Linux kernel vulnerabilities

In the TI ICSSM PRUETH network driver in the Linux kernel, a reference leak of the eth_ports_node device tree node occurs in the probe function. The leak happens on the error path after a failed of_property_read_u32() call, where the node is not released before returning.

A vulnerability was found in the Linux kernel's netfs subsystem, where the zero point update in netfs_release_folio() incorrectly used local i_size instead of remote_i_size when the local file size exceeds the server's EOF. This caused read operations to fail with short reads when accessing beyond the actual server file size.

A vulnerability was found in the Linux kernel's netfs mechanism regarding incorrect partial invalidation of a streaming-write folio. The netfs_invalidate_folio() function incorrectly modifies the dirty region by moving it forward by the start instead of the end of the invalidation region, leading to improper tracking of dirty data.

In the Linux kernel, a vulnerability in the netfs and afs subsystems causes write skipping in writepages functions for directories and links. The issue occurs when a write is skipped due to lock contention and WB_SYNC_NONE mode, potentially leading to data inconsistency.

In the Linux kernel, a memory leak vulnerability was found in the ath11k driver in WMI WOW functions. Two instances directly returned the result of ath11k_wmi_cmd_send without checking the return value, preventing skb buffer deallocation in the error path.

In the Linux kernel, a reference leak was found in the DRM driver for Adreno GPUs (MSM) in the a6xx_gpu_init() function. The function obtains a device node via of_parse_phandle(), but several early error paths skip releasing the reference, causing a memory leak.

In the Linux kernel, in the DRM MSM driver (drm/msm), a vulnerability was found due to incorrect checking of the return value of iommu_map_sgtable(). A change in the iommu_map_sgtable() interface made it return ssize_t with negative values on errors instead of size_t with zero. The code did not store the result in the appropriate type and triggered a WARN instead of returning the error.

In the Linux kernel, a bug was found in the IOMMU subsystem where the error path of the map function calls iommu_unmap(), which triggers debug routines (iommu_debug_unmap_begin/end) without a prior iommu_debug_map() call. This causes unbalanced tracking and potential debugging issues. The fix moves error handling to iommu_map_nosync() and reorders operations to record the partial mapping before unmapping it.

In the Linux kernel, a vulnerability was found in the iommupt subsystem due to missing check for PAGE_SIZE in the pgsize_bitmap. The driver may drop PAGE_SIZE from the bitmap, which is technically allowed but violates design assumptions and may cause issues with the DMA API.

In the Linux kernel, a flawed sanity check in dma_map_resource() using pfn_valid() was moved to debug code. On ARM64 with SPARSEMEM, MMIO addresses sharing a section with RAM falsely triggered WARN_ON_ONCE and returned DMA_MAPPING_ERROR, causing issues on Raspberry Pi 4 during SPI driver probe.

In the Linux kernel, the pds_core driver fixes two bugs in pdsc_devcmd_wait: firmware crash returned stale success instead of an error, and timeout overwrote the error code with stale status.

In the Linux kernel, the pds_core driver has a dentry reference leak and improper error handling in debugfs_lookup(). debugfs_lookup() returns a dentry with an elevated reference count that must be released with dput(). The code discards the dentry without calling dput(), causing a leak on every firmware reset recovery. Additionally, when CONFIG_DEBUG_FS is disabled, debugfs_lookup() returns ERR_PTR(-ENODEV) instead of NULL, and the current check passes for error pointers, leading to a crash when calling dput() on an invalid pointer.

In the Linux kernel, a metabuf leak was found in the EROFS filesystem during extended attribute initialization of inodes. The error paths after erofs_read_metabuf() fail to release the buffer, causing a folio reference leak.

In the wilc1000 WiFi driver, a memory leak occurs in wilc_wlan_firmware_download(). The function allocates dma_buffer but fails to free it on the first bus acquire failure, returning directly instead of using the cleanup label.

In the Linux kernel Bluetooth btmtk driver, a memory leak occurs when urb submission fails or the submitted urb is killed. The setup_packet of the control urb is not freed in error paths, leading to memory leak.

A vulnerability in the Linux kernel's uniwill-laptop driver may cause permanent battery damage on older models (~2020) when enabling the charging limit even via the 'force' parameter. The fix prevents forcing this feature.

In the Linux kernel's ksmbd filesystem, a null pointer dereference vulnerability exists in the compare_guid_key() function. During durable-handle session teardown, session_fd_check() sets the conn pointer in the opinfo structure to NULL but does not remove the opinfo from the lease list. When a new session is established with the same ClientGuid and an SMB2 CREATE request with a lease context is sent, find_same_lease_key() processes the stale opinfo, and compare_guid_key() attempts to read ClientGUID through a NULL conn pointer, causing a kernel panic.

In the Linux kernel ksmbd filesystem, a null pointer dereference vulnerability was found in proc_show_files(). When an SMB2 client opens a file with a durable v2 handle and then issues SMB2 SESSION_LOGOFF, the fp->tcon pointer is cleared but the entry remains in global_ft.idr. Reading /proc/fs/ksmbd/files during this window causes a kernel panic.

In the Linux kernel, the ksmbd module has a memory leak of struct smb_sid in set_posix_acl_entries_dacl(). When the DACL size exceeds 65535 bytes, the newly added check_add_overflow() guard breaks out of the loop but skips freeing the previously allocated memory, causing a leak.

A vulnerability was found in the Linux kernel's ksmbd module, where SID identifiers (Owner and Group) in the parent directory's security descriptor are not validated during ACL inheritance. This flaw could allow an attacker to manipulate file access permissions.

In the Linux kernel, a vulnerability was found in the CIFS SWN netlink implementation. Missing capability flags for generic netlink operations allow any local process to send RESOURCE_CHANGE or CLIENT_MOVE notifications to the in-kernel witness handler. Additionally, the multicast group lacks protection, enabling unprivileged processes to join and receive registration messages containing username, domain, and password for NTLM-authenticated mounts.

A stack buffer overflow vulnerability was found in the pmbus/adm1266 driver of the Linux kernel. The function adm1266_nvmem_read_blackbox() uses a 5-byte local buffer for reading block data via i2c_smbus_read_block_data(), which does not check buffer size and copies up to 32 bytes, potentially causing stack overflow.

In the Linux kernel, a vulnerability in the ALSA PCM subsystem was found where the iov_iter setup was incorrectly applied for silencing (NULL data), leading to a bogus iov_iter calculation. On RISC-V architecture, this causes a NULL pointer dereference.

In the Linux kernel, the ALSA asihpi driver has a vulnerability allowing out-of-bounds (OOB) array access when reading the cache. The find_control() function accesses the array without proper index validation, potentially leading to memory corruption.

A bug in the Linux kernel's unmap_page_range function caused spurious warnings when unmapping device-private/exclusive pages. The issue stemmed from an incorrect assumption that anonymous folios always belong to anonymous VMAs, which is false for private file-backed mappings.

In the Linux kernel, a vulnerability was found in the tag initialization of the huge zero folio when init_on_free is enabled. Memory tags are not cleared, potentially leaking previous allocation data. The issue affects ARM64 with Memory Tagging Extension (MTE).

In the Linux kernel, a vulnerability in the memory migration mechanism (mm/migrate_device) causes a spinlock leak when check_stable_address_space() fails after acquiring the PMD spinlock, leading to a permanent deadlock.

In the Linux kernel, a Bluetooth ISO vulnerability allows ISO_END frames sent without prior ISO_START to trigger a NULL pointer dereference. An attacker within radio range can crash the system (oops) by sending crafted packets.

In the Linux kernel's Bluetooth L2CAP subsystem, a vulnerability was found in the ecred_reconfigure function where a stack pointer was incorrectly passed instead of the packed PDU structure. This causes a kernel address leak to the paired Bluetooth device and breaks the L2CAP_ECRED_RECONFIGURE functionality.

In the Linux kernel, a vulnerability in the Bluetooth MGMT module allows an attacker with CAP_NET_ADMIN to trigger an out-of-bounds read by sending a short MGMT_OP_ADD_EXT_ADV_DATA command. The missing length validation can lead to data leakage or system crash.

In the Linux kernel, a vulnerability in the net:devmem mechanism lacks validation of page alignment for dma-buf size and SG segment length. This mismatch can cause out-of-bounds read of the tx_vec array during sendmsg() and desynchronization of num_niovs from the gen_pool region, affecting both RX and TX paths.

A use-after-free vulnerability was found in the Linux kernel's HSR (High-availability Seamless Redundancy) module. Generic-netlink operations running under rcu_read_lock() can access freed memory during HSR interface teardown (RTM_DELLINK) because the node list is removed with plain list_del() and freed immediately, while RCU readers may still hold pointers to those nodes.

In the Linux kernel's IFB driver, a slab-out-of-bounds read vulnerability was found when reporting ethtool stats. The issue occurs when the number of RX queues exceeds TX queues, causing indexing beyond allocated memory and potential data leak.

In the Linux kernel, a vulnerability was found where kstrdup() return values in phy_prepare_data() are not checked. A failed memory allocation for the 'name' string leads to a NULL pointer dereference in phy_reply_size() when strlen() is called, causing a kernel panic.

In the Linux kernel L2TP module, a vulnerability was found due to using list_del_init() instead of list_del_rcu() when removing a session from the list. An unprivileged local user can pin a host CPU indefinitely by concurrently issuing GET, CREATE, and DELETE operations on an L2TP session.

In the Linux kernel, a double-free vulnerability was found in the qed driver's qed_cxt_tables_alloc() function. When a CID bitmap allocation for PF or VF fails, qed_cid_map_alloc() frees previously allocated bitmaps, and then qed_cxt_tables_alloc() calls qed_cxt_mngr_free(), which frees them again. The fix sets bitmap pointers to NULL after freeing to prevent double free.

In the Linux kernel's mac80211 subsystem, a use-after-free vulnerability was found during mesh frame processing. The issue occurs when ieee80211_invoke_fast_rx() reads RX status via skb->cb, which is later overwritten by ieee80211_rx_mesh_data() with TX data, leading to access to freed or zeroed memory.

In the Linux kernel, the ipv6_hop_ioam() function lacked a NULL check for the pointer returned by __in6_dev_get(). During network interface teardown, this pointer can be NULL, leading to a NULL pointer dereference when processing an IOAM Hop-by-Hop option.

In the Linux kernel, a use-after-free (UAF) vulnerability was found in the vsock/vmci driver during connection handshake. When a peer sends a RST packet during handshake, the driver fails to properly remove the pending socket from the list, leading to double free and access to freed memory.

A vulnerability was found in the Linux kernel's IPv4 raw socket implementation. The raw_send_hdrinc() function fails to reject packets with ihl (Internet Header Length) less than 5, allowing malformed IP headers to be sent. This leads to an out-of-bounds memory access in ah_output() and a kernel panic.

A race condition was found in the Linux kernel's RBD (Ceph RADOS Block Device) driver during image unmap. The lock_dwork work item can be re-queued by maybe_kick_acquire() after cancellation, causing rbd_acquire_lock() to execute after resources are freed, violating an assertion about valid image format.

In the Linux kernel, a vulnerability was found in the LSM (Linux Security Module) mechanism. The lsm_set_self_attr() function does not hold the cred_guard_mutex, which may allow unauthorized changes to process security attributes, especially in the context of SELinux and AppArmor.

A memory leak vulnerability was found in the Linux kernel's igc driver for Intel network adapters. The igc_fpe_xmit_smd_frame() function fails to free an allocated skb buffer when igc_fpe_init_tx_descriptor() fails, causing a memory leak.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's unix_stream_data_wait() function for AF_UNIX sockets. The issue stems from a missing lock when reading the pointer to the last SKB in the receive queue, potentially leading to dereferencing freed memory. The flaw affects kernels from version 6.5 onward.

In the Linux kernel CIFS filesystem, a bug causes a busy dentry to be used after unmounting. The issue occurs when deferred file close work executes after unmount, triggering a warning in generic_shutdown_super.

In the Linux kernel's PCM512x driver, a null pointer dereference was found in pcm512x_overclock_xxx_put() functions. The issue arises from incorrectly using snd_soc_dapm_kcontrol_to_dapm() for a general mixer kcontrol, which should be replaced with snd_soc_component_to_dapm().

In the Linux kernel, a vulnerability was found in the KVM component for ARM64 architecture, related to memory management of the virtual Generic Interrupt Controller (vGIC). When vGIC initialization for a virtual CPU (vCPU) fails after allocating private IRQs, these IRQs are not freed, leading to a memory leak. The kvm_vgic_vcpu_destroy() call is missing in the error path of kvm_vgic_vcpu_init().

In the Linux kernel's sev-guest module, a vulnerability was found where pages remain in an unknown state when set_memory_{encrypted,decrypted}() fails. To prevent potential data leaks, these pages are not returned to the buddy allocator but are explicitly leaked via snp_leak_pages().

A use-after-free vulnerability was found in the Linux kernel's ISCI driver during device removal. The completion tasklet is not killed before the controller is torn down, allowing a race between interrupts and memory cleanup. After the ihost structure is freed, a delayed tasklet may still dereference freed memory, leading to a crash or potential exploitation.

In the Linux kernel, a vulnerability was found in the pds fwctl driver where RPC input size validation occurs after parsing. This can lead to an out-of-bounds read if the input size is smaller than the expected structure.