Linux kernel vulnerabilities

In the Linux kernel, the octeontx2-pf driver has a double-free vulnerability in rvu_rep_rsrc_init(). When hardware resource initialization fails, otx2_init_hw_resources() already unwinds partially initialized resources, and then the error path calls otx2_free_hw_resources() again, causing a double free.

In the Linux kernel's mac80211 subsystem, a vulnerability was found involving an out-of-bounds read when parsing negotiated TTLM maps. The bug occurs when the parser advances the cursor for every TID, even if it has no map, potentially reading past the validated element.

In the Linux kernel's octeontx2-pf driver, a double free of pool->stack was detected on AQ init failure. The function otx2_pool_aq_init() frees the memory but does not null the pointer, leading to a second free in the cleanup path.

In the Linux kernel's ti-qspi SPI driver, a use-after-free vulnerability was found after DMA setup failure. The driver falls back to PIO mode but does not clear the DMA channel pointer, potentially leading to use of freed memory.

In the Linux kernel's device property subsystem, a vulnerability was found due to an uninitialized secondary pointer in the fwnode structure. If a node is initialized via fwnode_init() without zeroing memory, the pointer may contain garbage, leading to dereference.

In the AMD Display driver (drm/amd/display) of the Linux kernel, a stack buffer overflow vulnerability was found in dc_process_dmub_aux_transfer_async. The function copies data into a 16-byte buffer without length checking, and uses link_index without bounds validation.

In the Linux kernel's batman-adv module, a work leak vulnerability was found during backbone_gw purge. The function batadv_bla_purge_backbone_gw() does not wait for or cancel report_work before freeing memory, potentially leading to use-after-free.

In the Linux kernel's netfs subsystem, an overrun vulnerability was found in netfs_extract_user_iter(). If iov_iter_extract_pages() overfills the pages[] array, excess pages may be included in the constructed iterator, leading to memory corruption.

In the Linux kernel's MSM graphics driver (drm/msm/a6xx), a NULL pointer dereference vulnerability was found in a8xx_hfi_send_perf_table. The function does not check the return value of kzalloc(), potentially leading to a crash on memory allocation failure.

In the Linux kernel for PowerPC, redundant preempt_disable()/preempt_enable() calls were removed from arch_irq_work_raise(). They caused a kernel panic when handling machine check exceptions (MCE) in real mode, as accessing the preempt_count in this context is invalid.

In the Linux kernel, the lm90 driver's lm90_alert() function lacks proper locking when modifying configuration registers in the SMBus alert context. Concurrent sysfs writes can overwrite these changes, re-enabling the alert line and causing an interrupt storm.

In the iwlwifi driver (Linux kernel), the function iwl_mld_remove_link() dereferences the link pointer before checking for NULL, potentially causing a memory access violation.

In the Linux kernel's SRCU mechanism, during a state transition from CPU-0 to all-CPUs, workqueue handlers may be queued on CPUs that have never been online, causing hangs on s390 systems.

In the Linux kernel, a vulnerability was found in the mlx5e driver for Mellanox network cards, involving unprotected writes to the ICOSQ during CPU affinity changes while NAPI polling is active. Lack of synchronization can lead to queue data corruption and hardware errors.

In the Qualcomm PHY driver (qmp-usbc) in the Linux kernel, an out-of-bounds array access occurs in the DP swing configuration because the boundary check uses "> 4" instead of ">= 4", allowing index 4 to access memory beyond the allocated 4x4 arrays.

In the Linux kernel, the krb5 crypto library and AF_RXRPC lack length checks before decryption/verification. New facilities for pre-checking message length have been added, and AF_RXRPC now validates DATA packets secured with RxGK.

In the Linux kernel, a vulnerability in XFS filesystem: functions xfs_reflink_fill_cow_hole and xfs_reflink_fill_delalloc cycle the ILOCK to grab a transaction, causing data fork mappings to become stale. Failure to refresh the data fork mapping before re-querying the COW mapping can lead to incorrect *shared values, potentially causing writes to wrong physical blocks.

In the Linux kernel, a bug in DualPI2 (net/sched) GSO segmentation accounting causes double counting in the parent queue. When QFQ is the parent, after all real packets are dequeued, the queue still has non-zero length, leading to a NULL pointer dereference.

In the Linux kernel's Bluetooth L2CAP subsystem, a deadlock occurs during connection teardown. l2cap_conn_del() locks conn->lock and then waits for pending_rx_work, which also tries to lock the same mutex, causing a circular lock dependency.

A livelock and Hung Task panic were discovered in the Linux kernel's i2c-i801 driver. When i801_check_pre() fails (e.g., returning -EBUSY), the error path incorrectly clears hardware registers without owning the SMBus controller, corrupting the hardware state machine and causing endless error logs.

A vulnerability was found in the Linux kernel's BPF INODE_STORAGE maps when BPF LSM is not initialized at boot. An uninitialized inode security blob offset aliases the RCU callback pointer, causing a kernel panic when executing code from address 0x0.

A stack out-of-bounds vulnerability was found in the i2c-stub driver in the Linux kernel. A local user with access to /dev/i2c-* can send an I2C_SMBUS request with an invalid block length (data->block[0] > 32), causing a buffer overflow and potential privilege escalation.

In the Linux kernel, a vulnerability in the team driver (net/team) causes a NULL pointer dereference when a mode change clears the transmit function pointers while concurrent network traffic is being processed, leading to a kernel crash.

A race condition was found in the Linux kernel's netfilter ipset module between dump operations and ip_set_list resize. The dump functions read the array pointer without proper RCU locking, leading to a use-after-free when a new set is created concurrently.

In the Linux kernel's Qualcomm rmnet driver, a use-after-free vulnerability occurs when deleting a network interface. The rmnet_dellink() function frees endpoint memory before the RCU grace period ends, allowing concurrent readers to access freed memory, leading to a page fault and potential code execution.

In the Linux kernel's XFS filesystem, a crafted log with a transaction header but no data regions causes a NULL pointer dereference during recovery, leading to a kernel crash.

In the Linux kernel, a potential out-of-bounds access was found in the AMD IOMMU debugfs interface. The iommu_mmio_write() and iommu_capability_write() functions used kstrtou32_from_user() for input parsing, which could convert large values into negative integers, leading to out-of-bounds memory reads/writes.

In the Linux kernel, a vulnerability in sysfs causes an existing group directory to be removed when sysfs_update_group() fails (e.g., -ENOMEM). The internal_create_group() function incorrectly deletes a directory that was not created by the caller, potentially destroying pre-existing sysfs groups.

In the Linux kernel, a cgroup reference leak was discovered in the DAMON sysfs-schemes module. The function damon_sysfs_memcg_path_to_id() breaks the mem_cgroup_iter() loop without calling mem_cgroup_iter_break(), causing a reference leak. The issue is fixed by adding the missing call.

In the Linux kernel, a vulnerability was found where the EFI runtime workqueue was allocated too late, causing a NULL pointer dereference when ACPI PRM calls were made early during boot. The fix moves the workqueue allocation to an earlier initcall (postcore).

In the Linux kernel, a memory block device reference leak was found in memblk_nr_poison_inc() and memblk_nr_poison_sub(). These functions look up a memory block via find_memory_block_by_id() but fail to drop the reference after updating the hwpoison counter.

A vulnerability in the Linux kernel's __vm_normal_page() function mishandles missing support for pmd_special()/pud_special() on 32-bit x86 systems with THP enabled. This triggers warnings, RSS counter bugs, and page state corruption during memory reclaim.

In the Linux kernel, a memory block device reference leak was found during memory removal. The function remove_memory_blocks_and_altmaps() acquires a reference via find_memory_block() but never releases it, causing a device reference leak.

In the Linux kernel, a memory leak was found in the iosm WWAN driver in the ipc_imem_init() function. Memory allocated in ipc_protocol_init() is not freed on error paths, potentially leading to resource exhaustion.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's Bluetooth BNEP module. The bnep_add_connection() function failed to hold the bnep_session_sem lock while reading dev->name, allowing a concurrent bnep_session() thread to free the net_device.

In the Linux kernel, a vulnerability was found in the Phonet/PEP subsystem where pep_do_rcv() calls sk_receive_skb() for a child socket without disabling bottom halves (BH). This causes a lock inconsistency (SOFTIRQ-ON-W vs IN-SOFTIRQ-W), potentially leading to a deadlock in the network receive path.

In iwlwifi driver for old devices (e.g., 7265D), a bug was found in setting TX rates due to incorrect encoding in v1 format (PLCP) instead of v3, potentially causing warnings when reported back from the device.

In the iwlwifi driver for Intel BE201 Wi-Fi 7 chipsets, a vulnerability was found where transmission is not stopped during firmware restart. After a firmware crash (e.g., NMI_INTERRUPT_UNKNOWN), the driver continues sending frames that are rejected, causing high CPU load and memory fragmentation.

In the Linux kernel, a bug in cfg80211_merge_profile() in the cfg80211 subsystem causes loop variables not to advance when reassembling split Multi-BSSID non-transmitted BSS profiles. This results in repeated copying of the same data, potentially leading to excessive CPU usage.

In the Linux kernel tracing module, a vulnerability was found where map->ops->elt_free() is called even when map->ops->elt_alloc() failed. This can lead to incorrect memory deallocation or other errors.

A vulnerability in the KVM driver for Hygon Family 18h CPUs causes hardware to read a stale IsRunning=1 bit during ICR write emulation, failing to generate an AVIC_IPI_FAILURE_TARGET_NOT_RUNNING VM-Exit. This leads to hung vCPUs and unbounded delays in guest execution.

In the Linux kernel, a PM reference leak was found in the Tegra I2C driver. The function fails to call pm_runtime_put() after a mutex lock failure, preventing the device from entering runtime suspend.

In the Linux kernel, the SPI QUP driver has an error pointer dereference after a DMA setup failure. The driver falls back to PIO mode but fails to clear DMA channel pointers, potentially causing a dereference of an error pointer or a double release on subsequent errors or driver unbind.

In the Linux kernel, a vulnerability was found in the ep93xx SPI driver. After a DMA setup failure during probe, the driver falls back to PIO mode but fails to clear DMA channel pointers, leading to an error pointer dereference on subsequent probe errors or driver unbind.

In the SPI driver for Spreadtrum (sprd) SoCs, an error pointer dereference occurs after a DMA setup failure. The driver falls back to PIO mode, but on late probe errors it may attempt to release an invalid DMA pointer or release a channel twice, leading to a crash.

In the Linux kernel, a vulnerability was found in the KHO (Kexec HandOver) mechanism. The kho_fill_kimage() function incorrectly added KHO metadata to crash kernel images, causing a page fault during memory initialization when the crash kernel tried to access KHO scratch areas outside its reserved region.

In the Linux kernel, a vulnerability was found in the arm_ffa driver where the driver registration function did not check if the FF-A ID table (id_table) was NULL. This missing validation could lead to a NULL pointer dereference during driver-to-device matching on the bus.

In the Linux kernel, the ARM Integrator platform driver has an initialization bug. The `intcp_init_early` function calls `syscon_regmap_lookup_by_compatible`, which allocates memory before the memory management subsystem is initialized, causing a crash (NULL pointer dereference) or -ENOMEM error. The fix moves the early initialization code to the standard machine initialization.

In the Linux kernel, a bug was found in the Btrfs filesystem tracepoint for btrfs_sync_file(). Calling dput() in an atomic context causes a sleep, leading to a kernel splat. The issue occurs when tracing is enabled during write operations on Btrfs.

In the Linux kernel, a vulnerability in the kprobes test causes all tests to fail and the kernel to crash when run twice, due to leftover data in static kprobe variables not being cleared between test runs.