Linux kernel vulnerabilities

A deadlock was detected in the Linux kernel's MSM DRM driver during shrinker operation. The kswapd process, holding the fs_reclaim lock, attempts to acquire the reservation_ww_class_acquire lock, leading to a circular dependency and potential system deadlock.

In the Linux kernel's DRM V3D driver, a use-after-free vulnerability exists on the error path during CPU job handling. After v3d_job_cleanup() frees the job memory, subsequent reads of timestamp and performance query arrays cause memory corruption. Additionally, a NULL pointer dereference occurs on the early error path.

In the Linux kernel DRM driver for VirtIO, a vulnerability was found where the return value of the DMA reservation lock function (dma_resv_lock_interruptible) is ignored. If interrupted by a signal (-EINTR) or due to memory shortage (-ENOMEM), the lock is not held, leading to a race condition when adding fences and potentially corrupting the fence list.

In the Linux kernel's AMD/Display driver, an out-of-bounds read vulnerability was found. GPIO pin table parsers did not validate whether the declared structure size from VBIOS fits within the available BIOS image, allowing reads beyond its boundaries.

In the Linux kernel, a use-after-free vulnerability was found in the batman-adv module's batadv_mcast_purge_orig() function. It removes entries from RCU-protected hlists without waiting for an RCU grace period, allowing concurrent RCU readers to access freed memory.

In the Linux kernel's batman-adv (BLA) module, a vulnerability was found involving a double decrement of the bla.num_requests counter. The issue stems from non-atomic operations on the counter and the request_sent flag, leading to a race condition and incorrect state.

In the Linux kernel's batman-adv (BLA) module, a NULL pointer dereference vulnerability was found. It occurs when a hard interface (hardif) is detached from a mesh interface (meshif) without holding rtnl_lock, causing the meshif pointer to become NULL. Subsequent operations, such as sending an ARP request, trigger the flaw.

In the Linux kernel, the batman-adv (tp_meter) module had a vulnerability where batadv_tp_sender_cleanup() used an unsafe combination of timer_delete_sync() and timer_delete() to stop a timer. This could lead to the timer being re-armed after cleanup, causing a use-after-free condition.

In the Linux kernel, a reference leak of tp_vars was found in the batman-adv throughput meter receiver shutdown. The flaw stems from incorrect synchronization between the timer callback and batadv_tp_stop_all(), causing inconsistent resource release.

In the Linux kernel, a vulnerability was found in the batman-adv module where empty VLAN responses could be sent in the Translation Table (TT) protocol. The fix extends previous protections against TT request storms to also prevent sending inconsistent TT entries for replies from the global TT state.

In the Linux kernel's batman-adv module, a vulnerability was found due to incorrect typing of the `tt_buff_len` field as `s16` instead of `u16`. Values greater than 32767 wrap to negative numbers, causing full buffer allocation but only partial population, leaving the rest uninitialized.

In the Linux kernel's pmbus/adm1266 driver, a vulnerability was found due to missing validation of the record count in the BLACKBOX_INFO response. An attacker can supply an inflated value, causing an out-of-bounds read beyond the allocated buffer and potential memory corruption.

In the Linux kernel's pmbus/adm1266 driver, a buffer overflow vulnerability exists during block read operations. The read_buf declaration was one byte too small, causing out-of-bounds write when handling maximum-length responses (255 bytes + PEC byte).

A buffer overflow vulnerability was found in the pmbus/adm1266 driver of the Linux kernel. The adm1266_nvmem_read_blackbox() function passes a 64-byte buffer to the adm1266_pmbus_block_xfer() helper, which can write up to 255 bytes, causing memory corruption.

In the Linux kernel hwmon (pmbus/adm1266) driver, a vulnerability was found where the wrong constant (ADM1266_PDIO_STATUS instead of ADM1266_PDIO_NR) is used in the PDIO mask scanning loop. This causes out-of-bounds read from the caller's stack and potential out-of-bounds write to the bits array, leading to memory corruption.

In the Linux kernel hwmon (pmbus/adm1266) driver, a vulnerability was found due to missing validation of block-read response length in GPIO accessors. Functions adm1266_gpio_get() and adm1266_gpio_get_multiple() do not check if the response contains at least 2 bytes, leading to use of uninitialized stack memory when a short response (0 or 1 byte) is received. This data can be leaked to userspace via gpiolib (sysfs or ioctl), causing kernel stack memory disclosure.

In the Linux kernel for RISC-V, an uninitialized stack variable 'cregs' causes register corruption. Functions compat_riscv_gpr_set() and compat_restore_sigcontext() call cregs_to_regs() even after a failed user-space copy, writing uninitialized stack data into the target task's pt_regs.

In the Linux kernel, a vulnerability was found in the ARM FF-A driver due to missing validation of the framework notification message layout. Incorrect offset and size values can lead to out-of-bounds reads or oversized memory allocations.

In the Linux kernel netfilter/x_tables subsystem, a vulnerability exists where tables (ARP/IP/IPv6) are added to the per-netns list before allocating the hook ops copy. During concurrent netns exit, the pre_exit callback finds the table with a NULL ops pointer, causing a NULL dereference and a general protection fault.

In the Linux kernel netfilter/x_tables subsystem, a new function xtables_unregister_table_exit was added to replace xt_unregister_table(). This fixes an issue where during module removal (rmmod), users performing set/getsockopt could not re-instantiate the table because the larval table was already removed and the existing instance was no longer on the active table list.

In the Linux kernel, the netfilter ebtables module introduces a two-stage removal scheme to prevent a race condition during table operation assignment. The table->ops assignment is now performed while holding the ebt mutex, avoiding exposure of a partially filled table structure.

A race condition vulnerability was found in the Linux kernel's netfilter bridge eb_tables module during initialization. The sockopt registration occurs too early, before the module initialization is complete, exposing partially initialized structures globally.

In the Linux kernel, unregister_fprobe() lacked RCU grace period synchronization, potentially causing use-after-free after fprobe unregistration. This affects fprobe events and sample module code.

A vulnerability in the Linux kernel's statmount_mnt_idmap function can cause an out-of-bounds write on the seq buffer. The issue occurs because manual increment of seq->count after seq_printf() bypasses overflow detection, leading to a NULL byte write beyond the allocated buffer.

In the Linux kernel on PREEMPT_RT, a use-after-free vulnerability was found in irq_work_single(). After clearing the BUSY flag via atomic_cmpxchg(), the code still dereferences the work structure, which can be freed prematurely by another thread calling irq_work_sync().

In the Linux kernel, a vulnerability in the NVMe driver causes a bio leak when integrity mapping fails. The issue arises because the local bio variable is always NULL instead of being retrieved directly from the request.

In the Linux kernel, the nvme-pci driver has a use-after-free vulnerability in nvme_free_host_mem(). After freeing memory via dma_free_noncontiguous(), the dev->hmb_sgt pointer is not cleared, leading to a double-free and NULL pointer dereference when the function is called twice in an error path.

In the Linux kernel powerpc/hv-gpci subsystem, a preempt count leak was found in four sysfs show() functions. These functions call preempt_disable() via get_cpu_var() but fail to call put_cpu_var() on successful reads, causing the preempt counter to accumulate. After repeated reads, the kernel may return to userspace with preemption disabled, leading to SIGSEGV and 'BUG: scheduling while atomic' errors.

A bug in the Linux kernel's netfs_write_begin() function triggers a kernel panic (VM_BUG_ON_FOLIO) when attempting to unlock a folio that is not locked. The issue occurs with approximately 30% probability during repeated runs of the generic/013 test, causing system crashes.

A vulnerability in the Linux kernel's netfs subsystem occurs when netfs_invalidate_folio() fails to clear the dirty bit after all modified data in a folio is removed by truncation. This can cause a kernel oops during subsequent mmap() reads due to a missing netfs_folio structure.

In the Linux kernel netfs subsystem, a vulnerability was found where streaming writes could be overwritten incorrectly. When a partially written streaming write page was fully overwritten, the netfs_folio structure was not freed, leading to data corruption. The fix properly manages the netfs_folio structure and handles partial copy failures.

A potential deadlock was discovered in the Linux kernel's write-through mode within the netfs subsystem. The fix ensures netfs_advance_writethrough() always unlocks the supplied folio and marks it dirty if not fully written, preventing deadlocks against mmapped reads and writes.

A vulnerability in the Linux kernel where a reference leak occurs in netfs_write_begin() during error handling. The leak happens when netfs_wait_for_read() returns an error, leaving the request reference unreleased.

In the Linux kernel, netfs_perform_write() mishandles folio->private, potentially causing multiple private data attachments, folio ref leaks, and leaks of netfs_folio structs or netfs_group refs.

In the Linux kernel, the netfs_read_folio() function fails to wait for ongoing writeback to complete. This can lead to data corruption because the function trusts the dirty flag and folio->private data, which may be cleaned up before the writeback flag is cleared.

In the Linux kernel, the AFS filesystem has a vulnerability due to incorrect locking when handling symbolic links. This allows races between multiple get_link() calls, potentially leading to memory leaks or incorrect symlink content reads.

In the Linux kernel, a vulnerability was found in the net shaper mechanism. The net_shaper_nl_group_doit() function does not deduplicate NET_SHAPER_A_LEAVES entries, causing a double free of the same parent pointer in the cleanup loop. This occurs when userspace supplies the same leaf handle twice.

In the Linux kernel, a vulnerability was found in bio_integrity_copy_user() where overwriting bip_vcnt with nr_vecs breaks the bip_vcnt <= bip_max_vcnt invariant. On WRITE this causes out-of-bounds read of the bip_vec[] flex array, and on READ it reads incorrect data.

A vulnerability in the Linux kernel's bio_integrity_map_user() function mishandles partial pinning by pin_user_pages_fast(), causing a null-pointer dereference and a general protection fault.

In the Linux kernel, the accel/qaic driver lacks an overflow check in remap_pfn_range during mmap, allowing a buffer object (BO) that is too large to map beyond the VMA region. This can cause use-after-free issues when munmap() unmaps only the VMA region.

In the Linux kernel, a vulnerability was found due to mixing devm and drmm memory management functions in the MSM DPU graphics driver. This causes a use-after-free condition during driver teardown when userspace holds a reference to the DRM device.

In the Linux kernel's Adreno GPU driver, a vulnerability allows a user-triggered crash. On a2xx-a4xx generations, querying UBWC parameters from userspace can cause a NULL pointer dereference.

In the Linux kernel's SMC-D subsystem, a vulnerability exists where a malicious peer can reply to an SMC-Dv2 proposal with CHID=0, matching an empty slot in the ism_dev[] array. This leads to a NULL pointer dereference in smc_conn_create(), causing a kernel panic.

In the Linux kernel, a security flaw was found in the ovpn TCP driver's ovpn_tcp_close() function. It used the sock->peer pointer outside the RCU section, leading to a race condition and potential use-after-free.

In the Linux kernel's ovpn (OpenVPN) driver, a vulnerability was found due to improper reference counting (kref) handling in the error path of the CMD_NEW_PEER command. For TCP connections, a new peer may be accessible via the socket before being added to the hash table, and calling ovpn_peer_release() directly instead of ovpn_peer_put() leads to a use-after-free condition.

A race condition in the Linux kernel's ovpn driver can occur when deleting a network interface. In a narrow time window, adding a new peer via netlink may cause the netdevice to hang and prevent its unregistration.

A vulnerability in the Linux kernel's VFIO/PCI driver allows exporting unallocated BAR resources via DMABUF. Lack of reservation verification before export may lead to unauthorized memory access.

In the Linux kernel, a buffer overflow vulnerability was found in the fs210x audio codec driver. The fs210x_effect_scene_info() function used strscpy with an incorrect destination size (strlen(SRC)+1 instead of sizeof(DST)), which can lead to out-of-bounds write.

In the Linux kernel's cachefiles subsystem, an error occurs when vfs_mkdir() fails: the error code is not extracted from the returned error pointer, causing the function to return NULL instead of a proper error pointer, which may lead to incorrect behavior.

In the Linux kernel, a vulnerability was found in the MSM DRM driver's snapshot code. Internal 16-byte alignment caused incorrect dumping of DSI data (shifted by 4 bytes) and 16x memory overallocation. The fix removes length alignment and accurately prints last registers.