystem), there is a possible underflow when processing the wowlan packet. The length of the packet is trusted from the firmware without proper validation, which could lead to incorrect calculations.

In the Linux kernel iwlwifi driver (mvm subsystem), the tid value from firmware is used as an index into tid_data[] without validation. Lack of bounds checking could lead to out-of-bounds access.

In the iwlwifi mvm driver, an incorrect indexing of the tid_data array was found — using the loop counter instead of the actual TID value. Currently it causes no harm, but a bounds check was added to prevent potential out-of-bounds access.

The iwlwifi firmware parser improperly checked aligned TLV length, potentially leading to length underflow with malformed data. Validation was added to avoid potential out-of-bounds reads.

In the iwlwifi ACPI function, a missing bounds check on the WGDS table revision before using it as a bit shift could cause undefined behavior with an invalid revision value.

In the Linux kernel CIFS (SMB1) module, cifs_filldir() copies directory entry names from an SMB response using a server-supplied length without checking that the name stays within the response buffer. A malicious SMB1 server returning an oversized FileNameLength causes memchr() to read past the end of the slab buffer.

The ksmbd SMB server could overwrite ACL masks inherited from the parent directory, leading to widened effective permissions during object creation. The fix preserves original masks.

In the cifs.idmap mechanism, the payload length was incorrectly handled, potentially truncating it to U16_MAX. Not rejecting oversized payloads led to length inconsistencies and potential memory errors.

In cfg80211, the cfg80211_wext_siwgenie() function lacked validation of the IE buffer, leading to out-of-bounds read and integer underflow during subsequent processing. Validation was added before storing.

In Bluetooth RFCOMM, the rfcomm_recv_frame function lacked frame length validation, allowing out-of-bounds reads on truncated frames and length underflow (UINT_MAX) on zero-length frames. The fix rejects frames smaller than the required size.

In vhost-scsi, a race condition between command submission and memory table replacement (VHOST_SET_MEM_TABLE) could cause response writes to an unrelated object after completion. The fix flushes the backend after ioctl.

A vulnerability in the Linux kernel's SCSI subsystem where scsi_eh_lock_door() can block on tag allocation when all tags are held by requeued commands. This leads to a deadlock in the error handler thread, especially for devices with a single driver tag (e.g., USB storage).

In the Linux kernel, the netfilter nfnetlink_log module has a synchronization issue: nfnl_log_net_exit() clears the logger pointer without waiting for an RCU grace period, potentially leading to use-after-free by concurrent packets. The fix moves the cleanup to .pre_exit to ensure RCU readers complete before freeing per-net state.

A vulnerability was found in the Linux kernel i2c/smbus subsystem due to missing early validation of SMBus block transfer length. A user-controlled oversized data->block[0] value can reach tracepoints and native smbus_xfer driver implementations unchecked, causing out-of-bounds memory access.

In the Linux kernel's appletalk module, aarp_send_ddp() calls atalk_find_dev_addr() without a NULL check, leading to a NULL pointer dereference when the device has no AppleTalk interface configured. The fix adds a NULL check consistent with other callers.

In the Linux kernel's f2fs filesystem, the f2fs_gc_kthread structure is dynamically allocated, leading to a race during teardown: the GC thread may access freed memory. The fix embeds f2fs_gc_kthread in f2fs_sb_info, simplifying lifetime management and preparing for race condition fixes.

In the Linux kernel's DRM pagemap driver, drm_pagemap_migrate_unmap_pages() relies on the pages array for DMA unmapping, but drm_pagemap_migration_unlock_put_pages() clears the array during cleanup, leaving no valid page info. The fix calls the unmap function before unlock_put_pages to keep the array valid.

In the Linux kernel, the error path of device_register() in i3c_master_register_new_i3c_devs() fails to clear desc->dev->desc and desc->dev before releasing the device. This triggers a WARN_ON and leaves a dangling pointer to freed memory, potentially causing a use-after-free.

In the Linux kernel, rtw89_mac_check_he_obss_narrow_bw_ru_iter() reads extended capability byte 10 but only rejects datalen values below 10, while reading byte 10 requires at least 11 bytes. The missing length check can lead to an out-of-bounds read.

In the Linux kernel, gb_audio_gb_get_topology() fetches a topology blob of a module-supplied size, and gbaudio_tplg_parse_data() uses the size_dais, size_controls and size_widgets fields to compute section offsets without validating them against the fetched size. A module reporting a small topology size but large section sizes makes offsets point past the allocation, causing out-of-bounds reads.

In the Linux kernel, the staging octeon driver's cvm_oct_tx_shutdown does not call tasklet_kill, so the TX cleanup tasklet can be scheduled by the watchdog IRQ handler and run after cvm_oct_remove() frees net_device structures. This causes a use-after-free in cvm_oct_tx_do_cleanup() while iterating the cvm_oct_device[] array.

In the Linux kernel, the staging octeon driver's cvm_oct_rx_shutdown calls free_irq and netif_napi_del without disabling the NAPI instance first. Since free_irq only waits for hard interrupt handlers to complete, the NAPI poll function may still be active, and if cvm_oct_remove frees the plat structure holding the NAPI instances, the active poll function accesses freed memory.

In the Linux kernel, the RDMA/bnxt_re driver's destroy callbacks zero the udata output after tearing down driver resources. If the userspace access fails, uverbs preserves the uobject and allows the destroy callback to run again even though the driver resource has already been freed. The fix moves ib_no_udata_io() before teardown and ib_respond_empty_udata() to the start of create and modify flows.

In the Linux kernel, the phy-rcar-gen3-usb2 driver's devm_regulator_get_exclusive() initializes the regulator with enable_count = 1, requiring the consumer to disable it before release. The devm disable action was only registered when the caller explicitly requested enable, so when the regulator was left in its initial enabled state without an explicit enable call, the cleanup path skipped decrementing enable_count, triggering a WARN_ON during regulator release on device removal.

In the Linux kernel, the perf/x86/intel/pt driver has an imbalance between perf_aux_output_begin() and perf_aux_output_end() calls. When pt_event_stop() is called without the PERF_EF_UPDATE flag (e.g. due to group throttling), a subsequent pt_event_start() reopens the AUX context, violating the no-nesting rule and triggering a WARNING in perf_aux_output_begin(). This affects scenarios such as AUX area sampling.

In the Linux kernel, the bcm2835 pinctrl driver's bcm2835_pinctrl_probe() calls gpiochip_remove() before the GPIO chip is registered by gpiochip_add_data() when devm_pinctrl_register() fails. This leaves gpio_chip.gpiodev as NULL, resulting in a null pointer dereference inside gpiochip_remove().

In the Linux kernel, the tps6594_regulator_probe() multiphase configuration loop failed to release device node references (np, np_parent, np_pmic_parent) obtained via of_find_node_by_name() and of_get_parent(), causing a reference leak on every iteration. Additionally, a missing NULL check after of_find_node_by_name() could lead to a NULL pointer dereference.

In the Linux kernel, the qcom_wcnss remoteproc driver changed the info pointer increment from num_pd_vregs to num_pds, which for the pronto-v3 platform (no power domain regulators in vregs) shifted the pointer past the end of the array. This manifested as a "regulator request with no identifier" error on SDM632 devices with LLVM-compiled kernels.

In the Linux kernel, the ath11k Wi-Fi driver could receive HT/VHT/HE frames with an MCS above the maximum expressible in the mac80211 rate space (e.g., HE with MCS 12). The ath11k_dp_rx_h_rate() function left an out-of-range rate_idx and never set encoding, causing mac80211 to drop the frame with a warning and discard otherwise valid data.

In the Linux kernel, the BPF interpreter ignored the 'off' field of the BPF_MOV64_PERCPU_REG (BPF_ADDR_PERCPU) instruction, which requires JIT compilation to native code. As a result, loading memory from such a register triggered a page fault and a kernel oops.

In the Linux kernel, ext4_ext_migrate() had a circular lock dependency between s_writepages_rwsem and sb_internal (freeze protection). Calling iput(tmp_inode) before releasing ext4_writepages_up_write() caused a deadlock with concurrent orphan inode cleanup during mount.

In the Linux kernel, ext4_try_to_expand_extra_isize() called during mount (!SB_ACTIVE) could move xattrs to external blocks and release ea_inodes via iput(), creating a circular lock dependency: s_writepages_rwsem -> jbd2_handle -> xattr_sem -> s_writepages_rwsem.

In the Linux kernel, the RDMA/core uverbs_free_dmah() function called rdma_restrack_del() too late, after vendor-specific resources associated with the dmah had already been freed. This left a short window where the dmah remained accessible through restrack, potentially leading to a use-after-free.

In the Linux kernel on arm64, the rsi_attestation_token_init function copying the challenge to &regs.a1 triggered a FORTIFY field-spanning write warning, because register a1 is treated as a single 8-byte field while 64 bytes were copied.

In the Linux kernel, the PCI/pwrctrl tc9563 driver parsing both functions of the integrated Ethernet MAC Endpoint under DSP3 caused an out-of-bounds access past the tc9563_pwrctrl->cfg array. The fix parses the Endpoint node under DSP3 instead of both functions.

In the Linux kernel, the RDMA/efa driver, when registering an MR and creating an indirect PBL, wrongly computed the last chunk length as 0 if the PBL page count was a multiple of EFA_PTRS_PER_CHUNK. This caused the device to see the chunk as empty and reject the memory registration.

In the Linux kernel, the eswin driver for EIC7700 chips has functions eswin_clk_register_pll() and eswin_register_clkdiv() that do not initialize all fields of a stack-allocated clk_init_data structure. Uninitialized stack data causes incorrect clock parent resolution and leads to a NULL pointer dereference during clock registration.

In the Linux kernel, in the md/raid5-ppl module, the ppl_do_flush() function continues iterating after calling ppl_io_unit_finished(), which frees the io object. Subsequent access to io->pending_flushes leads to a use-after-free.

In the Linux kernel, in the lockdep module, the __lock_set_class() function does not check if register_lock_class() returned NULL. When the lock class pool is exhausted or validation fails, an invalid class index is computed, leading to a NULL or out-of-bounds pointer dereference.

In the Linux kernel for powerpc architecture in the XIVE subsystem, when xive_init_ipis() fails, the global xive_ipis array is freed. However, xive_smp_probe() previously ignored this failure and called xive_setup_cpu_ipi(), which dereferenced the already-freed pointer, leading to a use-after-free.

In the Linux kernel with CONFIG_PPC_KERNEL_PCREL enabled on PowerPC, call_do_irq() and call_do_softirq() use inline assembly without listing r2 as clobbered. This causes the compiler to assume r2 is preserved, leading to register corruption and kernel crashes during interrupt handling, preventing boot.

In the Linux kernel, in the OCFS2 filesystem, the function ocfs2_read_inode_block_full() used make_bad_inode(), which changes the inode type to S_IFREG. For a directory inode during active VFS lookup, this can lead to errors, including triggering VFS_BUG_ON_INODE().

In the Linux kernel, in the fs-integrity (block) subsystem, there is a missing check of BIP_CHECK flags before generating or verifying PI information. This can lead to incorrect invocation for non-PI metadata, generating incorrect metadata and crashes in the verification handler.

In the Linux kernel, the arm64 hibernation code manages exception masking incorrectly, leading to potential crashes or warnings during resume. When restoring a hibernated image, only interrupts are masked, not all DAIF exceptions, which may cause unexpected exceptions in an inconsistent state.

In the Linux kernel for ARM64, an issue was found in the kernel exit path where local_irq_disable() was unnecessarily called in contexts where interrupts were already disabled or in NMI contexts. This confused the pNMI state tracking and caused warnings when CONFIG_ARM64_DEBUG_PRIORITY_MASKING is enabled. The fix splits arm64_exit_to_kernel_mode() into parts to avoid extra work and preserve correct logic.

A vulnerability in the Linux kernel's CPU isolation (housekeeping) mechanism was found, where memblock-allocated memory for the CPU mask was freed too early during boot, before the memory map was fully initialized. This caused a warning and potential system malfunction when using the 'nohz_full' boot parameter. The fix defers freeing this memory until initcall processing.

A vulnerability was found in the OCFS2 filesystem in the Linux kernel, involving a circular locking dependency between the ip_xattr_sem semaphore and the transaction barrier j_trans_barrier. This can lead to a deadlock during concurrent setxattr and mkdir/mknod operations. The fix precomputes the ACL state before starting the transaction and removes unnecessary semaphore acquisition.

In the Linux kernel, the acpi_get_first_physical_node() function may return a stale device pointer, potentially leading to a use-after-free. A new function acpi_bus_get_primary_device() has been introduced to mitigate this issue by properly managing references.

A use-after-free vulnerability has been found in the Linux kernel's vxlan_mdb_flush() function used for VXLAN multicast database (MDB) management. The flaw allows freeing one MDB entry while iterating over another, leading to a write to freed memory during deletion operations.